From 76371b7211051f960be489d89ab9a47108174dae Mon Sep 17 00:00:00 2001
From: sin serhao <shobu_serhao@proton.me>
Date: Wed, 14 Oct 2026 19:43:29 +0200
Subject: [PATCH] add nfs share instead of sshfs

---
 hosts/sin/configuration.nix  |  3 +++
 hosts/sin/copyparty.nix      |  9 +++++++++
 hosts/sin/nfs.nix            | 31 +++++++++++++++++++++++++++++++
 hosts/thea/configuration.nix |  2 ++
 hosts/thea/jellyfin.nix      | 11 ++---------
 hosts/thea/nginx.nix         |  4 ++++
 hosts/thea/shares.nix        |  1 -
 7 files changed, 51 insertions(+), 10 deletions(-)
 create mode 100644 hosts/sin/nfs.nix

diff --git a/hosts/sin/configuration.nix b/hosts/sin/configuration.nix
index ec2457a..ff3d191 100644
--- a/hosts/sin/configuration.nix
+++ b/hosts/sin/configuration.nix
@@ -19,6 +19,7 @@
     ./copyparty.nix
     ./trilium.nix
     ./actual.nix
+    ./nfs.nix
   ];
 
   boot.initrd.kernelModules = [ "usb_storage" ];
@@ -65,6 +66,8 @@
 
         53
 
+        2049 # nfs
+
         5690 # testing for wizarr
       ];
 
diff --git a/hosts/sin/copyparty.nix b/hosts/sin/copyparty.nix
index c622f36..e01dd88 100644
--- a/hosts/sin/copyparty.nix
+++ b/hosts/sin/copyparty.nix
@@ -107,5 +107,14 @@
     };
   };
 
+  systemd.services.copyparty = {
+    serviceConfig = {
+      IOSchedulingClass = "best-effort";
+      IOSchedulingPriority = 7;
+
+      IOWeight = 25;
+    };
+  };
+
   networking.firewall.allowedTCPPorts = [ 8086 ];
 }
diff --git a/hosts/sin/nfs.nix b/hosts/sin/nfs.nix
new file mode 100644
index 0000000..8a626b3
--- /dev/null
+++ b/hosts/sin/nfs.nix
@@ -0,0 +1,31 @@
+{...}: {
+  fileSystems = {
+    "/exports/mediacenter" = {
+      device = "/mnt/mediacenter";
+      fsType = "none";
+      options = [ "bind" ];
+    };
+    # "/exports/jellyfin" = {
+    #   device = "/mnt/jellyfin";
+    #   fsType = "none";
+    #   options = [ "bind" ];
+    # };
+  };
+
+  services.nfs = let
+    exports_config = n : {
+      "192.168.1.12" = [ # thea
+        "rw"
+        "fsid=${n}"
+      ];
+    };
+  in {
+    server = {
+      enable = true;
+      exports = {
+        "/exports/jellyfin" = exports_config "1";
+        "/exports/mediacenter" = exports_config "2";
+      };
+    };
+  };
+}
diff --git a/hosts/thea/configuration.nix b/hosts/thea/configuration.nix
index e300584..e9c88a1 100644
--- a/hosts/thea/configuration.nix
+++ b/hosts/thea/configuration.nix
@@ -28,6 +28,7 @@ in
   # Use the systemd-boot EFI boot loader.
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
+  boot.supportedFilesystems = [ "fuse.sshfs" "nfs" ];
 
   networking = {
     hostName = "thea"; # Define your hostname.
@@ -42,6 +43,7 @@ in
       allowedTCPPorts = [
         nodes.sin.config.services.gitea.settings.server.SSH_PORT
         993 # mail port
+        2049 # nfs
       ]
       ++ [
         # minecraft ad hoc server ports
diff --git a/hosts/thea/jellyfin.nix b/hosts/thea/jellyfin.nix
index 98e2b82..429405a 100644
--- a/hosts/thea/jellyfin.nix
+++ b/hosts/thea/jellyfin.nix
@@ -4,15 +4,8 @@ let
 in
 {
   fileSystems."/mnt/mediacenter" = {
-    device = "shobu@${sin-address}:/mnt/mediacenter";
-    fsType = "sshfs";
-    options = [
-      "nodev"
-      "noatime"
-      "allow_other"
-      "user=n100"
-      "IdentityFile=/root/.ssh/id_ed25519"
-    ];
+    device = "${sin-address}:/exports/mediacenter";
+    fsType = "nfs4";
   };
 
   fileSystems."/mnt/jellyfin" = {
diff --git a/hosts/thea/nginx.nix b/hosts/thea/nginx.nix
index 3710d16..aa5fabb 100644
--- a/hosts/thea/nginx.nix
+++ b/hosts/thea/nginx.nix
@@ -27,6 +27,10 @@ in
     typesHashMaxSize = 512;
     mapHashMaxSize = 512;
 
+    appendHttpConfig = ''
+      limit_conn_zone $binary_remote_addr zone=copyparty_dl:10m;
+    '';
+
     virtualHosts =
       let
         mkVHost =
diff --git a/hosts/thea/shares.nix b/hosts/thea/shares.nix
index b87072a..df75227 100644
--- a/hosts/thea/shares.nix
+++ b/hosts/thea/shares.nix
@@ -3,7 +3,6 @@ let
   sin-address = "192.168.1.14";
 in
 {
-  boot.supportedFilesystems = [ "fuse.sshfs" ];
   programs.fuse.userAllowOther = true;
 
   fileSystems = {