stable somewhat

hosts/sin/actual.nix

@@ -1,12 +1,32 @@
-{ inputs, pkgs, ... }:
+{
+  inputs,
+  pkgs,
+  config,
+  ...
+}:
 let
   unstable = import inputs.unstable { system = pkgs.stdenv.system; };
 in
 {
+  users.users.actual = {
+    isSystemUser = true;
+    group = config.users.groups.actual.name;
+  };
+  users.groups.actual = { };
   services.actual = {
     package = unstable.actual-server;
     enable = true;
     openFirewall = true;
-    settings.port = 3001;
+    user = config.users.users.actual.name;
+    settings = {
+      port = 3001;
+      openId = {
+        discoveryURL = "https://auth.shobu.fr";
+        client_id = "actual-budget";
+        client_secret._secret = config.age.secrets.actual-client_secret.path;
+        server_hostname = "https://actual.shobu.fr";
+        authMethod = "oauth2";
+      };
+    };
   };
 }

hosts/sin/configuration.nix

@@ -32,9 +32,25 @@
   networking = {
     hostName = "sin";
 
-    networkmanager.enable = true;
+    networkmanager = {
+      enable = true;
+      settings = {
+        main = {
+          dns = "default";
+        };
 
-    # nameservers = [ "10.0.0.4" ];
+        connection = {
+          "ipv4.ignore-auto-dns" = true;
+          "ipv6.ignore-auto-dns" = true;
+        };
+      };
+    };
+
+    nameservers = [
+      "9.9.9.9"
+      "149.112.112.112"
+      "8.8.8.8"
+    ];
 
     # dhcpcd.extraConfig = "nohook resolv.conf";
 
@@ -48,6 +64,8 @@
         config.services.trilium-server.port
 
         53
+
+        5690 # testing for wizarr
       ];
 
       allowedUDPPorts = [ 53 ];

hosts/sin/jellyfin.nix

@@ -44,51 +44,44 @@ in
   users.users."starr" = {
     isSystemUser = true;
     group = "starr";
-    extraGroups = [ "jellyfin" ];
   };
 
   users.users.sonarr.extraGroups = [
-    "jellyfin"
     "radarr"
     "transmission"
     "starr"
   ];
   users.users.radarr.extraGroups = [
-    "jellyfin"
     "sonarr"
     "transmission"
     "starr"
   ];
   users.users.bazarr.extraGroups = [
-    "jellyfin"
     "sonarr"
     "transmission"
     "starr"
     "radarr"
   ];
   users.users.lidarr.extraGroups = [
-    "jellyfin"
     "starr"
     "transmission"
   ];
 
   users.users.whisparr.extraGroups = [
-    "jellyfin"
     "starr"
     "transmission"
   ];
 
   users.users.shobu.extraGroups = [
-    "jellyfin"
     "starr"
     "transmission"
     "radarr"
     "sonarr"
   ];
-  users.users.jellyfin.extraGroups = [
-    "render"
-    "video"
-  ];
+  # users.users.jellyfin.extraGroups = [
+  #   "render"
+  #   "video"
+  # ];
 
   users.groups = {
     starr = {
@@ -107,7 +100,7 @@ in
     in
     {
       jellyfin = {
-        enable = true;
+        enable = false;
         openFirewall = true;
       };
 
@@ -154,7 +147,7 @@ in
         ];
       };
 
-      jellyseerr = {
+      seerr = {
         enable = true;
         openFirewall = true;
       };

hosts/sin/luks-btrfs-raid.nix

@@ -7,7 +7,7 @@
       # and the actual btrfs raid on the second disk, and the name of these entries matters!
       system = {
         type = "disk";
-        device = "/dev/sdb";
+        device = "/dev/sda";
         content = {
           type = "gpt";
           partitions = {
@@ -56,7 +56,7 @@
 
       data = {
         type = "disk";
-        device = "/dev/sda";
+        device = "/dev/sdb";
         content = {
           type = "gpt";
           partitions = {

