From 263b6c9a80bebd44ad38a8b19c4ee4985121f415 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 11:00:10 +0000
Subject: [PATCH 01/11] nixos: services: servarr: fix 'enableAll' logic

I renamed the option and refactored how it worked to make it more
explicit that it enables the entire suite by default, with explicit
opt-out of individual components (or fine-grained opt-in as an
alternative).
---
 modules/nixos/services/servarr/default.nix | 20 +++++++++-----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/modules/nixos/services/servarr/default.nix b/modules/nixos/services/servarr/default.nix
index e25d9cf..65c409a 100644
--- a/modules/nixos/services/servarr/default.nix
+++ b/modules/nixos/services/servarr/default.nix
@@ -19,6 +19,8 @@ let
       enable = true;
       group = "media";
     };
+    # Set-up media group
+    users.groups.media = { };
   };
 
   mkRedirection = service: {
@@ -54,34 +56,30 @@ let
 in
 {
   options.my.services.servarr = {
-    enable = lib.mkEnableOption "Media automation";
+    enableAll = lib.mkEnableOption "media automation suite";
 
     bazarr = {
-      enable = lib.my.mkDisableOption "Bazarr";
+      enable = lib.mkEnableOption "Bazarr" // { default = cfg.enableAll; };;
     };
 
     lidarr = {
-      enable = lib.my.mkDisableOption "Lidarr";
+      enable = lib.mkEnableOption "Lidarr" // { default = cfg.enableAll; };
     };
 
     radarr = {
-      enable = lib.my.mkDisableOption "Radarr";
+      enable = lib.mkEnableOption "Radarr" // { default = cfg.enableAll; };
     };
 
     readarr = {
-      enable = lib.my.mkDisableOption "Readarr";
+      enable = lib.mkEnableOption "Readarr" // { default = cfg.enableAll; };
     };
 
     sonarr = {
-      enable = lib.my.mkDisableOption "Sonarr";
+      enable = lib.mkEnableOption "Sonarr" // { default = cfg.enableAll; };
     };
   };
 
-  config = lib.mkIf cfg.enable (lib.mkMerge [
-    {
-      # Set-up media group
-      users.groups.media = { };
-    }
+  config = (lib.mkMerge [
     # Bazarr does not log authentication failures...
     (mkFullConfig "bazarr")
     # Lidarr for music

From 2875f6dd5c242536e5e4ed3de14c3b22e73b1675 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 10:51:21 +0000
Subject: [PATCH 02/11] nixos: services: servarr: extract bazarr

It's not an actual *arr package, but closely related to them. Extract
its configuration to a sub-module.
---
 modules/nixos/services/servarr/bazarr.nix  | 29 ++++++++++++++++++++++
 modules/nixos/services/servarr/default.nix | 11 +++-----
 2 files changed, 33 insertions(+), 7 deletions(-)
 create mode 100644 modules/nixos/services/servarr/bazarr.nix

diff --git a/modules/nixos/services/servarr/bazarr.nix b/modules/nixos/services/servarr/bazarr.nix
new file mode 100644
index 0000000..ff632f9
--- /dev/null
+++ b/modules/nixos/services/servarr/bazarr.nix
@@ -0,0 +1,29 @@
+{ config, lib, ... }:
+let
+  cfg = config.my.services.servarr.bazarr;
+in
+{
+  options.my.services.servarr = with lib; {
+    enable = lib.mkEnableOption "Bazarr" // {
+      default = config.my.services.servarr.enableAll;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.bazarr = {
+      enable = true;
+      group = "media";
+    };
+
+    # Set-up media group
+    users.groups.media = { };
+
+    my.services.nginx.virtualHosts = {
+      bazarr = {
+        port = 6767;
+      };
+    };
+
+    # Bazarr does not log authentication failures...
+  };
+}
diff --git a/modules/nixos/services/servarr/default.nix b/modules/nixos/services/servarr/default.nix
index 65c409a..53fd14b 100644
--- a/modules/nixos/services/servarr/default.nix
+++ b/modules/nixos/services/servarr/default.nix
@@ -7,7 +7,6 @@ let
   cfg = config.my.services.servarr;
 
