stable somewhat

hosts/thea/authelia.nix

@@ -134,6 +134,27 @@ in
                 userinfo_signed_response_alg = "none";
                 token_endpoint_auth_method = "client_secret_basic";
               }
+              {
+                client_id = "actual-budget";
+                client_name = "Actual Budget";
+                client_secret = "$pbkdf2-sha512$310000$0mdiwSrzfswVhLmJi0b/YQ$RjAuXY226qSrbpViJ2pitIA1B0a2rvL.5VfxnRwvvXzXlQAezczy5xK7.3X2uBvLgpnTjpxf3zdcvoDJ2ieIHw";
+                public = false;
+                authorization_policy = "two_factor";
+                require_pkce = false;
+                pkce_challenge_method = "";
+                redirect_uris = [ "https://actual.shobu.fr/openid/callback" ];
+                scopes = [
+                  "openid"
+                  "profile"
+                  "groups"
+                  "email"
+                ];
+                response_types = [ "code" ];
+                grant_types = [ "authorization_code" ];
+                access_token_signed_response_alg = "none";
+                userinfo_signed_response_alg = "none";
+                token_endpoint_auth_method = "client_secret_basic";
+              }
             ];
           };
         };

hosts/thea/configuration.nix

@@ -22,6 +22,7 @@ in
     ./secrets
     ./authelia.nix
     ./glances.nix
+    ./jellyfin.nix
   ];
 
   # Use the systemd-boot EFI boot loader.
@@ -46,6 +47,17 @@ in
         # minecraft ad hoc server ports
         25665
         25675
+      ]
+      ++ [
+        # rqbit
+        63369
+        37751
+      ];
+
+      allowedUDPPorts = [
+        # rqbit
+        63369
+        37751
       ];
     };
     nat = {
@@ -53,6 +65,16 @@ in
       internalInterfaces = [ "enp1s0" ];
       externalInterface = "enp1s0";
       forwardPorts = [
+        {
+          sourcePort = 25665;
+          proto = "tcp";
+          destination = "127.0.0.1:25665";
+        }
+        {
+          sourcePort = 25665;
+          proto = "udp";
+          destination = "127.0.0.1:25665";
+        }
         {
           # TODO refactor this in the gitea/n100 module
           sourcePort = nodes.sin.config.services.gitea.settings.server.SSH_PORT;
@@ -69,6 +91,16 @@ in
           proto = "tcp";
           destination = "${sin-address}:8086";
         }
+        # {
+        #   sourcePort = 54721;
+        #   proto = "tcp";
+        #   destination = "${sin-address}:54721";
+        # }
+        # {
+        #   sourcePort = 54721;
+        #   proto = "udp";
+        #   destination = "${sin-address}:54721";
+        # }
       ];
     };
   };
@@ -112,6 +144,19 @@ in
     ports = [ 22 ];
   };
 
+  services.openarena = {
+    enable = true;
+    openPorts = true;
+    extraFlags = [
+      "+set dedicated 2"
+      "+set sv_hostname 'Ser\'Hao\'s server'"
+      "+map oa_dm1"
+      "+set"
+      "rconPassword"
+      "test"
+    ];
+  };
+
   # Open ports in the firewall.
   # networking.firewall.allowedTCPPorts = [ ... ];
   # networking.firewall.allowedUDPPorts = [ ... ];

hosts/thea/jellyfin.nix

@@ -0,0 +1,81 @@
+{ pkgs, ... }:
+let
+  sin-address = "192.168.1.14";
+in
+{
+  fileSystems."/mnt/mediacenter" = {
+    device = "shobu@${sin-address}:/mnt/mediacenter";
+    fsType = "sshfs";
+    options = [
+      "nodev"
+      "noatime"
+      "allow_other"
+      "user=n100"
+      "IdentityFile=/root/.ssh/id_ed25519"
+    ];
+  };
+
+  fileSystems."/mnt/jellyfin" = {
+    device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
+    fsType = "btrfs";
+    options = [
+      "subvol=jellyfin"
+      "user=jellyfin"
+    ];
+  };
+
+  systemd.services.jellyfin.environment.LIBVA_DRIVER_NAME = "iHD"; # or i965 for older GPUs
+  environment.sessionVariables = {
+    LIBVA_DRIVER_NAME = "iHD";
+  };
+
+  hardware.graphics = {
+    enable = true;
+
+    extraPackages = with pkgs; [
+      intel-ocl
+      intel-compute-runtime
+      intel-media-driver
+      vpl-gpu-rt
+    ];
+  };
+  hardware.enableAllFirmware = true;
+  hardware.enableRedistributableFirmware = true;
+  boot.kernelParams = [
+    "i915.enable_guc=3"
+    "i915.force_probe=46d1"
+  ];
+
+  services = {
+    jellyfin = rec {
+      enable = true;
+      dataDir = "/mnt/jellyfin";
+      configDir = "${dataDir}/config";
+      openFirewall = true;
+      hardwareAcceleration = {
+        enable = true;
+        type = "qsv";
+        device = "/dev/dri/by-path/pci-0000:00:02.0-render";
+      };
+    };
+  };
+
+  users.users."starr" = {
+    uid = 993;
+    isSystemUser = true;
+    group = "starr";
+  };
+
+  users.groups = {
+    starr = {
+      gid = 990;
+    };
+  };
+
+  users.users.jellyfin.extraGroups = [
+    "render"
+    "video"
+    "starr"
+  ];
+
+}

