From 03dac604e9b8f6925042e7ced1c8f915a842acdb Mon Sep 17 00:00:00 2001 From: Bruno BELANYI Date: Sun, 24 Dec 2023 22:56:50 +0100 Subject: [PATCH] nixos: services: add pyload --- modules/nixos/services/default.nix | 1 + modules/nixos/services/pyload/default.nix | 77 +++++++++++++++++++++++ 2 files changed, 78 insertions(+) create mode 100644 modules/nixos/services/pyload/default.nix diff --git a/modules/nixos/services/default.nix b/modules/nixos/services/default.nix index 3e2b3c8..67504da 100644 --- a/modules/nixos/services/default.nix +++ b/modules/nixos/services/default.nix @@ -27,6 +27,7 @@ ./podgrab ./postgresql ./postgresql-backup + ./pyload ./quassel ./rss-bridge ./sabnzbd diff --git a/modules/nixos/services/pyload/default.nix b/modules/nixos/services/pyload/default.nix new file mode 100644 index 0000000..40bf12d --- /dev/null +++ b/modules/nixos/services/pyload/default.nix @@ -0,0 +1,77 @@ +{ config, lib, ... }: +let + cfg = config.my.services.pyload; +in +{ + options.my.services.pyload = with lib; { + enable = mkEnableOption "pyload download manager"; + + credentialsFile = mkOption { + type = types.path; + example = "/run/secrets/pyload-credentials.env"; + description = "pyload credentials"; + }; + + downloadDirectory = mkOption { + type = types.str; + default = "/data/downloads/pyload"; + example = "/var/lib/pyload/download"; + description = "Download directory"; + }; + + port = mkOption { + type = types.port; + default = 9093; + example = 8080; + description = "Internal port for webui"; + }; + }; + + config = lib.mkIf cfg.enable { + services.pyload = { + enable = true; + + # Listening on `localhost` leads to 502 with the reverse proxy... + listenAddress = "127.0.0.1"; + + inherit (cfg) + credentialsFile + downloadDirectory + port + ; + }; + + # Use pyload user/media group when downloading files + systemd.services.pyload = { + serviceConfig = { + User = lib.mkForce "pyload"; + Group = lib.mkForce "media"; + DynamicUser = lib.mkForce false; + }; + }; + + # And make sure the download directory has the correct owners + systemd.tmpfiles.settings.pyload = { + ${cfg.downloadDirectory}.d = { + user = "pyload"; + group = "media"; + }; + }; + + # Set-up pyload user and media group + users.users.pyload = { + isSystemUser = true; + group = "media"; + }; + + users.groups.media = { }; + + my.services.nginx.virtualHosts = { + pyload = { + inherit (cfg) port; + }; + }; + + # FIXME: fail2ban + }; +}