jahanson/mochi
1
0
Fork 0
Code Issues 1 Pull requests 2 Projects Releases Packages Wiki Activity Actions

to remove/rearrange files privileged is required.

Browse source
This commit is contained in:
Joseph Hanson 2025-02-09 19:24:05 -06:00
parent aae3f3397e
commit e782f7c268
Signed by: jahanson
SSH key fingerprint: SHA256:vy6dKBECV522aPAwklFM3ReKAVB086rT3oWwiuiFG7o
2 changed files with 24 additions and 26 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
nixos/modules/nixos/services/radarr/default.nix
View file

@ -5,8 +5,7 @@
utils, utils,
... ...
}: }:
with lib; with lib; let
let
cfg = config.mySystem.services.radarr; cfg = config.mySystem.services.radarr;
dbOptions = { dbOptions = {
options = { options = {
@ -51,12 +50,11 @@ let
}; };
}; };
}; };
in in {
{
options.mySystem.services.radarr = { options.mySystem.services.radarr = {
enable = mkEnableOption "Radarr"; enable = mkEnableOption "Radarr";
package = mkPackageOption pkgs "Radarr" { }; package = mkPackageOption pkgs "Radarr" {};
user = mkOption { user = mkOption {
type = types.str; type = types.str;
@ -128,7 +126,7 @@ in
extraEnvVars = mkOption { extraEnvVars = mkOption {
type = types.attrs; type = types.attrs;
default = { }; default = {};
example = { example = {
MY_VAR = "my value"; MY_VAR = "my value";
}; };
@ -169,7 +167,7 @@ in
"network.target" "network.target"
"nss-lookup.target" "nss-lookup.target"
]; ];
wantedBy = [ "multi-user.target" ]; wantedBy = ["multi-user.target"];
environment = lib.mkMerge [ environment = lib.mkMerge [
{ {
RADARR__APP__INSTANCENAME = "Radarr"; RADARR__APP__INSTANCENAME = "Radarr";
@ -207,8 +205,8 @@ in
RestartSec = 5; RestartSec = 5;
} }
(lib.mkIf cfg.hardening { (lib.mkIf cfg.hardening {
CapabilityBoundingSet = [ "" ]; CapabilityBoundingSet = [""];
DeviceAllow = [ "" ]; DeviceAllow = [""];
DevicePolicy = "closed"; DevicePolicy = "closed";
LockPersonality = true; LockPersonality = true;
# Needs access to .Net CLR memory space. # Needs access to .Net CLR memory space.
@ -225,6 +223,7 @@ in
cfg.dataDir cfg.dataDir
cfg.moviesDir cfg.moviesDir
"/var/log/radarr" "/var/log/radarr"
"/eru/media"
]; ];
RestrictAddressFamilies = [ RestrictAddressFamilies = [
"AF_INET" "AF_INET"
@ -243,7 +242,7 @@ in
SystemCallArchitectures = "native"; SystemCallArchitectures = "native";
SystemCallFilter = [ SystemCallFilter = [
"@system-service" "@system-service"
"~@privileged" #"~@privileged"
# .Net CLR requirement # .Net CLR requirement
#"~@resources" #"~@resources"
]; ];
@ -280,7 +279,7 @@ in
''}"; ''}";
EnvironmentFile = ( EnvironmentFile = (
[ "-/run/radarr/secrets.env" ] ["-/run/radarr/secrets.env"]
++ lib.optional (cfg.extraEnvVarFile != null && cfg.extraEnvVarFile != "") cfg.extraEnvVarFile ++ lib.optional (cfg.extraEnvVarFile != null && cfg.extraEnvVarFile != "") cfg.extraEnvVarFile
); );
}) })
@ -288,10 +287,10 @@ in
}; };
networking.firewall = mkIf cfg.openFirewall { networking.firewall = mkIf cfg.openFirewall {
allowedTCPPorts = [ cfg.port ]; allowedTCPPorts = [cfg.port];
}; };
users.groups.${cfg.group} = { }; users.groups.${cfg.group} = {};
users.users = mkIf (cfg.user == "radarr") { users.users = mkIf (cfg.user == "radarr") {
radarr = { radarr = {
inherit (cfg) group; inherit (cfg) group;

