281 lines
8.7 KiB
Nix
281 lines
8.7 KiB
Nix
{ config, ... }:
|
|
let
|
|
inherit (import ./lib.nix config)
|
|
hostRuleHavenisms
|
|
localHostRuleHavenisms
|
|
havenisms
|
|
mkContainer
|
|
;
|
|
gluetun_env = "gluetun-proton-vpn-wireguard.env";
|
|
in
|
|
{
|
|
|
|
sops.secrets = {
|
|
"protonvpn/private_key" = {
|
|
restartUnits = [ "${config.local.container-backend}-gluetun.service" ];
|
|
};
|
|
};
|
|
|
|
# Example Wireguard config file:
|
|
# # Key for MCP Wireguard
|
|
# # Bouncing = 13
|
|
# # NetShield = 1
|
|
# # Moderate NAT = off
|
|
# # NAT-PMP (Port Forwarding) = on
|
|
# # VPN Accelerator = on
|
|
# PrivateKey = ${config.sops.placeholder."protonvpn/private_key"}
|
|
# Address = 10.2.0.2/32
|
|
# DNS = 10.2.0.1
|
|
#
|
|
# [Peer]
|
|
# # US-CA#906
|
|
# PublicKey = 2xvxhMK0AalXOMq6Dh0QMVJ0Cl3WQTmWT5tdeb8SpR0=
|
|
# AllowedIPs = 0.0.0.0/0, ::/0
|
|
# Endpoint = 79.127.185.166:51820
|
|
#
|
|
# PersistentKeepalive = 25
|
|
sops.templates.${gluetun_env}.content = ''
|
|
VPN_SERVICE_PROVIDER=protonvpn
|
|
VPN_TYPE=wireguard
|
|
WIREGUARD_PRIVATE_KEY="${config.sops.placeholder."protonvpn/private_key"}"
|
|
SERVER_COUNTRIES="United States,United Kingdom,Netherlands,Switzerland,Sweden"
|
|
VPN_PORT_FORWARDING=on
|
|
'';
|
|
|
|
virtualisation.oci-containers.containers = {
|
|
jellyfin = {
|
|
image = "lscr.io/linuxserver/jellyfin:10.11.6";
|
|
autoStart = true;
|
|
extraOptions = [
|
|
"--device=/dev/dri:/dev/dri"
|
|
"-l=traefik.enable=true"
|
|
"-l=traefik.http.routers.jellyfin.rule=${hostRuleHavenisms "jellyfin"}"
|
|
"-l=traefik.http.services.jellyfin.loadbalancer.server.port=8096"
|
|
"-l=homepage.group=Apps"
|
|
"-l=homepage.name=Jellyfin"
|
|
"-l=homepage.icon=jellyfin.svg"
|
|
"-l=homepage.href=https://jellyfin.${havenisms}"
|
|
"-l=homepage.description=Media player"
|
|
"-l=homepage.widget.type=jellyfin"
|
|
"-l=homepage.widget.key={{HOMEPAGE_FILE_JELLYFIN_KEY}}"
|
|
"-l=homepage.widget.url=http://jellyfin:8096"
|
|
"-l=homepage.widget.enableBlocks=true"
|
|
];
|
|
volumes = [
|
|
"/tank/media/collection:/data"
|
|
"/tank/config/jellyfin:/config"
|
|
];
|
|
# environment = {
|
|
# TZ = vars.timeZone;
|
|
# PUID = "994";
|
|
# UMASK = "002";
|
|
# GUID = "993";
|
|
# };
|
|
};
|
|
deluge = {
|
|
image = "lscr.io/linuxserver/deluge:latest";
|
|
autoStart = true;
|
|
dependsOn = [
|
|
"gluetun"
|
|
];
|
|
extraOptions = [
|
|
"--network=container:gluetun"
|
|
"-l=homepage.group=Arr"
|
|
"-l=homepage.name=Deluge"
|
|
"-l=homepage.icon=deluge.svg"
|
|
"-l=homepage.href=https://deluge.${havenisms}"
|
|
"-l=homepage.description=Torrent client"
|
|
"-l=homepage.widget.type=deluge"
|
|
"-l=homepage.widget.password={{HOMEPAGE_FILE_DELUGE_PASSWORD}}"
|
|
"-l=homepage.widget.url=http://gluetun:8112"
|
|
];
|
|
volumes = [
|
|