   ports = {
-    bazarr = 6767;
     lidarr = 8686;
     radarr = 7878;
     readarr = 8787;
@@ -55,13 +54,13 @@ let
   ]);
 in
 {
+  imports = [
+    ./bazarr.nix
+  ];
+
   options.my.services.servarr = {
     enableAll = lib.mkEnableOption "media automation suite";
 
-    bazarr = {
-      enable = lib.mkEnableOption "Bazarr" // { default = cfg.enableAll; };;
-    };
-
     lidarr = {
       enable = lib.mkEnableOption "Lidarr" // { default = cfg.enableAll; };
     };
@@ -80,8 +79,6 @@ in
   };
 
   config = (lib.mkMerge [
-    # Bazarr does not log authentication failures...
-    (mkFullConfig "bazarr")
     # Lidarr for music
     (mkFullConfig "lidarr")
     (mkFail2Ban "lidarr")

From cb294ea0d0a0b14f5dc2fda258e33f05aae63f40 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 10:53:32 +0000
Subject: [PATCH 03/11] nixos: services: servarr: bazarr: add 'port'

---
 modules/nixos/services/servarr/bazarr.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/modules/nixos/services/servarr/bazarr.nix b/modules/nixos/services/servarr/bazarr.nix
index ff632f9..01af9c4 100644
--- a/modules/nixos/services/servarr/bazarr.nix
+++ b/modules/nixos/services/servarr/bazarr.nix
@@ -7,12 +7,20 @@ in
     enable = lib.mkEnableOption "Bazarr" // {
       default = config.my.services.servarr.enableAll;
     };
+
+    port = mkOption {
+      type = types.port;
+      default = 6767;
+      example = 8080;
+      description = "Internal port for webui";
+    };
   };
 
   config = lib.mkIf cfg.enable {
     services.bazarr = {
       enable = true;
       group = "media";
+      listenPort = cfg.port;
     };
 
     # Set-up media group
@@ -20,7 +28,7 @@ in
 
     my.services.nginx.virtualHosts = {
       bazarr = {
-        port = 6767;
+        inherit (cfg) port;
       };
     };
 

From d978787598d2bd78cb089630e19d2d0f3bc0dc16 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 11:07:21 +0000
Subject: [PATCH 04/11] nixox: services: servarr: refactor starr config

Makes it slightly DRY-er and more readable.
---
 modules/nixos/services/servarr/default.nix | 87 ++--------------------
 modules/nixos/services/servarr/starr.nix   | 51 +++++++++++++
 2 files changed, 56 insertions(+), 82 deletions(-)
 create mode 100644 modules/nixos/services/servarr/starr.nix

diff --git a/modules/nixos/services/servarr/default.nix b/modules/nixos/services/servarr/default.nix
index 53fd14b..398461b 100644
--- a/modules/nixos/services/servarr/default.nix
+++ b/modules/nixos/services/servarr/default.nix
@@ -2,94 +2,17 @@
 # Relevant link [1].
 #
 # [1]: https://youtu.be/I26Ql-uX6AM
-{ config, lib, ... }:
-let
-  cfg = config.my.services.servarr;
-
-  ports = {
-    lidarr = 8686;
-    radarr = 7878;
-    readarr = 8787;
-    sonarr = 8989;
-  };
-
-  mkService = service: {
-    services.${service} = {
-      enable = true;
-      group = "media";
-    };
-    # Set-up media group
-    users.groups.media = { };
-  };
-
-  mkRedirection = service: {
-    my.services.nginx.virtualHosts = {
-      ${service} = {
-        port = ports.${service};
-      };
-    };
-  };
-
-  mkFail2Ban = service: lib.mkIf cfg.${service}.enable {
-    services.fail2ban.jails = {
-      ${service} = ''
-        enabled = true
-        filter = ${service}
-        action = iptables-allports
-      '';
-    };
-
-    environment.etc = {
-      "fail2ban/filter.d/${service}.conf".text = ''
-        [Definition]
-        failregex = ^.*\|Warn\|Auth\|Auth-Failure ip <HOST> username .*$
-        journalmatch = _SYSTEMD_UNIT=${service}.service
-      '';
-    };
-  };
-
-  mkFullConfig = service: lib.mkIf cfg.${service}.enable (lib.mkMerge [
-    (mkService service)
-    (mkRedirection service)
-  ]);
-in
+{ lib, ... }:
 {
   imports = [
     ./bazarr.nix
+    (import ./starr.nix "lidarr")
+    (import ./starr.nix "radarr")
+    (import ./starr.nix "readarr")
+    (import ./starr.nix "sonarr")
   ];
 
