From 21ec3dbb26d2467fbe426521d8a0344bbeb86e92 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 24 Dec 2023 22:56:50 +0100
Subject: [PATCH] nixos: services: add pyload

---
 modules/nixos/services/default.nix        |  1 +
 modules/nixos/services/pyload/default.nix | 70 +++++++++++++++++++++++
 2 files changed, 71 insertions(+)
 create mode 100644 modules/nixos/services/pyload/default.nix

diff --git a/modules/nixos/services/default.nix b/modules/nixos/services/default.nix
index 3e2b3c8..67504da 100644
--- a/modules/nixos/services/default.nix
+++ b/modules/nixos/services/default.nix
@@ -27,6 +27,7 @@
     ./podgrab
     ./postgresql
     ./postgresql-backup
+    ./pyload
     ./quassel
     ./rss-bridge
     ./sabnzbd
diff --git a/modules/nixos/services/pyload/default.nix b/modules/nixos/services/pyload/default.nix
new file mode 100644
index 0000000..3751301
--- /dev/null
+++ b/modules/nixos/services/pyload/default.nix
@@ -0,0 +1,70 @@
+{ config, lib, ... }:
+let
+  cfg = config.my.services.pyload;
+in
+{
+  options.my.services.pyload = with lib; {
+    enable = mkEnableOption "pyload download manager";
+
+    credentialsFile = mkOption {
+      type = types.path;
+      example = "/run/secrets/pyload-credentials.env";
+      description = "pyload credentials";
+    };
+
+    downloadDirectory = mkOption {
+      type = types.str;
+      default = "/data/downloads/pyload";
+      example = "/var/lib/pyload/download";
+      description = "Download directory";
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 9093;
+      example = 8080;
+      description = "Internal port for webui";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.pyload = {
+      enable = true;
+
+      # Listening on `localhost` leads to 502 with the reverse proxy...
+      listenAddress = "127.0.0.1";
+
+      inherit (cfg)
+        credentialsFile
+        downloadDirectory
+        port
+        ;
+    };
+
+    # User media group when downloading files
+    systemd.services.pyload = {
+      serviceConfig = {
+        Group = lib.mkForce "media";
+      };
+    };
+
+    # And make sure the download directory has the correct owners
+    systemd.tmpfiles.settings.pyload = {
+      ${cfg.downloadDirectory}.d = {
+        user = "pyload";
+        group = "media";
+      };
+    };
+
+    # Set-up media group
+    users.groups.media = { };
+
+    my.services.nginx.virtualHosts = {
+      pyload = {
+        inherit (cfg) port;
+      };
+    };
+
+    # FIXME: fail2ban
+  };
+}