darmanandClaude Sonnet 5
d7a66f3e3b
Group service modules by category (media, network, vpn, identity, dev, desktop) to make the growing services/ dir easier to navigate. containers.nix stays at the top level since it's a shared backend, not a single-category service. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
40 lines
1.6 KiB
Nix
40 lines
1.6 KiB
Nix
{ config, ... }:
|
|
|
|
# Cinephage — indexer search + streaming/library manager. Runs the official
|
|
# container image, not upstream's nix flake module: its npmDepsHash is stale
|
|
# against its own package-lock.json, and a transitive dep hard-enforces pnpm,
|
|
# breaking the nix-sandboxed npm build regardless. Docker is the actually-
|
|
# maintained path. BETTER_AUTH_SECRET (paired sops secret in
|
|
# hosts/jupiter/secrets.nix) signs sessions/encrypts stored API keys — must
|
|
# be static, not app-generated, or losing it invalidates everything.
|
|
{
|
|
virtualisation.oci-containers.containers.cinephage = {
|
|
image = "ghcr.io/moldytaint/cinephage:latest";
|
|
autoStart = true;
|
|
# Host networking, not a published port: cinephage needs to reach
|
|
# Prowlarr/SABnzbd on jupiter's own localhost (they're native systemd
|
|
# services, not containers) — bridge-mode "localhost" would be the
|
|
# container's own netns, not the host's.
|
|
extraOptions = [ "--network=host" ];
|
|
volumes = [
|
|
"/mnt/data/AppData/cinephage:/config"
|
|
"/mnt/data/HighSeas:/media"
|
|
"/mnt/data/HighSeas/Downloads:/downloads"
|
|
];
|
|
environment = {
|
|
PUID = "1000";
|
|
PGID = "100"; # darman:users — matches HighSeas' real on-disk ownership
|
|
TZ = "Europe/Berlin";
|
|
ORIGIN = "http://cinephage.jupiter.sol";
|
|
};
|
|
environmentFiles = [ config.sops.templates."cinephage.env".path ];
|
|
};
|
|
|
|
sops.templates."cinephage.env".content =
|
|
"BETTER_AUTH_SECRET=${config.sops.placeholder.cinephage_better_auth_secret}";
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /mnt/data/AppData/cinephage 0755 darman users -"
|
|
];
|
|
}
|