   options.my.services.servarr = {
     enableAll = lib.mkEnableOption "media automation suite";
-
-    lidarr = {
-      enable = lib.mkEnableOption "Lidarr" // { default = cfg.enableAll; };
-    };
-
-    radarr = {
-      enable = lib.mkEnableOption "Radarr" // { default = cfg.enableAll; };
-    };
-
-    readarr = {
-      enable = lib.mkEnableOption "Readarr" // { default = cfg.enableAll; };
-    };
-
-    sonarr = {
-      enable = lib.mkEnableOption "Sonarr" // { default = cfg.enableAll; };
-    };
   };
-
-  config = (lib.mkMerge [
-    # Lidarr for music
-    (mkFullConfig "lidarr")
-    (mkFail2Ban "lidarr")
-    # Radarr for movies
-    (mkFullConfig "radarr")
-    (mkFail2Ban "radarr")
-    # Readarr for books
-    (mkFullConfig "readarr")
-    (mkFail2Ban "readarr")
-    # Sonarr for shows
-    (mkFullConfig "sonarr")
-    (mkFail2Ban "sonarr")
-  ]);
 }
diff --git a/modules/nixos/services/servarr/starr.nix b/modules/nixos/services/servarr/starr.nix
new file mode 100644
index 0000000..e9c84f9
--- /dev/null
+++ b/modules/nixos/services/servarr/starr.nix
@@ -0,0 +1,51 @@
+# Templated *arr configuration
+starr:
+{ config, lib, ... }:
+let
+  cfg = config.my.services.servarr.${starr};
+  ports = {
+    lidarr = 8686;
+    radarr = 7878;
+    readarr = 8787;
+    sonarr = 8989;
+  };
+in
+{
+  options.my.services.servarr.${starr} = with lib; {
+    enable = lib.mkEnableOption (lib.toSentenceCase starr) // {
+      default = config.my.services.servarr.enableAll;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.${starr} = {
+      enable = true;
+      group = "media";
+    };
+
+    # Set-up media group
+    users.groups.media = { };
+
+    my.services.nginx.virtualHosts = {
+      ${starr} = {
+        port = ports.${starr};
+      };
+    };
+
+    services.fail2ban.jails = {
+      ${starr} = ''
+        enabled = true
+        filter = ${starr}
+        action = iptables-allports
+      '';
+    };
+
+    environment.etc = {
+      "fail2ban/filter.d/${starr}.conf".text = ''
+        [Definition]
+        failregex = ^.*\|Warn\|Auth\|Auth-Failure ip <HOST> username .*$
+        journalmatch = _SYSTEMD_UNIT=${starr}.service
+      '';
+    };
+  };
+}

From ad5cbd23c147b53b485d45f979f984cc48e90062 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 11:12:16 +0000
Subject: [PATCH 05/11] nixos: services: servarr: starr: add 'port'

