Added plex
This commit is contained in:
rasmus-kirk
@@ -34,6 +34,11 @@ with lib; let
|
||||
chown -R streamer:root "${cfg.jellyfin.stateDir}"
|
||||
find "${cfg.jellyfin.stateDir}" \( -type d -exec chmod 0700 {} + -true \) -o \( -exec chmod 0600 {} + \)
|
||||
''
|
||||
+ strings.optionalString cfg.plex.enable ''
|
||||
chown -R streamer:media "${cfg.mediaDir}/library"
|
||||
chown -R streamer:root "${cfg.plex.stateDir}"
|
||||
find "${cfg.plex.stateDir}" \( -type d -exec chmod 0700 {} + -true \) -o \( -exec chmod 0600 {} + \)
|
||||
''
|
||||
+ strings.optionalString cfg.transmission.enable ''
|
||||
chown -R torrenter:media "${cfg.mediaDir}/torrents"
|
||||
chown -R torrenter:cross-seed "${cfg.transmission.stateDir}"
|
||||
@@ -85,6 +90,7 @@ in {
|
||||
imports = [
|
||||
./jellyfin
|
||||
./jellyseerr
|
||||
./plex
|
||||
./bazarr
|
||||
./ddns
|
||||
./radarr
|
||||
@@ -125,6 +131,7 @@ in {
|
||||
|
||||
- [Jellyfin](#nixarr.jellyfin.enable)
|
||||
- [Jellyseerr](#nixarr.jellyseerr.enable)
|
||||
- [Plex](#nixarr.plex.enable)
|
||||
- [Bazarr](#nixarr.bazarr.enable)
|
||||
- [Lidarr](#nixarr.lidarr.enable)
|
||||
- [Prowlarr](#nixarr.prowlarr.enable)
|
||||
|
||||
@@ -0,0 +1,246 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
cfg = config.nixarr.plex;
|
||||
defaultPort = 32400;
|
||||
nixarr = config.nixarr;
|
||||
in
|
||||
with lib; {
|
||||
options.nixarr.plex = {
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
example = true;
|
||||
description = ''
|
||||
Whether or not to enable the Plex service.
|
||||
|
||||
**Required options:** [`nixarr.enable`](#nixarr.enable)
|
||||
'';
|
||||
};
|
||||
|
||||
package = mkPackageOption pkgs "plexmediaserver" {};
|
||||
|
||||
stateDir = mkOption {
|
||||
type = types.path;
|
||||
default = "${nixarr.stateDir}/plex";
|
||||
defaultText = literalExpression ''"''${nixarr.stateDir}/plex"'';
|
||||
example = "/nixarr/.state/plex";
|
||||
description = ''
|
||||
The location of the state directory for the Plex service.
|
||||
|
||||
> **Warning:** Setting this to any path, where the subpath is not
|
||||
> owned by root, will fail! For example:
|
||||
>
|
||||
> ```nix
|
||||
> stateDir = /home/user/nixarr/.state/plex
|
||||
> ```
|
||||
>
|
||||
> Is not supported, because `/home/user` is owned by `user`.
|
||||
'';
|
||||
};
|
||||
|
||||
openFirewall = mkOption {
|
||||
type = types.bool;
|
||||
defaultText = literalExpression ''!nixarr.plex.vpn.enable'';
|
||||
default = !cfg.vpn.enable;
|
||||
example = true;
|
||||
description = "Open firewall for Plex";
|
||||
};
|
||||
|
||||
vpn.enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
example = true;
|
||||
description = ''
|
||||
**Required options:** [`nixarr.vpn.enable`](#nixarr.vpn.enable)
|
||||
|
||||
**Conflicting options:** [`nixarr.plex.expose.https.enable`](#nixarr.plex.expose.https.enable)
|
||||
|
||||
Route Plex traffic through the VPN.
|
||||
'';
|
||||
};
|
||||
|
||||
expose = {
|
||||
https = {
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
example = true;
|
||||
description = ''
|
||||
**Required options:**
|
||||
|
||||
- [`nixarr.plex.expose.https.acmeMail`](#nixarr.plex.expose.https.acmemail)
|
||||
- [`nixarr.plex.expose.https.domainName`](#nixarr.plex.expose.https.domainname)
|
||||
|
||||
**Conflicting options:** [`nixarr.plex.vpn.enable`](#nixarr.plex.vpn.enable)
|
||||
|
||||
Expose the Plex web service to the internet with https support,
|
||||
allowing anyone to access it.
|
||||
|
||||
> **Warning:** Do _not_ enable this without setting up Plex
|
||||
> authentication through localhost first!
|
||||
'';
|
||||
};
|
||||
|
||||
upnp.enable = mkEnableOption "UPNP to try to open ports 80 and 443 on your router.";
|
||||
|
||||
domainName = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default = null;
|
||||
example = "plex.example.com";
|
||||
description = "The domain name to host Plex on.";
|
||||
};
|
||||
|
||||
acmeMail = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default = null;
|
||||
example = "mail@example.com";
|
||||
description = "The ACME mail required for the letsencrypt bot.";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config =
|
||||
mkIf cfg.enable
|
||||
{
|
||||
assertions = [
|
||||
{
|
||||
assertion = cfg.vpn.enable -> nixarr.vpn.enable;
|
||||
message = ''
|
||||
The nixarr.plex.vpn.enable option requires the
|
||||
nixarr.vpn.enable option to be set, but it was not.
