darmanandClaude Sonnet 5
69a63dc615
- sabnzbd, prowlarr, sonarr, radarr, clonarr, seerr, cinephage, mediamanager services, wired into jupiter with LAN Caddy vhosts. - Gitea: migrated the old ZimaOS docker instance's data (sqlite db, 4 repos, no LFS objects) into the NixOS module's default stateDir layout. HTTP via Caddy; git SSH on its own built-in server at :2222 (not :222 - the unpriv gitea user can't bind <1024). - mediamanager-nix flake input for the mediamanager service. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
42 lines
1.7 KiB
Nix
42 lines
1.7 KiB
Nix
{ config, ... }:
|
|
|
|
# Cinephage — indexer search + streaming/library manager. Runs the official
|
|
# container image, not upstream's nix flake module: their flake's
|
|
# npmDepsHash is stale against their own package-lock.json (fixed-output
|
|
# hash mismatch), and past that, a transitive dep's postinstall hard-enforces
|
|
# pnpm (`only-allow pnpm`), which fails under nix's network-sandboxed npm
|
|
# build regardless. Docker is their actually-maintained deployment path.
|
|
# Paired sops secret in hosts/jupiter/secrets.nix — BETTER_AUTH_SECRET signs
|
|
# sessions/encrypts stored API keys; losing it invalidates all sessions and
|
|
# makes saved keys unrecoverable, so it must be static, not app-generated.
|
|
{
|
|
virtualisation.oci-containers.containers.cinephage = {
|
|
image = "ghcr.io/moldytaint/cinephage:latest";
|
|
autoStart = true;
|
|
# Host networking, not a published port: cinephage needs to reach
|
|
# Prowlarr/SABnzbd on jupiter's own localhost (they're native systemd
|
|
# services, not containers) — bridge-mode "localhost" would be the
|
|
# container's own netns, not the host's.
|
|
extraOptions = [ "--network=host" ];
|
|
volumes = [
|
|
"/mnt/data/AppData/cinephage:/config"
|
|
"/mnt/data/HighSeas:/media"
|
|
"/mnt/data/HighSeas/Downloads:/downloads"
|
|
];
|
|
environment = {
|
|
PUID = "1000";
|
|
PGID = "100"; # darman:users — matches HighSeas' real on-disk ownership
|
|
TZ = "Europe/Berlin";
|
|
ORIGIN = "http://cinephage.jupiter.sol";
|
|
};
|
|
environmentFiles = [ config.sops.templates."cinephage.env".path ];
|
|
};
|
|
|
|
sops.templates."cinephage.env".content =
|
|
"BETTER_AUTH_SECRET=${config.sops.placeholder.cinephage_better_auth_secret}";
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /mnt/data/AppData/cinephage 0755 darman users -"
|
|
];
|
|
}
|