Now that declarative configurations are supported for those
applications.
---
 modules/nixos/services/servarr/starr.nix | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/modules/nixos/services/servarr/starr.nix b/modules/nixos/services/servarr/starr.nix
index e9c84f9..2bf7c11 100644
--- a/modules/nixos/services/servarr/starr.nix
+++ b/modules/nixos/services/servarr/starr.nix
@@ -15,12 +15,25 @@ in
     enable = lib.mkEnableOption (lib.toSentenceCase starr) // {
       default = config.my.services.servarr.enableAll;
     };
+
+    port = mkOption {
+      type = types.port;
+      default = ports.${starr};
+      example = 8080;
+      description = "Internal port for webui";
+    };
   };
 
   config = lib.mkIf cfg.enable {
     services.${starr} = {
       enable = true;
       group = "media";
+
+      settings = {
+        server = {
+          port = cfg.port;
+        };
+      };
     };
 
     # Set-up media group
@@ -28,7 +41,7 @@ in
 
     my.services.nginx.virtualHosts = {
       ${starr} = {
-        port = ports.${starr};
+        port = cfg.port;
       };
     };
 

From 1a08118ced751266d079d57e89aff791476b4bd3 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 11:21:24 +0000
Subject: [PATCH 06/11] nixos: services: servarr: migrate prowlarr

It's configured in the exact same way as other *arr apps, and thus
automatically gains the declarative port configuration now.

I also want to move the other two indexer modules under `servarr`, as
they are all closely related.
---
 hosts/nixos/porthos/services.nix            |  4 ---
 modules/nixos/services/indexers/default.nix | 30 ---------------------
 modules/nixos/services/servarr/default.nix  |  1 +
 modules/nixos/services/servarr/starr.nix    |  1 +
 4 files changed, 2 insertions(+), 34 deletions(-)

diff --git a/hosts/nixos/porthos/services.nix b/hosts/nixos/porthos/services.nix
index ffd150a..4cae667 100644
--- a/hosts/nixos/porthos/services.nix
+++ b/hosts/nixos/porthos/services.nix
@@ -51,10 +51,6 @@ in
         passwordFile = secrets."forgejo/mail-password".path;
       };
     };
-    # Meta-indexers
-    indexers = {
-      prowlarr.enable = true;
-    };
     # Jellyfin media server
     jellyfin.enable = true;
     # Gitea mirrorig service
diff --git a/modules/nixos/services/indexers/default.nix b/modules/nixos/services/indexers/default.nix
index 8a42345..00bf316 100644
--- a/modules/nixos/services/indexers/default.nix
+++ b/modules/nixos/services/indexers/default.nix
@@ -5,13 +5,11 @@ let
 
   jackettPort = 9117;
   nzbhydraPort = 5076;
-  prowlarrPort = 9696;
 in
 {
   options.my.services.indexers = with lib; {
     jackett.enable = mkEnableOption "Jackett torrent meta-indexer";
     nzbhydra.enable = mkEnableOption "NZBHydra2 usenet meta-indexer";
-    prowlarr.enable = mkEnableOption "Prowlarr torrent & usenet meta-indexer";
   };
 