hosts/sin/secrets.nix

@@ -7,7 +7,7 @@
     #   mode = "770";
     # };
     airvpn-params = {
-      file = ./secrets/airvpn_wireguard_key_env.age;
+      file = ./secrets/airvpn-params.age;
       mode = "700";
     };
     copyparty-serhao = {
@@ -27,5 +27,10 @@
       file = ./secrets/authelia-session.age;
       mode = "700";
     };
+    actual-client_secret = {
+      file = ./secrets/actual-client_secret.age;
+      mode = "700";
+      owner = "actual";
+    };
   };
 }

hosts/sin/secrets/actual-client_secret.age

@@ -0,0 +1,12 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IC91cWo0QSBuNXRB
+ZnhnOFFhdUJZaHhHZVFHSVVRNThMdndDalV0Y3U5czBNSGh3b0U4ClRFWFYxQXpl
+VnBhRVo0SHZjVE9weDhlcEdnbElwZnErTUVkTmFiZE1jQWMKLT4gc3NoLWVkMjU1
+MTkgTm9TbDZRIFdDU01HdjlXc1VUL3FuM0FTZS81ZGgveXovVFB2bi85aGpLNWFI
+YmhjekUKNjFWSGl1OVJTZDFmOEtCK0l2a25KYWdSRm9hdkxGV1JZYUY5NStoRDhw
+bwotPiAmLHJbLWdyZWFzZSBiKiBJIDxpIVNVCkZLQ3Fwc2N0dU9UUFo2QTVEODg2
+RkNBRWdFSmUKLS0tIHU1SUl1amt5Z1NSbVpvcGx5eHZOcmxpb2lnWlg5NENGZXJ1
+MDFveGJONlEK4tVPaUccMrkiQZriMRvYcegvemtcOBIVGAa/hUX7BoLXUas2FVct
+gSCJKPBzt0Jyg2Qcj4kBgjqdNBGG0AP4QjTaxg2Vy5B/Ao5jV3v9heSRzucTkxUG
+bxB6Bt7tgF6XDDsBcXsFNiS7
+-----END AGE ENCRYPTED FILE-----

hosts/sin/secrets/airvpn-params.age

@@ -0,0 +1,15 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IC91cWo0QSA3S2dM
+RVE2R3liVzdReiszZXZtVUJGbzVRRTY5YUhCY2h6WWNTVUxGRGhVCmYyWGsrMGZG
+cEZmeFZyN0dtblI4NHRmUTNhWjlzRThuMEpaR01zUFVGejAKLT4gc3NoLWVkMjU1
+MTkgTm9TbDZRIEVxR1hMWXJxdFNTa1c1WlZrWEs3YkFCZmxRclhxNEd6RnBkU1A0
+U0g2MWMKVUkrV1JVWm5xblRwalY1cWtFODRJcnlRZHJaSkY1R1RyLzZtTWNacDVa
+WQotPiA3aUQnMCd9LWdyZWFzZSBtQiBkVW9cIHssXDwuMjo1CngyajZobkxXUnpL
+VXozVytpay9GL0JrNUliUVNVckZZbHQ3dnJkY0FJOHJqVHBQMU1lVzV3emhsVWhh
+VXZ6VG8Kdmtyak1nCi0tLSA4NnYxNnQ0VDZFZlR0MC9lUmdXYld1QWtMRCtDR05C
+TTU0L2pDa2trdmFJCn0WLrNMRqn2jUSTwunUtj82aXfcdsdEGl8EIkqPEpig//gH
+urGRbk9vR1UzTcykWAXbqtXMs8tl9pMVSYWD/qLG2qUWNSkLFbGxRphAhgofVZBZ
+Fd8lqAa5bXQQXh4kKSBRQEtVXci18E/kxPFKofVxnf3STx0oldbde5pf1dWjBd2H
+VkyFjm8vAxJJyEcVRGtb7muQt+PezfSXpdzCsO/Uuiwvd5WXO9EM7xuJjJRWSRUT
+VjkfehDjkmy5501zmeFLq8dkB4stSrjkIg8=
+-----END AGE ENCRYPTED FILE-----

