flake.lock

@@ -223,16 +223,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1726989464,
-        "narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
+        "lastModified": 1731880681,
+        "narHash": "sha256-FmYTkIyPBUxSWgA7DPIVTsCCMvSSbs56yOtHpLNSnKg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
+        "rev": "aecd341dfead1c3ef7a3c15468ecd71e8343b7c6",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-24.05",
+        "ref": "release-24.11",
         "repo": "home-manager",
         "type": "github"
       }
@@ -456,16 +456,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1731797254,
-        "narHash": "sha256-df3dJApLPhd11AlueuoN0Q4fHo/hagP75LlM5K1sz9g=",
+        "lastModified": 1731755305,
+        "narHash": "sha256-v5P3dk5JdiT+4x69ZaB18B8+Rcu3TIOrcdG4uEX7WZ8=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "e8c38b73aeb218e27163376a2d617e61a2ad9b59",
+        "rev": "057f63b6dc1a2c67301286152eb5af20747a9cb4",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-24.05",
+        "ref": "nixos-24.11",
         "repo": "nixpkgs",
         "type": "github"
       }

nixos/modules/nixos/containers/jellyfin/default.nix

@@ -1,7 +1,6 @@
 {
   lib,
   config,
-  pkgs,
   ...
 }:
 with lib;
@@ -10,6 +9,7 @@ let
   # renovate: depName=ghcr.io/jellyfin/jellyfin datasource=docker
   version = "10.10.2";
   image = "ghcr.io/jellyfin/jellyfin:${version}";
+  port = 8096; # int
   cfg = config.mySystem.containers.${app};
 in
 {
@@ -27,64 +27,37 @@ in
 
   # Implementation
   config = mkIf cfg.enable {
-    # Systemd service for container
-    systemd.services.${app} = {
-      description = "Jellyfin Media Server";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
+    # Container
+    virtualisation.oci-containers.containers.${app} = {
+      image = "${image}";
+      user = "568:568";
 
-      serviceConfig = {
-        ExecStartPre = "${pkgs.writeShellScript "jellyfin-start-pre" ''
-          set -o errexit
-          set -o nounset
-          set -o pipefail
+      volumes = [
+        "/nahar/containers/volumes/jellyfin:/config:rw"
+        "/moria/media:/media:rw"
+        "tmpfs:/cache:rw"
+        "tmpfs:/transcode:rw"
+        "tmpfs:/tmp:rw"
+      ];
 
-          podman rm -f ${app} || true
-          rm -f /run/${app}.ctr-id
-        ''}";
-        ExecStart = ''
-          ${pkgs.podman}/bin/podman run \
-            --rm \
-            --name=${app} \
-            --user=568:568 \
-            --device='nvidia.com/gpu=all' \
-            --log-driver=journald \
-            --cidfile=/run/${app}.ctr-id \
-            --cgroups=no-conmon \
-            --sdnotify=conmon \
-            --volume="/nahar/containers/volumes/jellyfin:/config:rw" \
-            --volume="/moria/media:/media:rw" \
-            --volume="tmpfs:/cache:rw" \
-            --volume="tmpfs:/transcode:rw" \
-            --volume="tmpfs:/tmp:rw" \
-            --env=TZ=America/Chicago \
-            --env=DOTNET_SYSTEM_IO_DISABLEFILELOCKING=true \
-            --env=JELLYFIN_FFmpeg__probesize=50000000 \
-            --env=JELLYFIN_FFmpeg__analyzeduration=50000000 \
-            --env=JELLYFIN_PublishedServerUrl=http://10.1.1.61:8096 \
-            -p 8096:8096 \
-            -p 8920:8920 \
-            -p 1900:1900/udp \
-            -p 7359:7359/udp \
-            ${image}
-        '';
-        ExecStop = "${pkgs.podman}/bin/podman stop --ignore --cidfile=/run/${app}.ctr-id";
-        ExecStopPost = "${pkgs.podman}/bin/podman rm --force --ignore --cidfile=/run/${app}.ctr-id";
-        Type = "simple";
-        Restart = "always";
+      environment = {
+        TZ = "America/Chicago";
+        DOTNET_SYSTEM_IO_DISABLEFILELOCKING = "true";
+        JELLYFIN_FFmpeg__probesize = "50000000";
+        JELLYFIN_FFmpeg__analyzeduration = "50000000";
       };
+
+      ports = [ "${toString port}:${toString port}" ]; # expose port
+
+      extraOptions = [
+        # "--device nvidia.com/gpu=all"
+      ];
     };
 