   config = lib.mkMerge [
@@ -46,33 +44,5 @@ in
         };
       };
     })
-
-    (lib.mkIf cfg.prowlarr.enable {
-      services.prowlarr = {
-        enable = true;
-      };
-
-      my.services.nginx.virtualHosts = {
-        prowlarr = {
-          port = prowlarrPort;
-        };
-      };
-
-      services.fail2ban.jails = {
-        prowlarr = ''
-          enabled = true
-          filter = prowlarr
-          action = iptables-allports
-        '';
-      };
-
-      environment.etc = {
-        "fail2ban/filter.d/prowlarr.conf".text = ''
-          [Definition]
-          failregex = ^.*\|Warn\|Auth\|Auth-Failure ip <HOST> username .*$
-          journalmatch = _SYSTEMD_UNIT=prowlarr.service
-        '';
-      };
-    })
   ];
 }
diff --git a/modules/nixos/services/servarr/default.nix b/modules/nixos/services/servarr/default.nix
index 398461b..a08c5d0 100644
--- a/modules/nixos/services/servarr/default.nix
+++ b/modules/nixos/services/servarr/default.nix
@@ -7,6 +7,7 @@
   imports = [
     ./bazarr.nix
     (import ./starr.nix "lidarr")
+    (import ./starr.nix "prowlarr")
     (import ./starr.nix "radarr")
     (import ./starr.nix "readarr")
     (import ./starr.nix "sonarr")
diff --git a/modules/nixos/services/servarr/starr.nix b/modules/nixos/services/servarr/starr.nix
index 2bf7c11..3b0e3ec 100644
--- a/modules/nixos/services/servarr/starr.nix
+++ b/modules/nixos/services/servarr/starr.nix
@@ -5,6 +5,7 @@ let
   cfg = config.my.services.servarr.${starr};
   ports = {
     lidarr = 8686;
+    prowlarr = 9696;
     radarr = 7878;
     readarr = 8787;
     sonarr = 8989;

From 51cbbb0b7b6117c519f21c6ca69c041da6c8d878 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 11:27:18 +0000
Subject: [PATCH 07/11] nixos: services: servarr: migrate jackett

---
 hosts/nixos/porthos/services.nix            |  4 +++
 modules/nixos/services/indexers/default.nix | 22 --------------
 modules/nixos/services/servarr/default.nix  |  1 +
 modules/nixos/services/servarr/jackett.nix  | 33 +++++++++++++++++++++
 4 files changed, 38 insertions(+), 22 deletions(-)
 create mode 100644 modules/nixos/services/servarr/jackett.nix

diff --git a/hosts/nixos/porthos/services.nix b/hosts/nixos/porthos/services.nix
index 4cae667..b4ab6ab 100644
--- a/hosts/nixos/porthos/services.nix
+++ b/hosts/nixos/porthos/services.nix
@@ -145,6 +145,10 @@ in
       lidarr = {
         enable = false;
       };
+      # I only use Prowlarr nowadays
+      jackett = {
+        enable = false;
+      };
     };
     # Because I still need to play sysadmin
     ssh-server.enable = true;
diff --git a/modules/nixos/services/indexers/default.nix b/modules/nixos/services/indexers/default.nix
index 00bf316..5d81079 100644
--- a/modules/nixos/services/indexers/default.nix
+++ b/modules/nixos/services/indexers/default.nix
@@ -3,36 +3,14 @@
 let
   cfg = config.my.services.indexers;
 
-  jackettPort = 9117;
   nzbhydraPort = 5076;
 in
 {
   options.my.services.indexers = with lib; {
-    jackett.enable = mkEnableOption "Jackett torrent meta-indexer";
     nzbhydra.enable = mkEnableOption "NZBHydra2 usenet meta-indexer";
   };
 
