services: move cinephage and mediamanager to experimental/

Neither is imported by any host -- both are parked while their upstreams settle (cinephage ships only a container image, mediamanager comes from a community flake). Grouping them apart from services/media keeps that category to what jupiter actually runs. Pure rename, no content change; nothing imported them, so no host config moves with them.
2026-07-21 00:50:43 +02:00
parent 10416ed23d
commit 3a6950779e
2 changed files with 0 additions and 0 deletions
@@ -0,0 +1,39 @@
+{ config, ... }:
+
+# Cinephage — indexer search + streaming/library manager. Runs the official
+# container image, not upstream's nix flake module: its npmDepsHash is stale
+# against its own package-lock.json, and a transitive dep hard-enforces pnpm,
+# breaking the nix-sandboxed npm build regardless. Docker is the actually-
+# maintained path. BETTER_AUTH_SECRET (paired sops secret in
+# hosts/jupiter/secrets.nix) signs sessions/encrypts stored API keys — must
+# be static, not app-generated, or losing it invalidates everything.
+{
+  virtualisation.oci-containers.containers.cinephage = {
+    image = "ghcr.io/moldytaint/cinephage:latest";
+    autoStart = true;
+    # Host networking, not a published port: cinephage needs to reach
+    # Prowlarr/SABnzbd on jupiter's own localhost (they're native systemd
+    # services, not containers) — bridge-mode "localhost" would be the
+    # container's own netns, not the host's.
+    extraOptions = [ "--network=host" ];
+    volumes = [
+      "/mnt/data/AppData/cinephage:/config"
+      "/mnt/data/HighSeas:/media"
+      "/mnt/data/HighSeas/Downloads:/downloads"
+    ];
+    environment = {
+      PUID = "1000";
+      PGID = "100";   # darman:users — matches HighSeas' real on-disk ownership
+      TZ = "Europe/Berlin";
+      ORIGIN = "http://cinephage.jupiter.sol";
+    };
+    environmentFiles = [ config.sops.templates."cinephage.env".path ];
+  };
+
+  sops.templates."cinephage.env".content =
+    "BETTER_AUTH_SECRET=${config.sops.placeholder.cinephage_better_auth_secret}";
+
+  systemd.tmpfiles.rules = [
+    "d /mnt/data/AppData/cinephage 0755 darman users -"
+  ];
+}
@@ -0,0 +1,53 @@
+{ config, ... }:
+
+# MediaManager — media request/library manager. Module comes from the
+# community flake input `mediamanager-nix`, not nixpkgs. Paired sops secret
+# in hosts/jupiter/secrets.nix — without it the module mints+discards a
+# random auth token_secret on every restart, logging everyone out.
+# Port 8010: 8000 is taken by audiobookshelf on this host.
+{
+  services.media-manager = {
+    enable = true;
+    dataDir = "/mnt/data/AppData/mediamanager";
+    host = "0.0.0.0";
+    port = 8010;
+    postgres.enable = true;
+    environmentFile = config.sops.templates."mediamanager.env".path;
+    settings = {
+      misc = {
+        frontend_url = "http://mediamanager.jupiter.sol";
+        # Point straight at the existing library instead of the empty
+        # dirs under dataDir — group "users" needs write access (see
+        # the chmod note below); files stay darman-owned.
+        movie_directory = "/mnt/data/HighSeas/Movies";
+        tv_directory = "/mnt/data/HighSeas/Shows";
+        image_directory = "/mnt/data/HighSeas/images";
+        torrent_directory = "/mnt/data/HighSeas/Downloads";
+      };
+      auth.admin_emails = [ "mail@erik-s.dev" ];
+      # API keys are secret -> env vars via the sops template below, not here
+      # (settings.* is rendered to a world-readable file in /nix/store).
+      torrents.sabnzbd = {
+        enabled = true;
+        host = "http://localhost";
+        port = 8085;
+      };
+      indexers.prowlarr = {
+        enabled = true;
+        url = "http://localhost:9696";
+      };
+    };
+  };
+
+  sops.templates."mediamanager.env".content = ''
+    MEDIAMANAGER_AUTH__TOKEN_SECRET=${config.sops.placeholder.mediamanager_token_secret}
+    MEDIAMANAGER_TORRENTS__SABNZBD__API_KEY=${config.sops.placeholder.sabnzbd_api_key}
+    MEDIAMANAGER_INDEXERS__PROWLARR__API_KEY=${config.sops.placeholder.prowlarr_api_key}
+  '';
+
+  # HighSeas/{Movies,Shows,images,Downloads} are darman:users 755 on disk —
+  # group has no write bit. media-manager is in "users" (below); the dirs
+  # themselves were chmod g+w by hand once (not declarative — see CLAUDE.md
+  # gotchas), since this is pre-existing data, not something tmpfiles owns.
+  users.users.media-manager.extraGroups = [ "users" ];
+}