Update ghcr.io/koush/scrypted Docker tag to v0.123.37

flake.lock

@@ -223,16 +223,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1731880681,
-        "narHash": "sha256-FmYTkIyPBUxSWgA7DPIVTsCCMvSSbs56yOtHpLNSnKg=",
+        "lastModified": 1726989464,
+        "narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "aecd341dfead1c3ef7a3c15468ecd71e8343b7c6",
+        "rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-24.11",
+        "ref": "release-24.05",
         "repo": "home-manager",
         "type": "github"
       }
@@ -456,16 +456,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1731755305,
-        "narHash": "sha256-v5P3dk5JdiT+4x69ZaB18B8+Rcu3TIOrcdG4uEX7WZ8=",
+        "lastModified": 1731797254,
+        "narHash": "sha256-df3dJApLPhd11AlueuoN0Q4fHo/hagP75LlM5K1sz9g=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "057f63b6dc1a2c67301286152eb5af20747a9cb4",
+        "rev": "e8c38b73aeb218e27163376a2d617e61a2ad9b59",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-24.11",
+        "ref": "nixos-24.05",
         "repo": "nixpkgs",
         "type": "github"
       }

nixos/modules/nixos/containers/jellyfin/default.nix

@@ -1,6 +1,7 @@
 {
   lib,
   config,
+  pkgs,
   ...
 }:
 with lib;
@@ -9,7 +10,6 @@ let
   # renovate: depName=ghcr.io/jellyfin/jellyfin datasource=docker
   version = "10.10.2";
   image = "ghcr.io/jellyfin/jellyfin:${version}";
-  port = 8096; # int
   cfg = config.mySystem.containers.${app};
 in
 {
@@ -27,37 +27,64 @@ in
 
   # Implementation
   config = mkIf cfg.enable {
-    # Container
-    virtualisation.oci-containers.containers.${app} = {
-      image = "${image}";
-      user = "568:568";
+    # Systemd service for container
+    systemd.services.${app} = {
+      description = "Jellyfin Media Server";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
 
-      volumes = [
-        "/nahar/containers/volumes/jellyfin:/config:rw"
-        "/moria/media:/media:rw"
-        "tmpfs:/cache:rw"
-        "tmpfs:/transcode:rw"
-        "tmpfs:/tmp:rw"
-      ];
+      serviceConfig = {
+        ExecStartPre = "${pkgs.writeShellScript "jellyfin-start-pre" ''
+          set -o errexit
+          set -o nounset
+          set -o pipefail
 
-      environment = {
-        TZ = "America/Chicago";
-        DOTNET_SYSTEM_IO_DISABLEFILELOCKING = "true";
-        JELLYFIN_FFmpeg__probesize = "50000000";
-        JELLYFIN_FFmpeg__analyzeduration = "50000000";
+          podman rm -f ${app} || true
+          rm -f /run/${app}.ctr-id
+        ''}";
+        ExecStart = ''
+          ${pkgs.podman}/bin/podman run \
+            --rm \
+            --name=${app} \
+            --user=568:568 \
+            --device='nvidia.com/gpu=all' \
+            --log-driver=journald \
+            --cidfile=/run/${app}.ctr-id \
+            --cgroups=no-conmon \
+            --sdnotify=conmon \
+            --volume="/nahar/containers/volumes/jellyfin:/config:rw" \
+            --volume="/moria/media:/media:rw" \
+            --volume="tmpfs:/cache:rw" \
+            --volume="tmpfs:/transcode:rw" \
+            --volume="tmpfs:/tmp:rw" \
+            --env=TZ=America/Chicago \
+            --env=DOTNET_SYSTEM_IO_DISABLEFILELOCKING=true \
+            --env=JELLYFIN_FFmpeg__probesize=50000000 \
+            --env=JELLYFIN_FFmpeg__analyzeduration=50000000 \
+            --env=JELLYFIN_PublishedServerUrl=http://10.1.1.61:8096 \
+            -p 8096:8096 \
+            -p 8920:8920 \
+            -p 1900:1900/udp \
+            -p 7359:7359/udp \
+            ${image}
+        '';
+        ExecStop = "${pkgs.podman}/bin/podman stop --ignore --cidfile=/run/${app}.ctr-id";
+        ExecStopPost = "${pkgs.podman}/bin/podman rm --force --ignore --cidfile=/run/${app}.ctr-id";
+        Type = "simple";
+        Restart = "always";
       };
-
-      ports = [ "${toString port}:${toString port}" ]; # expose port
-
-      extraOptions = [
-        # "--device nvidia.com/gpu=all"
-      ];
     };
 