"/tank/media:/data"
|
|
"/tank/config/deluge:/config"
|
|
];
|
|
};
|
|
qbittorrent = {
|
|
image = "lscr.io/linuxserver/qbittorrent:latest";
|
|
autoStart = true;
|
|
dependsOn = [
|
|
"gluetun"
|
|
];
|
|
extraOptions = [
|
|
"--network=container:gluetun"
|
|
"-l=homepage.group=Arr"
|
|
"-l=homepage.name=qBitTorrent"
|
|
"-l=homepage.icon=qbittorrent.svg"
|
|
"-l=homepage.href=https://torrents.${havenisms}"
|
|
"-l=homepage.description=Torrent client"
|
|
"-l=homepage.widget.type=qbittorrent"
|
|
"-l=homepage.widget.url=http://torrents.${havenisms}"
|
|
];
|
|
volumes = [
|
|
"/tank/media/Downloads:/downloads"
|
|
"/tank/config/qbittorrent:/config"
|
|
];
|
|
environment = {
|
|
PUID = "911";
|
|
PGID = "911";
|
|
UMASK = "002";
|
|
};
|
|
};
|
|
gluetun = {
|
|
image = "qmcgaw/gluetun:latest";
|
|
autoStart = true;
|
|
extraOptions = [
|
|
# add network admin capability.
|
|
"--cap-add=NET_ADMIN"
|
|
"--device=/dev/net/tun:/dev/net/tun"
|
|
"-l=traefik.enable=true"
|
|
"-l=traefik.http.routers.torrents.rule=${localHostRuleHavenisms "torrents"}"
|
|
"-l=traefik.http.routers.torrents.service=torrents"
|
|
"-l=traefik.http.services.torrents.loadbalancer.server.port=8080"
|
|
"-l=homepage.group=Infra"
|
|
"-l=homepage.name=GlueTun"
|
|
"-l=homepage.icon=gluetun.svg"
|
|
"-l=homepage.href=https://torrents.${havenisms}"
|
|
"-l=homepage.description=VPN killswitch"
|
|
"-l=homepage.widget.type=gluetun"
|
|
"-l=homepage.widget.url=http://gluetun:8000"
|
|
];
|
|
ports = [
|
|
"127.0.0.1:8083:8000"
|
|
];
|
|
environmentFiles = [
|
|
config.sops.templates.${gluetun_env}.path
|
|
];
|
|
};
|
|
prowlarr = {
|
|
image = "lscr.io/linuxserver/prowlarr";
|
|
autoStart = true;
|
|
extraOptions = [
|
|
"-l=traefik.enable=true"
|
|
"-l=traefik.http.routers.prowlarr.rule=${localHostRuleHavenisms "prowlarr"}"
|
|
"-l=traefik.http.services.prowlarr.loadbalancer.server.port=9696"
|
|
"-l=homepage.group=Arr"
|
|
"-l=homepage.name=Prowlarr"
|
|
"-l=homepage.icon=prowlarr.svg"
|
|
"-l=homepage.href=https://prowlarr.${havenisms}"
|
|
"-l=homepage.description=Torrent indexer"
|
|
];
|
|
volumes = [
|
|
"/tank/config/prowlarr:/config"
|
|
];
|
|
environment = {
|
|
UMASK = "002";
|
|
};
|
|
};
|
|
# Currently broken and doesn't work. :(
|
|
# flaresolverr = {
|
|
# image = "ghcr.io/flaresolverr/flaresolverr:latest";
|
|
# autoStart = true;
|
|
# extraOptions = [
|
|
# "-l=homepage.group=Infra"
|
|
# "-l=homepage.name=FlareSolverr"
|
|
# "-l=homepage.icon=flaresolverr.svg"
|
|
# "-l=homepage.href=https://flaresolverr.${domain}"
|
|
# "-l=homepage.description=Cloudflare bypass"
|
|
# ];
|
|
# volumes = [
|
|
# "/tank/config/flaresolverr:/config"
|
|
# ];
|
|
# environment = {
|
|
# UMASK = "002";
|
|
# };
|
|
# };
|
|
radarr = {
|
|
image = "lscr.io/linuxserver/radarr";