   config = lib.mkMerge [
-    (lib.mkIf cfg.jackett.enable {
-      services.jackett = {
-        enable = true;
-      };
-
-      # Jackett wants to eat *all* my RAM if left to its own devices
-      systemd.services.jackett = {
-        serviceConfig = {
-          MemoryHigh = "15%";
-          MemoryMax = "25%";
-        };
-      };
-
-      my.services.nginx.virtualHosts = {
-        jackett = {
-          port = jackettPort;
-        };
-      };
-    })
-
     (lib.mkIf cfg.nzbhydra.enable {
       services.nzbhydra2 = {
         enable = true;
diff --git a/modules/nixos/services/servarr/default.nix b/modules/nixos/services/servarr/default.nix
index a08c5d0..4c4e8dd 100644
--- a/modules/nixos/services/servarr/default.nix
+++ b/modules/nixos/services/servarr/default.nix
@@ -6,6 +6,7 @@
 {
   imports = [
     ./bazarr.nix
+    ./jackett.nix
     (import ./starr.nix "lidarr")
     (import ./starr.nix "prowlarr")
     (import ./starr.nix "radarr")
diff --git a/modules/nixos/services/servarr/jackett.nix b/modules/nixos/services/servarr/jackett.nix
new file mode 100644
index 0000000..f05905a
--- /dev/null
+++ b/modules/nixos/services/servarr/jackett.nix
@@ -0,0 +1,33 @@
+{ config, lib, ... }:
+let
+  cfg = config.my.services.servarr.jackett;
+in
+{
+  options.my.services.servarr = with lib; {
+    enable = lib.mkEnableOption "Jackett" // {
+      default = config.my.services.servarr.enableAll;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.jackett = {
+      enable = true;
+    };
+
+    # Jackett wants to eat *all* my RAM if left to its own devices
+    systemd.services.jackett = {
+      serviceConfig = {
+        MemoryHigh = "15%";
+        MemoryMax = "25%";
+      };
+    };
+
+    my.services.nginx.virtualHosts = {
+      jackett = {
+        port = 9117;
+      };
+    };
+
+    # Jackett does not log authentication failures...
+  };
+}

From 495098aa4c01232b0c3d9a024d8ac394214a0a90 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 11:28:04 +0000
Subject: [PATCH 08/11] nixos: services: servarr: jackett: add 'port'

---
 modules/nixos/services/servarr/jackett.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/modules/nixos/services/servarr/jackett.nix b/modules/nixos/services/servarr/jackett.nix
index f05905a..c838c52 100644
--- a/modules/nixos/services/servarr/jackett.nix
+++ b/modules/nixos/services/servarr/jackett.nix
@@ -7,11 +7,19 @@ in
     enable = lib.mkEnableOption "Jackett" // {
       default = config.my.services.servarr.enableAll;
     };
+
+    port = mkOption {
+      type = types.port;
+      default = 9117;
+      example = 8080;
+      description = "Internal port for webui";
+    };
   };
 
   config = lib.mkIf cfg.enable {
     services.jackett = {
       enable = true;
+      inherit (cfg) port;
     };
 
     # Jackett wants to eat *all* my RAM if left to its own devices
@@ -24,7 +32,7 @@ in
 
     my.services.nginx.virtualHosts = {
       jackett = {
-        port = 9117;
+        inherit (cfg) port;
       };
     };
 

From b19d5bf218ae24db068129297290db714ce2df41 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 11:32:39 +0000
Subject: [PATCH 09/11] nixos: services: servarr: migrate nzbhydra

---
 hosts/nixos/porthos/services.nix            |  3 +++
 modules/nixos/services/default.nix          |  1 -
 modules/nixos/services/indexers/default.nix | 26 ---------------------
 modules/nixos/services/servarr/default.nix  |  1 +
 modules/nixos/services/servarr/nzbhydra.nix | 25 ++++++++++++++++++++
 5 files changed, 29 insertions(+), 27 deletions(-)
 delete mode 100644 modules/nixos/services/indexers/default.nix
 create mode 100644 modules/nixos/services/servarr/nzbhydra.nix