     # Firewall
     networking.firewall = mkIf cfg.openFirewall {
-      allowedTCPPorts = [
-        8096    # HTTP web interface
-        8920    # HTTPS web interface
-      ];
-      allowedUDPPorts = [
-        1900    # DLNA discovery
-        7359    # Jellyfin auto-discovery
-      ];
+      allowedTCPPorts = [ port ];
+      allowedUDPPorts = [ port ];
     };
 
     # TODO add nginx proxy

nixos/modules/nixos/containers/plex/default.nix

@@ -40,7 +40,7 @@ in
       ];
 
       extraOptions = [
-        # "--device nvidia.com/gpu=all"
+        "--device nvidia.com/gpu=all"
       ];
 
       environment = {

nixos/modules/nixos/containers/scrypted/default.nix

@@ -1,7 +1,6 @@
 {
   lib,
   config,
-  pkgs,
   ...
 }:
 with lib;
@@ -10,6 +9,7 @@ let
   # renovate: depName=ghcr.io/koush/scrypted datasource=docker versioning=docker
   version = "v0.123.30-jammy-nvidia";
   image = "ghcr.io/koush/scrypted:${version}";
+  port = 11080; # int
   cfg = config.mySystem.containers.${app};
 in
 {
@@ -27,57 +27,36 @@ in
 
   # Implementation
   config = mkIf cfg.enable {
-    # Systemd service for container
-    systemd.services.${app} = {
-      description = "Scrypted Home Security";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
+    # Container
+    virtualisation.oci-containers.containers.${app} = {
+      image = "${image}";
 
-      serviceConfig = {
-        ExecStartPre = "${pkgs.writeShellScript "scrypted-start-pre" ''
-          set -o errexit
-          set -o nounset
-          set -o pipefail
+      volumes = [
+        "/nahar/containers/volumes/scrypted:/server/volume:rw"
+        # "/nahar/scrypted:/recordings:rw"
+        "tmpfs:/.cache:rw"
+        "tmpfs:/.npm:rw"
+        "tmpfs:/tmp:rw"
+      ];
 
-          podman rm -f ${app} || true
-          rm -f /run/${app}.ctr-id
-        ''}";
-        ExecStart = ''
-          ${pkgs.podman}/bin/podman run \
-            --rm \
-            --name=${app} \
-            --device=/dev/bus/usb \
-            --device='nvidia.com/gpu=all' \
-            --log-driver=journald \
-            --cidfile=/run/${app}.ctr-id \
-            --cgroups=no-conmon \
-            --sdnotify=conmon \
-            --volume="/nahar/containers/volumes/scrypted:/server/volume:rw" \
-            --volume="tmpfs:/.cache:rw" \
-            --volume="tmpfs:/.npm:rw" \
-            --volume="tmpfs:/tmp:rw" \
-            --env=TZ=America/Chicago \
-            --network=host \
-            ${image}
-        '';
-        ExecStop = "${pkgs.podman}/bin/podman stop --ignore --cidfile=/run/${app}.ctr-id";
-        ExecStopPost = "${pkgs.podman}/bin/podman rm --force --ignore --cidfile=/run/${app}.ctr-id";
-        Type = "simple";
-        Restart = "always";
+      extraOptions = [
+        # all usb devices, such as coral tpu
+        "--device=/dev/bus/usb"
+        "--network=host"
+        "--device nvidia.com/gpu=all"
+      ];
+
+      environment = {
+        TZ = "America/Chicago";
       };
+
+      ports = [ "${toString port}:${toString port}" ]; # expose port
     };
 
     # Firewall
     networking.firewall = mkIf cfg.openFirewall {
-      allowedTCPPorts = [
-        11080 # Main Scrypted interface
-        10443 # HTTPS interface
-        8554 # RTSP server
-      ];
-      allowedUDPPorts = [
-        10443 # HTTPS interface
-        8554 # RTSP server
-      ];
+      allowedTCPPorts = [ port ];
+      allowedUDPPorts = [ port ];
     };
 
     # TODO add nginx proxy

nixos/modules/nixos/containers/scrypted/systemd/start-pre.sh

@@ -1,7 +0,0 @@
-#!/usr/bin/env bash
-set -o errexit
-set -o nounset
-set -o pipefail
-
-podman rm -f scrypted || true
-rm -f /run/scrypted.ctr-id