|
|
autoStart = true;
|
|
extraOptions = [
|
|
"-l=traefik.enable=true"
|
|
"-l=traefik.http.routers.radarr.rule=${localHostRuleHavenisms "radarr"}"
|
|
"-l=traefik.http.services.radarr.loadbalancer.server.port=7878"
|
|
"-l=homepage.group=Arr"
|
|
"-l=homepage.name=Radarr"
|
|
"-l=homepage.icon=radarr.svg"
|
|
"-l=homepage.href=https://radarr.${havenisms}"
|
|
"-l=homepage.description=Movie acquisition"
|
|
"-l=homepage.widget.type=radarr"
|
|
"-l=homepage.widget.url=http://radarr:7878"
|
|
"-l=homepage.widget.key={{HOMEPAGE_FILE_RADARR_KEY}}"
|
|
];
|
|
volumes = [
|
|
"/tank/media:/data"
|
|
"/tank/config/radarr:/config"
|
|
];
|
|
environment = {
|
|
UMASK = "002";
|
|
};
|
|
};
|
|
sonarr = {
|
|
image = "lscr.io/linuxserver/sonarr";
|
|
autoStart = true;
|
|
extraOptions = [
|
|
"-l=traefik.enable=true"
|
|
"-l=traefik.http.routers.sonarr.rule=${localHostRuleHavenisms "sonarr"}"
|
|
"-l=traefik.http.services.sonarr.loadbalancer.server.port=8989"
|
|
"-l=homepage.group=Arr"
|
|
"-l=homepage.name=Sonarr"
|
|
"-l=homepage.icon=sonarr.svg"
|
|
"-l=homepage.href=https://sonarr.${havenisms}"
|
|
"-l=homepage.description=Show acquisition"
|
|
"-l=homepage.widget.type=sonarr"
|
|
"-l=homepage.widget.url=http://sonarr:8989"
|
|
"-l=homepage.widget.key={{HOMEPAGE_FILE_SONARR_KEY}}"
|
|
];
|
|
volumes = [
|
|
"/tank/media:/data"
|
|
"/tank/config/sonarr:/config"
|
|
];
|
|
environment = {
|
|
UMASK = "002";
|
|
};
|
|
};
|
|
readarr = {
|
|
# The Linuxserver version of this image doesn't have a latest tag. Odd.
|
|
image = "lscr.io/linuxserver/readarr:develop";
|
|
autoStart = true;
|
|
extraOptions = [
|
|
"-l=traefik.enable=true"
|
|
"-l=traefik.http.routers.readarr.rule=${localHostRuleHavenisms "readarr"}"
|
|
"-l=traefik.http.services.readarr.loadbalancer.server.port=8787"
|
|
"-l=homepage.group=Arr"
|
|
"-l=homepage.name=Readarr"
|
|
"-l=homepage.icon=readarr.svg"
|
|
"-l=homepage.href=https://readarr.${havenisms}"
|
|
"-l=homepage.description=E-book acquisition"
|
|
"-l=homepage.widget.type=readarr"
|
|
"-l=homepage.widget.url=http://readarr.havenisms.com:8787"
|
|
"-l=homepage.widget.key={{HOMEPAGE_FILE_READARR_KEY}}"
|
|
];
|
|
volumes = [
|
|
"/tank/media:/data"
|
|
"/tank/config/readarr:/config"
|
|
];
|
|
environment = {
|
|
UMASK = "002";
|
|
};
|
|
};
|
|
bazarr = mkContainer {
|
|
# The Linuxserver version of this image doesn't have a latest tag. Odd.
|
|
image = "lscr.io/linuxserver/bazarr:latest";
|
|
port = 6767;
|
|
hostName = "bazarr";
|
|
homepageOpts = {
|
|
group = "Arr";
|
|
name = "Bazarr";
|
|
icon = "bazarr.svg";
|
|
description = "Subtitles";
|
|
};
|
|
volumes = [
|
|
"/tank/media:/data"
|
|
"/tank/config/bazarr:/config"
|
|
];
|
|
environment = {
|
|
UMASK = "002";
|
|
};
|
|
};
|
|
};
|
|
}
|