diff --git a/hosts/nixos/porthos/services.nix b/hosts/nixos/porthos/services.nix
index b4ab6ab..45a6bd2 100644
--- a/hosts/nixos/porthos/services.nix
+++ b/hosts/nixos/porthos/services.nix
@@ -149,6 +149,9 @@ in
       jackett = {
         enable = false;
       };
+      nzbhydra = {
+        enable = false;
+      };
     };
     # Because I still need to play sysadmin
     ssh-server.enable = true;
diff --git a/modules/nixos/services/default.nix b/modules/nixos/services/default.nix
index 3992385..27f8765 100644
--- a/modules/nixos/services/default.nix
+++ b/modules/nixos/services/default.nix
@@ -15,7 +15,6 @@
     ./gitea
     ./grocy
     ./homebox
-    ./indexers
     ./jellyfin
     ./komga
     ./lohr
diff --git a/modules/nixos/services/indexers/default.nix b/modules/nixos/services/indexers/default.nix
deleted file mode 100644
index 5d81079..0000000
--- a/modules/nixos/services/indexers/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-# Torrent and usenet meta-indexers
-{ config, lib, ... }:
-let
-  cfg = config.my.services.indexers;
-
-  nzbhydraPort = 5076;
-in
-{
-  options.my.services.indexers = with lib; {
-    nzbhydra.enable = mkEnableOption "NZBHydra2 usenet meta-indexer";
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf cfg.nzbhydra.enable {
-      services.nzbhydra2 = {
-        enable = true;
-      };
-
-      my.services.nginx.virtualHosts = {
-        nzbhydra = {
-          port = nzbhydraPort;
-        };
-      };
-    })
-  ];
-}
diff --git a/modules/nixos/services/servarr/default.nix b/modules/nixos/services/servarr/default.nix
index 4c4e8dd..8fd9b20 100644
--- a/modules/nixos/services/servarr/default.nix
+++ b/modules/nixos/services/servarr/default.nix
@@ -7,6 +7,7 @@
   imports = [
     ./bazarr.nix
     ./jackett.nix
+    ./nzbhydra.nix
     (import ./starr.nix "lidarr")
     (import ./starr.nix "prowlarr")
     (import ./starr.nix "radarr")
diff --git a/modules/nixos/services/servarr/nzbhydra.nix b/modules/nixos/services/servarr/nzbhydra.nix
new file mode 100644
index 0000000..f040bf0
--- /dev/null
+++ b/modules/nixos/services/servarr/nzbhydra.nix
@@ -0,0 +1,25 @@
+{ config, lib, ... }:
+let
+  cfg = config.my.services.servarr.nzbhydra;
+in
+{
+  options.my.services.servarr = with lib; {
+    enable = lib.mkEnableOption "NZBHydra2" // {
+      default = config.my.services.servarr.enableAll;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.nzbhydra2 = {
+      enable = true;
+    };
+
+    my.services.nginx.virtualHosts = {
+      nzbhydra = {
+        port = 5076;
+      };
+    };
+
+    # NZBHydra2 does not log authentication failures...
+  };
+}

From f312c80e55304ad84d95923e0cfd33572dbd9c95 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 11:34:25 +0000
Subject: [PATCH 10/11] nixos: services: servarr: nzbhydra: fix websockets

From what I could read, NZBHydra2 *might* require proxying websockets in
new versions (better safe than sorry).
---
 modules/nixos/services/servarr/nzbhydra.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/nixos/services/servarr/nzbhydra.nix b/modules/nixos/services/servarr/nzbhydra.nix
index f040bf0..05742d6 100644
--- a/modules/nixos/services/servarr/nzbhydra.nix
+++ b/modules/nixos/services/servarr/nzbhydra.nix
@@ -17,6 +17,7 @@ in
     my.services.nginx.virtualHosts = {
       nzbhydra = {
         port = 5076;
+        websocketsLocations = [ "/" ];
       };
     };
 

From 4d6e7140ef8ef3e626963cd1d723efb5663eeb35 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 31 Mar 2025 15:30:54 +0000
Subject: [PATCH 11/11] fixup! nixos: services: servarr: fix 'enableAll' logic

---
 hosts/nixos/porthos/services.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hosts/nixos/porthos/services.nix b/hosts/nixos/porthos/services.nix
index 45a6bd2..7efddfa 100644
--- a/hosts/nixos/porthos/services.nix
+++ b/hosts/nixos/porthos/services.nix
@@ -140,7 +140,7 @@ in
     sabnzbd.enable = true;
     # The whole *arr software suite
     servarr = {
-      enable = true;
+      enableAll = true;
       # ... But not Lidarr because I don't care for music that much
       lidarr = {
         enable = false;