25
nixos/modules/nixos/services/sonarr/default.nix
View file

@ -5,8 +5,7 @@
utils, utils,
... ...
}: }:
with lib; with lib; let
let
cfg = config.mySystem.services.sonarr; cfg = config.mySystem.services.sonarr;
dbOptions = { dbOptions = {
options = { options = {
@ -51,12 +50,11 @@ let
}; };
}; };
}; };
in in {
{
options.mySystem.services.sonarr = { options.mySystem.services.sonarr = {
enable = mkEnableOption "Sonarr"; enable = mkEnableOption "Sonarr";
package = mkPackageOption pkgs "Sonarr" { }; package = mkPackageOption pkgs "Sonarr" {};
user = mkOption { user = mkOption {
type = types.str; type = types.str;
@ -115,7 +113,7 @@ in
extraEnvVars = mkOption { extraEnvVars = mkOption {
type = types.attrs; type = types.attrs;
default = { }; default = {};
example = { example = {
MY_VAR = "my value"; MY_VAR = "my value";
}; };
@ -169,7 +167,7 @@ in
"network.target" "network.target"
"nss-lookup.target" "nss-lookup.target"
]; ];
wantedBy = [ "multi-user.target" ]; wantedBy = ["multi-user.target"];
environment = lib.mkMerge [ environment = lib.mkMerge [
{ {
SONARR__APP__INSTANCENAME = "Sonarr"; SONARR__APP__INSTANCENAME = "Sonarr";
@ -207,8 +205,8 @@ in
RestartSec = 5; RestartSec = 5;
} }
(lib.mkIf cfg.hardening { (lib.mkIf cfg.hardening {
CapabilityBoundingSet = [ "" ]; CapabilityBoundingSet = [""];
DeviceAllow = [ "" ]; DeviceAllow = [""];
DevicePolicy = "closed"; DevicePolicy = "closed";
LockPersonality = true; LockPersonality = true;
# Needs access to .Net CLR memory space. # Needs access to .Net CLR memory space.
@ -225,6 +223,7 @@ in
cfg.dataDir cfg.dataDir
cfg.tvDir cfg.tvDir
"/var/log/sonarr" "/var/log/sonarr"
"/eru/media"
]; ];
RestrictAddressFamilies = [ RestrictAddressFamilies = [
"AF_INET" "AF_INET"
@ -244,7 +243,7 @@ in
SystemCallArchitectures = "native"; SystemCallArchitectures = "native";
SystemCallFilter = [ SystemCallFilter = [
"@system-service" "@system-service"
"~@privileged" #"~@privileged"
# .Net CLR requirement # .Net CLR requirement
#"~@resources" #"~@resources"
]; ];
@ -281,7 +280,7 @@ in
''}"; ''}";
EnvironmentFile = ( EnvironmentFile = (
[ "-/run/sonarr/secrets.env" ] ["-/run/sonarr/secrets.env"]
++ lib.optional (cfg.extraEnvVarFile != null && cfg.extraEnvVarFile != "") cfg.extraEnvVarFile ++ lib.optional (cfg.extraEnvVarFile != null && cfg.extraEnvVarFile != "") cfg.extraEnvVarFile
); );
}) })
@ -289,10 +288,10 @@ in
}; };
networking.firewall = mkIf cfg.openFirewall { networking.firewall = mkIf cfg.openFirewall {
allowedTCPPorts = [ cfg.port ]; allowedTCPPorts = [cfg.port];
}; };
users.groups.${cfg.group} = { }; users.groups.${cfg.group} = {};
users.users = mkIf (cfg.user == "sonarr") { users.users = mkIf (cfg.user == "sonarr") {
sonarr = { sonarr = {
inherit (cfg) group; inherit (cfg) group;