jahanson/mochi
1
0
Fork 0
Code Issues 1 Pull requests 2 Projects Releases Packages Wiki Activity Actions

Merge pull request 'feat: multi-radarr' (#74) from multi-radarr into main

Browse source 
Reviewed-on: #74
This commit is contained in:
Joseph Hanson 2025-02-10 11:49:52 -06:00
commit 77d0962f1c
4 changed files with 433 additions and 282 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

60
nixos/hosts/shadowfax/config/sops-secrets.nix
View file

@ -91,41 +91,77 @@
restartUnits = [ "sonarr.service" ]; restartUnits = [ "sonarr.service" ];
}; };
# Radarr # Radarr
"arr/radarr/apiKey" = { "arr/radarr/1080p/apiKey" = {
sopsFile = ../secrets.sops.yaml; sopsFile = ../secrets.sops.yaml;
owner = "radarr"; owner = "radarr";
mode = "400"; mode = "400";
restartUnits = [ "radarr.service" ]; restartUnits = [ "radarr-movies1080p.service" ];
}; };
"arr/radarr/postgres/dbName" = { "arr/radarr/1080p/postgres/dbName" = {
sopsFile = ../secrets.sops.yaml; sopsFile = ../secrets.sops.yaml;
owner = "radarr"; owner = "radarr";
mode = "400"; mode = "400";
restartUnits = [ "radarr.service" ]; restartUnits = [ "radarr-movies1080p.service" ];
}; };
"arr/radarr/postgres/user" = { "arr/radarr/1080p/postgres/user" = {
sopsFile = ../secrets.sops.yaml; sopsFile = ../secrets.sops.yaml;
owner = "radarr"; owner = "radarr";
mode = "400"; mode = "400";
restartUnits = [ "radarr.service" ]; restartUnits = [ "radarr-movies1080p.service" ];
}; };
"arr/radarr/postgres/password" = { "arr/radarr/1080p/postgres/password" = {
sopsFile = ../secrets.sops.yaml; sopsFile = ../secrets.sops.yaml;
owner = "radarr"; owner = "radarr";
mode = "400"; mode = "400";
restartUnits = [ "radarr.service" ]; restartUnits = [ "radarr-movies1080p.service" ];
}; };
"arr/radarr/postgres/host" = { "arr/radarr/1080p/postgres/host" = {
sopsFile = ../secrets.sops.yaml; sopsFile = ../secrets.sops.yaml;
owner = "radarr"; owner = "radarr";
mode = "400"; mode = "400";
restartUnits = [ "radarr.service" ]; restartUnits = [ "radarr-movies1080p.service" ];
}; };
"arr/radarr/extraEnvVars" = { "arr/radarr/1080p/extraEnvVars" = {
sopsFile = ../secrets.sops.yaml; sopsFile = ../secrets.sops.yaml;
owner = "radarr"; owner = "radarr";
mode = "400"; mode = "400";
restartUnits = [ "radarr.service" ]; restartUnits = [ "radarr-movies1080p.service" ];
};
"arr/radarr/anime/apiKey" = {
sopsFile = ../secrets.sops.yaml;
owner = "radarr";
mode = "400";
restartUnits = [ "radarr-anime.service" ];
};
"arr/radarr/anime/postgres/dbName" = {
sopsFile = ../secrets.sops.yaml;
owner = "radarr";
mode = "400";
restartUnits = [ "radarr-anime.service" ];
};
"arr/radarr/anime/postgres/user" = {
sopsFile = ../secrets.sops.yaml;
owner = "radarr";
mode = "400";
restartUnits = [ "radarr-anime.service" ];
};
"arr/radarr/anime/postgres/password" = {
sopsFile = ../secrets.sops.yaml;
owner = "radarr";
mode = "400";
restartUnits = [ "radarr-anime.service" ];
};
"arr/radarr/anime/postgres/host" = {
sopsFile = ../secrets.sops.yaml;
owner = "radarr";
mode = "400";
restartUnits = [ "radarr-anime.service" ];
};
"arr/radarr/anime/extraEnvVars" = {
sopsFile = ../secrets.sops.yaml;
owner = "radarr";
mode = "400";
restartUnits = [ "radarr-anime.service" ];
}; };
# Unpackerr # Unpackerr
"arr/unpackerr/extraEnvVars" = { "arr/unpackerr/extraEnvVars" = {

45
nixos/hosts/shadowfax/default.nix
View file

@ -4,7 +4,8 @@
inputs, inputs,
pkgs, pkgs,
... ...