|
||||
'';
|
||||
}
|
||||
{
|
||||
assertion = cfg.enable -> nixarr.enable;
|
||||
message = ''
|
||||
The nixarr.plex.enable option requires the nixarr.enable
|
||||
option to be set, but it was not.
|
||||
'';
|
||||
}
|
||||
{
|
||||
assertion = !(cfg.vpn.enable && cfg.expose.https.enable);
|
||||
message = ''
|
||||
The nixarr.plex.vpn.enable option conflicts with the
|
||||
nixarr.plex.expose.https.enable option. You cannot set both.
|
||||
'';
|
||||
}
|
||||
{
|
||||
assertion =
|
||||
cfg.expose.https.enable
|
||||
-> (
|
||||
(cfg.expose.https.domainName != null)
|
||||
&& (cfg.expose.https.acmeMail != null)
|
||||
);
|
||||
message = ''
|
||||
The nixarr.plex.expose.https.enable option requires the
|
||||
following options to be set, but one of them were not:
|
||||
|
||||
- nixarr.plex.expose.domainName
|
||||
- nixarr.plex.expose.acmeMail
|
||||
'';
|
||||
}
|
||||
];
|
||||
|
||||
users = {
|
||||
groups.streamer = {};
|
||||
users.streamer = {
|
||||
isSystemUser = true;
|
||||
group = "streamer";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d '${cfg.stateDir}' 0700 streamer root - -"
|
||||
|
||||
# Media Dirs
|
||||
"d '${nixarr.mediaDir}/library' 0775 streamer media - -"
|
||||
"d '${nixarr.mediaDir}/library/shows' 0775 streamer media - -"
|
||||
"d '${nixarr.mediaDir}/library/movies' 0775 streamer media - -"
|
||||
"d '${nixarr.mediaDir}/library/music' 0775 streamer media - -"
|
||||
"d '${nixarr.mediaDir}/library/books' 0775 streamer media - -"
|
||||
];
|
||||
|
||||
# Always prioritise Plex IO
|
||||
systemd.services.plex.serviceConfig.IOSchedulingPriority = 0;
|
||||
|
||||
services.plex = {
|
||||
enable = cfg.enable;
|
||||
package = cfg.package;
|
||||
user = "streamer";
|
||||
group = "media";
|
||||
openFirewall = cfg.openFirewall;
|
||||
dataDir = cfg.stateDir;
|
||||
};
|
||||
|
||||
networking.firewall = mkIf cfg.expose.https.enable {
|
||||
allowedTCPPorts = [80 443];
|
||||
};
|
||||
|
||||
util-nixarr.upnp = mkIf cfg.expose.https.upnp.enable {
|
||||
enable = true;
|
||||
openTcpPorts = [80 443];
|
||||
};
|
||||
|
||||
services.nginx = mkMerge [
|
||||
(mkIf (cfg.expose.https.enable || cfg.vpn.enable) {
|
||||
enable = true;
|
||||
|
||||
recommendedTlsSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedGzipSettings = true;
|
||||
})
|
||||
(mkIf cfg.expose.https.enable {
|
||||
virtualHosts."${builtins.replaceStrings ["\n"] [""] cfg.expose.https.domainName}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
recommendedProxySettings = true;
|
||||
proxyWebsockets = true;
|
||||
proxyPass = "http://127.0.0.1:${builtins.toString defaultPort}";
|
||||
};
|
||||
};
|
||||
})
|
||||
(mkIf cfg.vpn.enable {
|
||||
virtualHosts."127.0.0.1:${builtins.toString defaultPort}" = mkIf cfg.vpn.enable {
|
||||
listen = [
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = defaultPort;
|
||||
}
|
||||
];
|
||||
locations."/" = {
|
||||
recommendedProxySettings = true;
|
||||
proxyWebsockets = true;
|
||||
proxyPass = "http://192.168.15.1:${builtins.toString defaultPort}";
|
||||
};
|
||||
};
|
||||
})
|
||||
];
|
||||
|
||||
security.acme = mkIf cfg.expose.https.enable {
|
||||
acceptTerms = true;
|
||||
defaults.email = cfg.expose.https.acmeMail;
|
||||
};
|
||||
|
||||
# Enable and specify VPN namespace to confine service in.
|
||||
systemd.services.plex.vpnConfinement = mkIf cfg.vpn.enable {
|
||||
enable = true;
|
||||
vpnNamespace = "wg";
|
||||
};
|
||||
|
||||
# Port mappings
|
||||
vpnNamespaces.wg = mkIf cfg.vpn.enable {
|
||||
portMappings = [
|
||||
{
|
||||
from = defaultPort;
|
||||
to = defaultPort;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user