Alexander
908c37f73f
Module manages PostgreSQL (both databases + schema init), qBittorrent (VPN-confined via VPN-Confinement), Jackett, metadata-agregator, musicfs, and the main orchestrator. All services are independently enableable with auto-wired inter-service configuration. Includes NixOS VM test validating PostgreSQL setup, schema initialization, service startup, and directory creation. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/claude-agent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
49 lines
1.1 KiB
Nix
49 lines
1.1 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
...
|
|
}:
|
|
|
|
let
|
|
cfg = config.services.agregators;
|
|
vpnCfg = cfg.vpn;
|
|
in
|
|
{
|
|
options.services.agregators.vpn = {
|
|
enable = lib.mkEnableOption "WireGuard VPN via VPN-Confinement for torrent traffic";
|
|
|
|
wgConfigFile = lib.mkOption {
|
|
type = lib.types.path;
|
|
description = ''
|
|
Path to WireGuard configuration file.
|
|
Must not be in the Nix store — use a runtime path.
|
|
'';
|
|
example = "/run/secrets/wireguard.conf";
|
|
};
|
|
|
|
accessibleFrom = lib.mkOption {
|
|
type = lib.types.listOf lib.types.str;
|
|
default = [
|
|
"192.168.1.0/24"
|
|
"192.168.0.0/24"
|
|
"127.0.0.1"
|
|
];
|
|
description = "CIDRs allowed to reach services inside the VPN namespace.";
|
|
};
|
|
|
|
namespace = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "wg";
|
|
description = "Name of the VPN network namespace.";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf (cfg.enable && vpnCfg.enable) {
|
|
vpnNamespaces.${vpnCfg.namespace} = {
|
|
enable = true;
|
|
wireguardConfigFile = vpnCfg.wgConfigFile;
|
|
accessibleFrom = vpnCfg.accessibleFrom;
|
|
};
|
|
};
|
|
}
|