}: let }:
let
sanoidConfig = import ./config/sanoid.nix { }; sanoidConfig = import ./config/sanoid.nix { };
disks = import ./config/disks.nix; disks = import ./config/disks.nix;
smartdDevices = map (device: { inherit device; }) disks; smartdDevices = map (device: { inherit device; }) disks;
@ -37,7 +38,8 @@
${builtins.readFile ./scripts/refresh-series.sh} ${builtins.readFile ./scripts/refresh-series.sh}
''; '';
}; };
in { in
{
imports = [ imports = [
inputs.disko.nixosModules.disko inputs.disko.nixosModules.disko
(import ../../profiles/disko-nixos.nix { (import ../../profiles/disko-nixos.nix {
@ -266,23 +268,50 @@ in {
}; };
# Radarr # Radarr
radarr = { radarr = {
enable = true;
instances = {
movies1080p = {
enable = true; enable = true;
package = pkgs.unstable.radarr; package = pkgs.unstable.radarr;
dataDir = "/nahar/radarr"; dataDir = "/nahar/radarr/1080p";
extraEnvVarFile = config.sops.secrets."arr/radarr/extraEnvVars".path; extraEnvVarFile = config.sops.secrets."arr/radarr/1080p/extraEnvVars".path;
moviesDir = "/moria/media/Movies"; moviesDir = "/moria/media/Movies";
user = "radarr"; user = "radarr";
group = "kah"; group = "kah";
port = 7878; port = 7878;
openFirewall = true; openFirewall = true;
hardening = true; hardening = true;
apiKeyFile = config.sops.secrets."arr/radarr/apiKey".path; apiKeyFile = config.sops.secrets."arr/radarr/1080p/apiKey".path;
db = { db = {
enable = true; enable = true;
hostFile = config.sops.secrets."arr/radarr/postgres/host".path; hostFile = config.sops.secrets."arr/radarr/1080p/postgres/host".path;
port = 5432; port = 5432;
userFile = config.sops.secrets."arr/radarr/postgres/user".path; dbname = "radarr_main";
passwordFile = config.sops.secrets."arr/radarr/postgres/password".path; userFile = config.sops.secrets."arr/radarr/1080p/postgres/user".path;
passwordFile = config.sops.secrets."arr/radarr/1080p/postgres/password".path;
};
};
moviesAnime = {
enable = true;
package = pkgs.unstable.radarr;
dataDir = "/nahar/radarr/anime";
extraEnvVarFile = config.sops.secrets."arr/radarr/anime/extraEnvVars".path;
moviesDir = "/moria/media/Anime/Movies";
user = "radarr";
group = "kah";
port = 7879;