     # Firewall
     networking.firewall = mkIf cfg.openFirewall {
-      allowedTCPPorts = [ port ];
-      allowedUDPPorts = [ port ];
+      allowedTCPPorts = [
+        8096    # HTTP web interface
+        8920    # HTTPS web interface
+      ];
+      allowedUDPPorts = [
+        1900    # DLNA discovery
+        7359    # Jellyfin auto-discovery
+      ];
     };
 
     # TODO add nginx proxy

nixos/modules/nixos/containers/plex/default.nix

@@ -40,13 +40,13 @@ in
       ];
 
       extraOptions = [
-        "--device nvidia.com/gpu=all"
+        # "--device nvidia.com/gpu=all"
       ];
 
       environment = {
         TZ = "America/Chicago";
-        # PLEX_ADVERTISE_URL = "https://${app}.hsn.dev";
-        PLEX_NO_AUTH_NETWORKS = "10.1.1.0/24,10.1.2.0/24";
+        PLEX_ADVERTISE_URL = "https://10.1.1.61:32400";
+        PLEX_NO_AUTH_NETWORKS = "10.1.1.0/24";
       };
 
       ports = [ "${toString port}:${toString port}" ]; # expose port

nixos/modules/nixos/containers/scrypted/default.nix

@@ -1,15 +1,15 @@
 {
   lib,
   config,
+  pkgs,
   ...
 }:
 with lib;
 let
   app = "scrypted";
   # renovate: depName=ghcr.io/koush/scrypted datasource=docker versioning=docker
-  version = "v0.123.36-jammy-nvidia";
+  version = "v0.123.37-jammy-nvidia";
   image = "ghcr.io/koush/scrypted:${version}";
-  port = 11080; # int
   cfg = config.mySystem.containers.${app};
 in
 {
@@ -27,36 +27,57 @@ in
 
   # Implementation
   config = mkIf cfg.enable {
-    # Container
-    virtualisation.oci-containers.containers.${app} = {
-      image = "${image}";
+    # Systemd service for container
+    systemd.services.${app} = {
+      description = "Scrypted Home Security";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
 
-      volumes = [
-        "/nahar/containers/volumes/scrypted:/server/volume:rw"
-        # "/nahar/scrypted:/recordings:rw"
-        "tmpfs:/.cache:rw"
-        "tmpfs:/.npm:rw"
-        "tmpfs:/tmp:rw"
-      ];
+      serviceConfig = {
+        ExecStartPre = "${pkgs.writeShellScript "scrypted-start-pre" ''
+          set -o errexit
+          set -o nounset
+          set -o pipefail
 
-      extraOptions = [
-        # all usb devices, such as coral tpu
-        "--device=/dev/bus/usb"
-        "--network=host"
-        "--device nvidia.com/gpu=all"
-      ];
-
-      environment = {
-        TZ = "America/Chicago";
+          podman rm -f ${app} || true
+          rm -f /run/${app}.ctr-id
+        ''}";
+        ExecStart = ''
+          ${pkgs.podman}/bin/podman run \
+            --rm \
+            --name=${app} \
+            --device=/dev/bus/usb \
+            --device='nvidia.com/gpu=all' \
+            --log-driver=journald \
+            --cidfile=/run/${app}.ctr-id \
+            --cgroups=no-conmon \
+            --sdnotify=conmon \
+            --volume="/nahar/containers/volumes/scrypted:/server/volume:rw" \
+            --volume="tmpfs:/.cache:rw" \
+            --volume="tmpfs:/.npm:rw" \
+            --volume="tmpfs:/tmp:rw" \
+            --env=TZ=America/Chicago \
+            --network=host \
+            ${image}
+        '';
+        ExecStop = "${pkgs.podman}/bin/podman stop --ignore --cidfile=/run/${app}.ctr-id";
+        ExecStopPost = "${pkgs.podman}/bin/podman rm --force --ignore --cidfile=/run/${app}.ctr-id";
+        Type = "simple";
+        Restart = "always";
       };
-
-      ports = [ "${toString port}:${toString port}" ]; # expose port
     };
 
     # Firewall
     networking.firewall = mkIf cfg.openFirewall {
-      allowedTCPPorts = [ port ];
-      allowedUDPPorts = [ port ];
+      allowedTCPPorts = [
+        11080 # Main Scrypted interface
+        10443 # HTTPS interface
+        8554 # RTSP server
+      ];
+      allowedUDPPorts = [
+        10443 # HTTPS interface
+        8554 # RTSP server
+      ];
     };
 
     # TODO add nginx proxy

nixos/modules/nixos/containers/scrypted/systemd/start-pre.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -o errexit
+set -o nounset
+set -o pipefail
+
+podman rm -f scrypted || true
+rm -f /run/scrypted.ctr-id