Reorganize services/ into category subfolders

Group service modules by category (media, network, vpn, identity, dev, desktop) to make the growing services/ dir easier to navigate. containers.nix stays at the top level since it's a shared backend, not a single-category service. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-20 06:08:43 +02:00
parent 4679afa505
commit d7a66f3e3b
27 changed files with 41 additions and 38 deletions
@@ -0,0 +1,45 @@
+{ ... }:
+
+# SABnzbd — usenet downloader. Reuses the config migrated from the old
+# ZimaOS docker stack (servers/API key/history already set up) by pointing
+# straight at the real ini instead of generating a fresh NixOS-managed one.
+# Runs as the module's default dedicated `sabnzbd` system user — after first
+# deploy, chown the migrated config dir to it (see README/CLAUDE notes):
+#   chown -R sabnzbd:sabnzbd /mnt/data/AppData/sabnzbd/config
+{
+  services.sabnzbd = {
+    enable = true;
+    configFile = "/mnt/data/AppData/sabnzbd/config/sabnzbd.ini";
+    allowConfigWrite = true;   # real pre-existing state — let sabnzbd keep saving it
+  };
+
+  # Write access to the shared downloads dir (owned darman:users on disk).
+  users.users.sabnzbd.extraGroups = [ "users" ];
+
+  # SABnzbd hardcodes completed job folders to 0700 on every job, ignoring
+  # the ini's `umask` (that only covers files during unpack, not the job
+  # dir itself). setgid on Downloads keeps the group as "users" but perm
+  # bits still come back zeroed, locking out cinephage/mediamanager — sweep
+  # it clean instead of fighting SABnzbd.
+  systemd.services.fix-downloads-perms = {
+    description = "Fix group perms SABnzbd resets on completed downloads";
+    serviceConfig.Type = "oneshot";
+    script = ''
+      find /mnt/data/HighSeas/Downloads \
+        ! -group users -exec chgrp users {} + 2>/dev/null || true
+      find /mnt/data/HighSeas/Downloads -type d ! -perm -g+rwx \
+        -exec chmod g+rwx {} + 2>/dev/null || true
+      find /mnt/data/HighSeas/Downloads -type f ! -perm -g+rw \
+        -exec chmod g+rw {} + 2>/dev/null || true
+    '';
+  };
+
+  systemd.timers.fix-downloads-perms = {
+    description = "Periodically fix group perms under HighSeas/Downloads";
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnBootSec = "1m";
+      OnUnitActiveSec = "2m";
+    };
+  };
+}