openFirewall = true;
hardening = true;
apiKeyFile = config.sops.secrets."arr/radarr/anime/apiKey".path;
db = {
enable = true;
hostFile = config.sops.secrets."arr/radarr/anime/postgres/host".path;
port = 5432;
dbname = "radarr_anime";
userFile = config.sops.secrets."arr/radarr/anime/postgres/user".path;
passwordFile = config.sops.secrets."arr/radarr/anime/postgres/password".path;
};
};
}; };
}; };
# Sonarr # Sonarr

25
nixos/hosts/shadowfax/secrets.sops.yaml
View file

@ -28,13 +28,22 @@ arr:
password: ENC[AES256_GCM,data:XOrycMom2utnefraGPoAq7xtP6yfSzTb8g==,iv:WQInK+bJuDNI9uN/GeQ2Fb1Mmlux6+lXwkGS1ZEh+kQ=,tag:DGqLerxomCVfVv15Gt3b8A==,type:str] password: ENC[AES256_GCM,data:XOrycMom2utnefraGPoAq7xtP6yfSzTb8g==,iv:WQInK+bJuDNI9uN/GeQ2Fb1Mmlux6+lXwkGS1ZEh+kQ=,tag:DGqLerxomCVfVv15Gt3b8A==,type:str]
extraEnvVars: ENC[AES256_GCM,data:KnZSJ2YbNLawSzrj7syx0cfAFseHbgjGvjpB7yWajXfCIy+CV800z9YU2SVO2kV6b+9OrmyKKFFbM5ac4cWnc5Pcx8TUxfiAuL5RSi6ZTmUrZUA7Zqx5UDTHwXgvhDI=,iv:TX8sFk7uc1TYG/gkuA9plGZlhP25WuczEXd+QKsPi4c=,tag:zhVeZxrTgcv+Y2OP8I+k5g==,type:str] extraEnvVars: ENC[AES256_GCM,data:KnZSJ2YbNLawSzrj7syx0cfAFseHbgjGvjpB7yWajXfCIy+CV800z9YU2SVO2kV6b+9OrmyKKFFbM5ac4cWnc5Pcx8TUxfiAuL5RSi6ZTmUrZUA7Zqx5UDTHwXgvhDI=,iv:TX8sFk7uc1TYG/gkuA9plGZlhP25WuczEXd+QKsPi4c=,tag:zhVeZxrTgcv+Y2OP8I+k5g==,type:str]
radarr: radarr:
apiKey: ENC[AES256_GCM,data:Qcfzr12aftnS+b3pDHHnfOya1+vlyVaoNCPLzJ9xv5Pv,iv:9M33sfqZPzeghxmBtYk3LgsfbInC7sPSQGuYFJiydh4=,tag:lSmi6Do64sarG15q6+yuQw==,type:str] 1080p:
apiKey: ENC[AES256_GCM,data:NVIa3nK4/QxZF1/peKei9Qsxn2AjRiBnBdr2N08QiXhi,iv:h/Rb38FCF8auMCTT+Cuj/i8YAeavntwbbJEA9LwDYUY=,tag:OwAQy76GjIrY9/126zExdA==,type:str]
postgres: postgres:
host: ENC[AES256_GCM,data:mYFhyUYIqp8=,iv:Cj03GOR58PWv3HWXRx0/D5tZ2oObejtIVuQcTcHGkuw=,tag:9K2asujaqi4/Qbozb18Ghg==,type:str] host: ENC[AES256_GCM,data:bycrytLkcdI=,iv:zfsSP+uoVpvG2HXydCXT+yfMc5GadjG8qo+4ld+rdjk=,tag:cXtYTFg27hS9Idn3UjUn1A==,type:str]
dbName: ENC[AES256_GCM,data:zC4j0VJJpWWT0XY=,iv:ITupnWLgvI2wAPnkD826S77BMELDqRWZKax51SVkBgA=,tag:L7YXfoxAhi94ssBoE35Aug==,type:str] dbName: ENC[AES256_GCM,data:pjvSoLQ/TUdd6Y0=,iv:TsThUHuF9Mm1fuGYcEh/GanaDGuoSJxPt7LVRJHSFAo=,tag:tMIdTPSaNE4hOh97lck6DQ==,type:str]