hosts/thea/nginx.nix

@@ -29,16 +29,27 @@ in
 
     virtualHosts =
       let
-        mkVHost = host: port: {
-          "${host}" = {
-            enableACME = true;
-            forceSSL = true;
+        mkVHost =
+          {
+            host,
+            port,
+            target ? sin-address,
+          }:
+          {
+            "${host}" = {
+              enableACME = true;
+              forceSSL = true;
 
-            locations."/" = {
-              proxyPass = "http://${sin-address}:${toString port}";
+              locations."/" = {
+                proxyPass = "http://${target}:${toString port}";
+                extraConfig = ''
+                  proxy_set_header X-Real-IP $remote_addr;
+                  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                  proxy_set_header X-Forwarded-Proto $scheme;
+                '';
+              };
             };
           };
-        };
         mkStarr = host: port: {
           "${host}" = {
             enableACME = true;
@@ -53,6 +64,8 @@ in
               proxyWebsockets = true;
               extraConfig = ''
                 proxy_ssl_server_name on;
+
+                proxy_read_timeout 4800s;
               '';
             };
             locations."/" = {
@@ -63,7 +76,6 @@ in
                 include ${authelia-snippets.authelia-authrequest};
 
                 proxy_ssl_server_name on;
-                proxy_read_timeout 4800s;
               '';
             };
           };
@@ -99,18 +111,45 @@ in
           ) vhost);
       in
       (
-        (withWebsockets (mkVHost "jellyfin.shobu.fr" "8096") "/")
+        (withWebsockets (mkVHost {
+          host = "jellyfin.shobu.fr";
+          port = "8096";
+          target = "127.0.0.1";
+        }) "/")
         // mkStarr "radarr.shobu.fr" "7878"
         // mkStarr "sonarr.shobu.fr" "8989"
         // mkStarr "prowlarr.shobu.fr" "9696"
         // mkStarr "bazarr.shobu.fr" "6767"
         // mkStarr "lidarr.shobu.fr" "8686"
         // mkStarr "whisparr.shobu.fr" "6969"
-        // mkVHost "jellyseerr.shobu.fr" "5055"
-        // withAuthelia (mkVHost "transmission.shobu.fr" "9091") "/"
-        // withAuthelia (mkVHost "zimablade-admin.shobu.fr" "61208") "/"
-        // withAuthelia (mkVHost "actual.shobu.fr" nodes.sin.config.services.actual.settings.port) "/"
-        // (withWebsockets (mkVHost "trilium.shobu.fr" "12783") "/")
+        // mkVHost {
+          host = "jellyseerr.shobu.fr";
+          port = "5055";
+        }
+        // withAuthelia (mkVHost {
+          host = "transmission.shobu.fr";
+          port = "13277";
+        }) "/"
+        // mkVHost {
+          host = "qbittorrent.shobu.fr";
+          port = "44160";
+        }
+        // withAuthelia (mkVHost {
+          host = "zimablade-admin.shobu.fr";
+          port = "61208";
+        }) "/"
+        // (mkVHost {
+          host = "actual.shobu.fr";
+          port = nodes.sin.config.services.actual.settings.port;
+        })
+        // (withWebsockets (mkVHost {
+          host = "trilium.shobu.fr";
+          port = "12783";
+        }) "/")
+        // mkVHost {
+          host = "invit.shobu.fr";
+          port = "5690";
+        }
         // {
           "shobu.fr" = {
             enableACME = true;