hosts/sin/transmission.nix

@@ -39,21 +39,21 @@
 
   virtualisation.oci-containers =
     let
-      peerport = "63369";
+      peerport = "44161";
+      webport = "44160";
     in
     {
       backend = "docker";
       containers = {
         gluetun = {
-          image = "qmcgaw/gluetun";
+          image = "qmcgaw/gluetun:latest";
           environment = {
             VPN_SERVICE_PROVIDER = "airvpn";
             VPN_TYPE = "wireguard";
-            # WIREGUARD_PRIVATE_KEY = "from agenix";
-            # WIREGUARD_PRESHARED_KEY = "from agenix";
-            # WIREGUARD_ADDRESSES = "from agenix";
-            # SERVER_COUNTRIES = "from agenix";
-            FIREWALL_VPN_INPUT_PORTS = "13277,${peerport}";
+            SERVER_NAMES = "Taiyangshou";
+            FIREWALL_VPN_INPUT_PORTS = "${peerport},${webport}";
+
+            TZ = "Europe/Paris";
           };
           environmentFiles = [
             config.age.secrets.airvpn-params.path
@@ -65,31 +65,47 @@
           ];
           ports = [
             "13277:13277"
-            "9091:13277"
+            "${webport}:${webport}"
             "${peerport}:${peerport}"
             "${peerport}:${peerport}/udp"
           ];
-        };
-        transmission = {
-          image = "docker.io/linuxserver/transmission:latest";
           volumes = [
-            "/etc/transmission:/config"
+            "/etc/gluetun:/gluetun"
+          ];
+        };
+        qbittorrent = {
+          image = "lscr.io/linuxserver/qbittorrent:latest";
+          volumes = [
             "/etc/localtime:/etc/localtime:ro"
+
             "/mnt/mediacenter/torrents:/mnt/mediacenter/torrents"
             "/mnt/data/transmission_downloads:/mnt/data/transmission_downloads"
+
+            "/mnt/data/downloads:/downloads"
+
+            "/etc/qbittorrent:/config"
           ];
           dependsOn = [
             "gluetun"
           ];
           extraOptions = [
             "--network=container:gluetun"
+            # "-u=992:989"
+            # "-u=${toString config.users.users.transmission.uid}:${toString config.users.groups.starr.gid}"
           ];
           environment = {
             PUID = toString config.users.users.transmission.uid;
             PGID = toString config.users.groups.starr.gid;
-            PEERPORT = peerport;
+            TZ = "Europe/Paris";
+
+            WEBUI_PORT = "${webport}";
+            TORRENTING_PORT = "${peerport}";
           };
         };
       };
     };
+  networking.firewall.allowedTCPPorts = [
+    44160
+    13277
+  ];
 }

hosts/sin/trilium.nix

@@ -1,7 +1,12 @@
-{ ... }:
+{ inputs, pkgs, ... }:
+let
+  unstable = import inputs.unstable { system = pkgs.stdenv.system; };
+in
+
 {
   services.trilium-server = {
     enable = true;
+    package = unstable.trilium-server;
     port = 12783;
     host = "0.0.0.0";
     # noAuthentication = true;

hosts/thea/authelia.nix

@@ -134,6 +134,27 @@ in
                 userinfo_signed_response_alg = "none";
                 token_endpoint_auth_method = "client_secret_basic";
               }
+              {
+                client_id = "actual-budget";
+                client_name = "Actual Budget";
+                client_secret = "$pbkdf2-sha512$310000$0mdiwSrzfswVhLmJi0b/YQ$RjAuXY226qSrbpViJ2pitIA1B0a2rvL.5VfxnRwvvXzXlQAezczy5xK7.3X2uBvLgpnTjpxf3zdcvoDJ2ieIHw";
+                public = false;
+                authorization_policy = "two_factor";
+                require_pkce = false;
+                pkce_challenge_method = "";
+                redirect_uris = [ "https://actual.shobu.fr/openid/callback" ];
+                scopes = [
+                  "openid"
+                  "profile"
+                  "groups"
+                  "email"
+                ];
+                response_types = [ "code" ];
+                grant_types = [ "authorization_code" ];
+                access_token_signed_response_alg = "none";
+                userinfo_signed_response_alg = "none";
+                token_endpoint_auth_method = "client_secret_basic";
+              }
             ];
           };
         };

hosts/thea/configuration.nix

@@ -22,6 +22,7 @@ in
     ./secrets
     ./authelia.nix
     ./glances.nix
+    ./jellyfin.nix
   ];
 