user: ENC[AES256_GCM,data:jaYUWAzQ,iv:ayEutHFPyZ7CN3inTqmgPmintR8qE8HfatvzCx7VXnA=,tag:3Ou0JRzpcihL0AWcC0pC5w==,type:str] user: ENC[AES256_GCM,data:0QFQsAfq,iv:+qtq/BhC26fdW9rXlbZFf6fQCOV+UsP1Y9cNMUtn5+w=,tag:WBg4ruYa7t+8d8iHjjPJ1g==,type:str]
password: ENC[AES256_GCM,data:XcS9H5L+ikA2KflepKrBHVlBjKwB0Vu8mw==,iv:lSpoEiCqOpP3p1T7bBH8F9YiSf2kwQQC+FQPuaKojnE=,tag:ScV/E6JeomQlfp35NIrh1g==,type:str] password: ENC[AES256_GCM,data:TvGQsShraVE70JoHkk4PWkoeElu+dn882w==,iv:oQ15XrRCLUZ6XWSifB9hGF+wYActgDE9NEqly+LTTFA=,tag:kUbn5dKq9jU4Xl1+mRI2Zw==,type:str]
extraEnvVars: ENC[AES256_GCM,data:hQlXQD4Zb3HnXfOZsX5PpxxyIzpYjqFletRiGRUWpICCEIcbsEK6WN8VtCaH+lpVqcVOpLUSSX1jILEwn4H483JyPk9EI04tIGBgq+svUOg7PZhc7zLllczMKN+BcdY=,iv:OyeAYXln8Dm1WvrrySkYXk+XC7kcwHFUSamIBdCTHRY=,tag:OGsR6IfBJF5Ki6VG15iyUw==,type:str] extraEnvVars: ENC[AES256_GCM,data:4E1NFQZOrH7sBGnJus7+VZLTWnzif1Asr+mCeaXorsfO8nJpA14HjQ9diAqPuabTlUsl4vMznFmKjdAFCvuRz9p7xfq96qmJKN3oTKuVaz6SlQbXKcfCeldn2E2EA2k=,iv:CVaiTGR0WpcCNvDpD202P4dHqEjX9xqJEVz0usEeANY=,tag:FRz7t5wV2TePakxmyBkb1Q==,type:str]
anime:
apiKey: ENC[AES256_GCM,data:7Z59sJCKBmayd1J71+C72IdoeNlU71jcJS885bUwc+g8,iv:0Uav84UAanmZvvZfJJNoDmvyKY068L8+ONnVGWmldSI=,tag:WYQvccwlm/Y8S2ynPkEPjA==,type:str]
postgres:
host: ENC[AES256_GCM,data:EL6Qzm8r/XQ=,iv:Gz099lg7zDRrIf7i2kOb+MSXGwHazTtcnBbCmciVCHE=,tag:l2Lqd7dDeRZYzflhK9/Kdg==,type:str]
dbName: ENC[AES256_GCM,data:9MJ6UcVlLPN+hI4=,iv:AwCdIJ1KwThbUVGM759m0GVWh3yf3anBHdsfdIjVWP4=,tag:7kUUSTNpt/rOtYHkDRlKxA==,type:str]
user: ENC[AES256_GCM,data:QE+Lr0L0ad3oufG4,iv:WCTkwhN9FjibXlyPqY7oDjSByXn6Exma/VDsE3ju/FE=,tag:orFBsxd/ETSaiFC1KNsO0A==,type:str]
password: ENC[AES256_GCM,data:3rYBq3cosu962m/FZIc/WZogr+BZxQ==,iv:dK/IDKYz3NKeAE7PV/f+qRtSu3veg20B6+6gZmaD/eg=,tag:9k0+zrcWC6i6YjwJkMYkzA==,type:str]
extraEnvVars: ENC[AES256_GCM,data:HAGHXI14CFx/CXbpHGn1MQQeRmMO9zzsnHEJrgTfho96XPtoKJQj+b3h7VNVkkHAifjuMzbKb0BM8qrtAIjssWuQUrWChxgHBg3OWodsJkstYplB0RYIun5RorzHaNY=,iv:3nW9806ciMdblFphEi9zK8kkIB8r01eF/167vYq177w=,tag:7aPJ63Wl+SGzWCBXuitgmA==,type:str]
unpackerr: unpackerr:
extraEnvVars: ENC[AES256_GCM,data:UT6HLaEKGEHggZx8Ict23OOLlRppErCnIDA16CleMFe33/IHyyp8El8aBNCq5A/1+NIGN5aZat2El562QAcZBVITa9ffmmtXqnDsheaRo+nDSPR5mGqh39uoKWIy2eSO5nv3rD0jN08MFYjxZNti/k0p0JIDMYN5shnVLiwO7krLs3Z6m+sZntg6euCWnHJMM2p3v38bffUzbZWrD1hEKaOUofOhTL0rDUiiysCawMZvJx6zXgfyO6DeUdwlYIxlg0mZ8SkmDRoFDPYrI40tIA+oSScJhJkDgoNPPJVEuGu6vVMPgqkAWUSucVGeiYVati2PsBJHn9wori2GWRTY0n7mjQKe8cz3nPIKQFWYLRWDZ9UBBvh05bYLa54+C4mGczFFPZra/DDoR2i9gzCXxjhRmt2Qs+g0RqefJTq5W2qQKRLj9PKFr02GuOY=,iv:pmOkkfFd4eGRCburRz6rgqqAFQJhPgjuUKn23ipLg3E=,tag:heZtewMOnnMxE5qSVEiI0Q==,type:str] extraEnvVars: ENC[AES256_GCM,data:UT6HLaEKGEHggZx8Ict23OOLlRppErCnIDA16CleMFe33/IHyyp8El8aBNCq5A/1+NIGN5aZat2El562QAcZBVITa9ffmmtXqnDsheaRo+nDSPR5mGqh39uoKWIy2eSO5nv3rD0jN08MFYjxZNti/k0p0JIDMYN5shnVLiwO7krLs3Z6m+sZntg6euCWnHJMM2p3v38bffUzbZWrD1hEKaOUofOhTL0rDUiiysCawMZvJx6zXgfyO6DeUdwlYIxlg0mZ8SkmDRoFDPYrI40tIA+oSScJhJkDgoNPPJVEuGu6vVMPgqkAWUSucVGeiYVati2PsBJHn9wori2GWRTY0n7mjQKe8cz3nPIKQFWYLRWDZ9UBBvh05bYLa54+C4mGczFFPZra/DDoR2i9gzCXxjhRmt2Qs+g0RqefJTq5W2qQKRLj9PKFr02GuOY=,iv:pmOkkfFd4eGRCburRz6rgqqAFQJhPgjuUKn23ipLg3E=,tag:heZtewMOnnMxE5qSVEiI0Q==,type:str]
sops: sops:
@ -115,8 +124,8 @@ sops:
aVlOSHhFb2I5UnYwVytyQzlWTXBDYUUKdQKilmfJ1F7UYKtQV9zV95FcRIK17p4M aVlOSHhFb2I5UnYwVytyQzlWTXBDYUUKdQKilmfJ1F7UYKtQV9zV95FcRIK17p4M
vGvu/pGJ32tH8xI7cNs9I5Hmg9c5wOam21W1FDk+VlJ/ClXqQzS0MA== vGvu/pGJ32tH8xI7cNs9I5Hmg9c5wOam21W1FDk+VlJ/ClXqQzS0MA==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2025-02-04T04:28:14Z" lastmodified: "2025-02-10T04:49:46Z"
mac: ENC[AES256_GCM,data:7y38SzT51EOTx83lEJugW5XmsgGa00yemYIE5IRLasqwiSGSWHTt3iZy/2FLNXbFIqiz+O1K3xajstOF4ijvpYmP6Tu3rCh/4gxChqcokP6kxsI6b4nKp6ZkC/eZpoevFQmYHYqJU4b9iOQT9QZqdzwCIxOVRNZDAAc8u1SeBsg=,iv:7ni7qo6Xojs5MlOZBMLnnEKnDqdNDp9Ms/D9JMoRnm0=,tag:1/wqZh0igzhFyqdBxemntA==,type:str] mac: ENC[AES256_GCM,data:wT82lve5wNbxXUgcw3EZkOrsLFOmtriJtSNtpcfcH2KYkFEZTyzYCO10EBMrm1FjJxJFmhtde9f+CkSkT5ypjP6Ou4TGn9nP0jOlCyLxYyQkv7Lr31aEF8d2Q0NDjSHePW4YUiY88YrOX8shWYFVtNoZSonyCv8G6lwGVIsZzi4=,iv:MkHiwV5qRBE3LfTt0WHV56LWAeTEcRlux4xIf90R3AU=,tag:qUgCaPLa+W/pZ8uM1Gw7Xw==,type:str]
pgp: [] pgp: []
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.9.4 version: 3.9.4

197
nixos/modules/nixos/services/radarr/default.nix
View file

@ -5,7 +5,8 @@
utils, utils,
... ...