   # Use the systemd-boot EFI boot loader.
@@ -46,6 +47,17 @@ in
         # minecraft ad hoc server ports
         25665
         25675
+      ]
+      ++ [
+        # rqbit
+        63369
+        37751
+      ];
+
+      allowedUDPPorts = [
+        # rqbit
+        63369
+        37751
       ];
     };
     nat = {
@@ -53,6 +65,16 @@ in
       internalInterfaces = [ "enp1s0" ];
       externalInterface = "enp1s0";
       forwardPorts = [
+        {
+          sourcePort = 25665;
+          proto = "tcp";
+          destination = "127.0.0.1:25665";
+        }
+        {
+          sourcePort = 25665;
+          proto = "udp";
+          destination = "127.0.0.1:25665";
+        }
         {
           # TODO refactor this in the gitea/n100 module
           sourcePort = nodes.sin.config.services.gitea.settings.server.SSH_PORT;
@@ -69,6 +91,16 @@ in
           proto = "tcp";
           destination = "${sin-address}:8086";
         }
+        # {
+        #   sourcePort = 54721;
+        #   proto = "tcp";
+        #   destination = "${sin-address}:54721";
+        # }
+        # {
+        #   sourcePort = 54721;
+        #   proto = "udp";
+        #   destination = "${sin-address}:54721";
+        # }
       ];
     };
   };
@@ -112,6 +144,19 @@ in
     ports = [ 22 ];
   };
 
+  services.openarena = {
+    enable = true;
+    openPorts = true;
+    extraFlags = [
+      "+set dedicated 2"
+      "+set sv_hostname 'Ser\'Hao\'s server'"
+      "+map oa_dm1"
+      "+set"
+      "rconPassword"
+      "test"
+    ];
+  };
+
   # Open ports in the firewall.
   # networking.firewall.allowedTCPPorts = [ ... ];
   # networking.firewall.allowedUDPPorts = [ ... ];

hosts/thea/jellyfin.nix

@@ -0,0 +1,81 @@
+{ pkgs, ... }:
+let
+  sin-address = "192.168.1.14";
+in
+{
+  fileSystems."/mnt/mediacenter" = {
+    device = "shobu@${sin-address}:/mnt/mediacenter";
+    fsType = "sshfs";
+    options = [
+      "nodev"
+      "noatime"
+      "allow_other"
+      "user=n100"
+      "IdentityFile=/root/.ssh/id_ed25519"
+    ];
+  };
+
+  fileSystems."/mnt/jellyfin" = {
+    device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
+    fsType = "btrfs";
+    options = [
+      "subvol=jellyfin"
+      "user=jellyfin"
+    ];
+  };
+
+  systemd.services.jellyfin.environment.LIBVA_DRIVER_NAME = "iHD"; # or i965 for older GPUs
+  environment.sessionVariables = {
+    LIBVA_DRIVER_NAME = "iHD";
+  };
+
+  hardware.graphics = {
+    enable = true;
+
+    extraPackages = with pkgs; [
+      intel-ocl
+      intel-compute-runtime
+      intel-media-driver
+      vpl-gpu-rt
+    ];
+  };
+  hardware.enableAllFirmware = true;
+  hardware.enableRedistributableFirmware = true;
+  boot.kernelParams = [
+    "i915.enable_guc=3"
+    "i915.force_probe=46d1"
+  ];
+
+  services = {
+    jellyfin = rec {
+      enable = true;
+      dataDir = "/mnt/jellyfin";
+      configDir = "${dataDir}/config";
+      openFirewall = true;
+      hardwareAcceleration = {
+        enable = true;
+        type = "qsv";
+        device = "/dev/dri/by-path/pci-0000:00:02.0-render";
+      };
+    };
+  };
+
+  users.users."starr" = {
+    uid = 993;
+    isSystemUser = true;
+    group = "starr";
+  };
+
+  users.groups = {
+    starr = {
+      gid = 990;
+    };
+  };
+
+  users.users.jellyfin.extraGroups = [
+    "render"
+    "video"
+    "starr"
+  ];
+
+}