}: }:
with lib; let with lib;
let
cfg = config.mySystem.services.radarr; cfg = config.mySystem.services.radarr;
dbOptions = { dbOptions = {
options = { options = {
@ -50,9 +51,40 @@ with lib; let
}; };
}; };
}; };
in {
# Function to create instance-specific configuration
mkRadarrInstance = name: instanceCfg: {
systemd.services."radarr-${name}" = {
description = "Radarr (${name})";
};
networking.firewall = mkIf instanceCfg.openFirewall {
allowedTCPPorts = [ instanceCfg.port ];
};
users.groups.${instanceCfg.group} = { };
users.users = mkIf (instanceCfg.user == "radarr") {
radarr = {
inherit (instanceCfg) group;
isSystemUser = true;
home = instanceCfg.dataDir;
};
};
};
in
{
options.mySystem.services.radarr = { options.mySystem.services.radarr = {
enable = mkEnableOption "Radarr"; enable = mkEnableOption "Radarr (global)";
instances = mkOption {
type = types.attrsOf (
types.submodule (
{ name, ... }:
{
options = {
enable = mkEnableOption "Radarr (instance)";
package = mkPackageOption pkgs "Radarr" { }; package = mkPackageOption pkgs "Radarr" { };
@ -70,7 +102,7 @@ in {
dataDir = mkOption { dataDir = mkOption {
type = types.path; type = types.path;
default = "/var/lib/radarr"; default = "/var/lib/radarr/${name}";
description = "Storage directory for radarr data"; description = "Storage directory for radarr data";
}; };
@ -140,29 +172,58 @@ in {
description = "Extra environment file for Radarr."; description = "Extra environment file for Radarr.";
}; };
}; };
}
)
);
default = { };
description = "Radarr instance configurations.";
};
};
config = mkIf cfg.enable { config = mkIf cfg.enable {
assertions = [ # Add assertions for all instances
assertions = flatten (
mapAttrsToList (
name: instanceCfg:
if instanceCfg.enable then
[
{ {
assertion = !(cfg.db.host != "" && cfg.db.hostFile != ""); assertion = !(instanceCfg.db.host != "" && instanceCfg.db.hostFile != "");
message = "Specify either a direct database host via db.host or a file via db.hostFile (leave direct host empty)."; message = "Specify either a direct database host via db.host or a file via db.hostFile (leave direct host empty).";
} }
{ {
assertion = !(cfg.db.user != "radarr" && cfg.db.userFile != ""); assertion = !(instanceCfg.db.user != "radarr" && instanceCfg.db.userFile != "");
message = "Specify either a direct database user via db.user or a file via db.userFile."; message = "Specify either a direct database user via db.user or a file via db.userFile.";
} }
{ {
assertion = !(cfg.apiKey != "" && cfg.apiKeyFile != ""); assertion = !(instanceCfg.apiKey != "" && instanceCfg.apiKeyFile != "");
message = "Specify either a direct API key via apiKey or a file via apiKeyFile (leave direct API key empty)."; message = "Specify either a direct API key via apiKey or a file via apiKeyFile (leave direct API key empty).";
} }
]; ]
else
[ ]
) cfg.instances
);
systemd.tmpfiles.rules = [ # Create systemd tmpfiles rules for each enabled instance
"d ${cfg.dataDir} 0775 ${cfg.user} ${cfg.group}" systemd.tmpfiles.rules = flatten (
]; mapAttrsToList (
name: instanceCfg:
if instanceCfg.enable then
[
"d ${instanceCfg.dataDir} 0775 ${instanceCfg.user} ${instanceCfg.group}"
]
else
[ ]
) cfg.instances
);
systemd.services.radarr = { # Create services for each enabled instance
description = "Radarr"; systemd.services = mapAttrs' (
name: instanceCfg:
nameValuePair "radarr-${name}" (
mkIf instanceCfg.enable {
description = "Radarr (${name})";
after = [ after = [
"network.target" "network.target"
"nss-lookup.target" "nss-lookup.target"
@ -170,46 +231,45 @@ in {
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
environment = lib.mkMerge [ environment = lib.mkMerge [
{ {
RADARR__APP__INSTANCENAME = "Radarr"; RADARR__APP__INSTANCENAME = name;
RADARR__APP__THEME = "dark"; RADARR__APP__THEME = "dark";
RADARR__AUTH__METHOD = "External"; RADARR__AUTH__METHOD = "External";
RADARR__AUTH__REQUIRED = "DisabledForLocalAddresses"; RADARR__AUTH__REQUIRED = "DisabledForLocalAddresses";
RADARR__LOG__DBENABLED = "False"; RADARR__LOG__DBENABLED = "False";
RADARR__LOG__LEVEL = "info"; RADARR__LOG__LEVEL = "info";
RADARR__SERVER__PORT = toString cfg.port; RADARR__SERVER__PORT = toString instanceCfg.port;
RADARR__UPDATE__BRANCH = "develop"; RADARR__UPDATE__BRANCH = "develop";
} }
(lib.mkIf cfg.db.enable { (lib.mkIf instanceCfg.db.enable {
RADARR__POSTGRES__PORT = toString cfg.db.port; RADARR__POSTGRES__PORT = toString instanceCfg.db.port;
RADARR__POSTGRES__MAINDB = cfg.db.dbname; RADARR__POSTGRES__MAINDB = instanceCfg.db.dbname;
}) })
cfg.extraEnvVars instanceCfg.extraEnvVars
]; ];
serviceConfig = lib.mkMerge [ serviceConfig = lib.mkMerge [
{ {
Type = "simple"; Type = "simple";
User = cfg.user; User = instanceCfg.user;
Group = cfg.group; Group = instanceCfg.group;
ExecStart = utils.escapeSystemdExecArgs [ ExecStart = utils.escapeSystemdExecArgs [
(lib.getExe cfg.package) (lib.getExe instanceCfg.package)
"-nobrowser" "-nobrowser"
"-data=${cfg.dataDir}" "-data=${instanceCfg.dataDir}"
"-port=${toString cfg.port}" "-port=${toString instanceCfg.port}"
]; ];
WorkingDirectory = cfg.dataDir; WorkingDirectory = instanceCfg.dataDir;
RuntimeDirectory = "radarr"; RuntimeDirectory = "radarr-${name}";
LogsDirectory = "radarr"; LogsDirectory = "radarr-${name}";
RuntimeDirectoryMode = "0750"; RuntimeDirectoryMode = "0750";
Restart = "on-failure"; Restart = "on-failure";
RestartSec = 5; RestartSec = 5;
} }
(lib.mkIf cfg.hardening { (lib.mkIf instanceCfg.hardening {
CapabilityBoundingSet = [ "" ]; CapabilityBoundingSet = [ "" ];
DeviceAllow = [ "" ]; DeviceAllow = [ "" ];
DevicePolicy = "closed"; DevicePolicy = "closed";
LockPersonality = true; LockPersonality = true;
# Needs access to .Net CLR memory space.
MemoryDenyWriteExecute = false; MemoryDenyWriteExecute = false;
NoNewPrivileges = true; NoNewPrivileges = true;
PrivateDevices = true; PrivateDevices = true;
@ -220,9 +280,9 @@ in {
ProtectKernelTunables = true; ProtectKernelTunables = true;
ProtectSystem = "strict"; ProtectSystem = "strict";
ReadWritePaths = [ ReadWritePaths = [
cfg.dataDir instanceCfg.dataDir
cfg.moviesDir instanceCfg.moviesDir
"/var/log/radarr" "/var/log/radarr-${name}"
"/eru/media" "/eru/media"
]; ];
RestrictAddressFamilies = [ RestrictAddressFamilies = [
@ -242,61 +302,78 @@ in {
SystemCallArchitectures = "native"; SystemCallArchitectures = "native";
SystemCallFilter = [ SystemCallFilter = [
"@system-service" "@system-service"
#"~@privileged"
# .Net CLR requirement
#"~@resources"