hosts/thea/nginx.nix

@@ -29,16 +29,27 @@ in
 
     virtualHosts =
       let
-        mkVHost = host: port: {
-          "${host}" = {
-            enableACME = true;
-            forceSSL = true;
+        mkVHost =
+          {
+            host,
+            port,
+            target ? sin-address,
+          }:
+          {
+            "${host}" = {
+              enableACME = true;
+              forceSSL = true;
 
-            locations."/" = {
-              proxyPass = "http://${sin-address}:${toString port}";
+              locations."/" = {
+                proxyPass = "http://${target}:${toString port}";
+                extraConfig = ''
+                  proxy_set_header X-Real-IP $remote_addr;
+                  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                  proxy_set_header X-Forwarded-Proto $scheme;
+                '';
+              };
             };
           };
-        };
         mkStarr = host: port: {
           "${host}" = {
             enableACME = true;
@@ -53,6 +64,8 @@ in
               proxyWebsockets = true;
               extraConfig = ''
                 proxy_ssl_server_name on;
+
+                proxy_read_timeout 4800s;
               '';
             };
             locations."/" = {
@@ -63,7 +76,6 @@ in
                 include ${authelia-snippets.authelia-authrequest};
 
                 proxy_ssl_server_name on;
-                proxy_read_timeout 4800s;
               '';
             };
           };
@@ -99,18 +111,45 @@ in
           ) vhost);
       in
       (
-        (withWebsockets (mkVHost "jellyfin.shobu.fr" "8096") "/")
+        (withWebsockets (mkVHost {
+          host = "jellyfin.shobu.fr";
+          port = "8096";
+          target = "127.0.0.1";
+        }) "/")
         // mkStarr "radarr.shobu.fr" "7878"
         // mkStarr "sonarr.shobu.fr" "8989"
         // mkStarr "prowlarr.shobu.fr" "9696"
         // mkStarr "bazarr.shobu.fr" "6767"
         // mkStarr "lidarr.shobu.fr" "8686"
         // mkStarr "whisparr.shobu.fr" "6969"
-        // mkVHost "jellyseerr.shobu.fr" "5055"
-        // withAuthelia (mkVHost "transmission.shobu.fr" "9091") "/"
-        // withAuthelia (mkVHost "zimablade-admin.shobu.fr" "61208") "/"
-        // withAuthelia (mkVHost "actual.shobu.fr" nodes.sin.config.services.actual.settings.port) "/"
-        // (withWebsockets (mkVHost "trilium.shobu.fr" "12783") "/")
+        // mkVHost {
+          host = "jellyseerr.shobu.fr";
+          port = "5055";
+        }
+        // withAuthelia (mkVHost {
+          host = "transmission.shobu.fr";
+          port = "13277";
+        }) "/"
+        // mkVHost {
+          host = "qbittorrent.shobu.fr";
+          port = "44160";
+        }
+        // withAuthelia (mkVHost {
+          host = "zimablade-admin.shobu.fr";
+          port = "61208";
+        }) "/"
+        // (mkVHost {
+          host = "actual.shobu.fr";
+          port = nodes.sin.config.services.actual.settings.port;
+        })
+        // (withWebsockets (mkVHost {
+          host = "trilium.shobu.fr";
+          port = "12783";
+        }) "/")
+        // mkVHost {
+          host = "invit.shobu.fr";
+          port = "5690";
+        }
         // {
           "shobu.fr" = {
             enableACME = true;