]; ];
}) })
(lib.mkIf cfg.db.enable { (lib.mkIf instanceCfg.db.enable {
ExecStartPre = "+${pkgs.writeShellScript "radarr-pre-script" '' ExecStartPre = "+${pkgs.writeShellScript "radarr-${name}-pre-script" ''
mkdir -p /run/radarr mkdir -p /run/radarr-${name}
rm -f /run/radarr/secrets.env rm -f /run/radarr-${name}/secrets.env
# Helper function to safely write variables # Helper function to safely write variables
write_var() { write_var() {
local var_name="$1" local var_name="$1"
local value="$2" local value="$2"
if [ -n "$value" ]; then if [ -n "$value" ]; then
printf "%s=%s\n" "$var_name" "$value" >> /run/radarr/secrets.env printf "%s=%s\n" "$var_name" "$value" >> /run/radarr-${name}/secrets.env
fi fi
} }
# API Key (direct value or file) # API Key (direct value or file)
if [ -n "${cfg.apiKey}" ]; then if [ -n "${instanceCfg.apiKey}" ]; then
write_var "RADARR__AUTH__APIKEY" "${cfg.apiKey}" write_var "RADARR__AUTH__APIKEY" "${instanceCfg.apiKey}"
else else
write_var "RADARR__AUTH__APIKEY" "$(cat ${cfg.apiKeyFile})" write_var "RADARR__AUTH__APIKEY" "$(cat ${instanceCfg.apiKeyFile})"
fi fi
# Database Configuration # Database Configuration
write_var "RADARR__POSTGRES__HOST" "$([ -n "${cfg.db.host}" ] && echo "${cfg.db.host}" || cat "${cfg.db.hostFile}")" write_var "RADARR__POSTGRES__HOST" "$([ -n "${instanceCfg.db.host}" ] && echo "${instanceCfg.db.host}" || cat "${instanceCfg.db.hostFile}")"
write_var "RADARR__POSTGRES__USER" "$([ -n "${cfg.db.user}" ] && echo "${cfg.db.user}" || cat "${cfg.db.userFile}")" write_var "RADARR__POSTGRES__USER" "$([ -n "${instanceCfg.db.userFile}" ] && cat "${instanceCfg.db.userFile}" || echo "${instanceCfg.db.user}")"
write_var "RADARR__POSTGRES__PASSWORD" "$(cat ${cfg.db.passwordFile})" write_var "RADARR__POSTGRES__PASSWORD" "$(cat ${instanceCfg.db.passwordFile})"
# Final permissions # Final permissions
chmod 600 /run/radarr/secrets.env chmod 600 /run/radarr-${name}/secrets.env
chown ${cfg.user}:${cfg.group} /run/radarr/secrets.env chown ${instanceCfg.user}:${instanceCfg.group} /run/radarr-${name}/secrets.env
''}"; ''}";
EnvironmentFile = ( EnvironmentFile = (
["-/run/radarr/secrets.env"] [ "-/run/radarr-${name}/secrets.env" ]
++ lib.optional (cfg.extraEnvVarFile != null && cfg.extraEnvVarFile != "") cfg.extraEnvVarFile ++ lib.optional (
instanceCfg.extraEnvVarFile != null && instanceCfg.extraEnvVarFile != ""
) instanceCfg.extraEnvVarFile
); );
}) })
]; ];
}; }
)
) cfg.instances;
networking.firewall = mkIf cfg.openFirewall { # Firewall configurations
allowedTCPPorts = [cfg.port]; networking.firewall = mkMerge (
}; mapAttrsToList (
name: instanceCfg:
mkIf (instanceCfg.enable && instanceCfg.openFirewall) {
allowedTCPPorts = [ instanceCfg.port ];
}
) cfg.instances
);
users.groups.${cfg.group} = {}; # Users and groups
users.users = mkIf (cfg.user == "radarr") { users = mkMerge (
mapAttrsToList (
name: instanceCfg:
mkIf instanceCfg.enable {
groups.${instanceCfg.group} = { };
users = mkIf (instanceCfg.user == "radarr") {
radarr = { radarr = {
inherit (cfg) group; inherit (instanceCfg) group;
isSystemUser = true; isSystemUser = true;
home = cfg.dataDir; # home = instanceCfg.dataDir;
}; home = "/nahar/radarr";
}; };
}; };
} }
) cfg.instances
);
};
}