89 lines
2.3 KiB
Nix
89 lines
2.3 KiB
Nix
{ pkgs, config, lib, python3Packages, ... }:
|
|
|
|
let
|
|
lmsDomain = "lms.cloonar.com";
|
|
networkPrefix = config.networkPrefix;
|
|
in
|
|
{
|
|
security.acme.certs."${lmsDomain}" = {
|
|
group = "nginx";
|
|
};
|
|
|
|
sops.secrets.lms-spotify = { };
|
|
|
|
containers.lms = {
|
|
autoStart = true;
|
|
ephemeral = false;
|
|
privateNetwork = true;
|
|
hostBridge = "server";
|
|
|
|
hostAddress = "${networkPrefix}.97.2";
|
|
localAddress = "${networkPrefix}.97.21/24";
|
|
|
|
extraFlags = [ "--capability=CAP_NET_ADMIN" ];
|
|
|
|
bindMounts = {
|
|
"/var/lib/acme/lms/" = {
|
|
hostPath = config.security.acme.certs.${lmsDomain}.directory;
|
|
isReadOnly = true;
|
|
};
|
|
"/run/secrets/lms-spotify" = {
|
|
hostPath = config.sops.secrets.lms-spotify.path;
|
|
};
|
|
};
|
|
|
|
config = { pkgs, lib, config, ... }:
|
|
let
|
|
in
|
|
{
|
|
networking = {
|
|
hostName = "lms";
|
|
useHostResolvConf = false;
|
|
defaultGateway = {
|
|
address = "${networkPrefix}.97.1";
|
|
interface = "eth0";
|
|
};
|
|
nameservers = [ "${networkPrefix}.97.1" ];
|
|
firewall.enable = false;
|
|
};
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
slimserver # Logitech/Lyrion Media Server
|
|
];
|
|
|
|
services.slimserver = {
|
|
enable = true;
|
|
package = pkgs.slimserver;
|
|
};
|
|
|
|
# make LMS discoverable via mDNS/Avahi
|
|
services.avahi = {
|
|
enable = true;
|
|
publish.enable = true;
|
|
publish.userServices = true;
|
|
};
|
|
|
|
services.nginx.enable = true;
|
|
services.nginx.virtualHosts."${lmsDomain}" = {
|
|
sslCertificate = "/var/lib/acme/lms/fullchain.pem";
|
|
sslCertificateKey = "/var/lib/acme/lms/key.pem";
|
|
sslTrustedCertificate = "/var/lib/acme/lms/chain.pem";
|
|
forceSSL = true;
|
|
extraConfig = "proxy_buffering off;";
|
|
|
|
locations."/".extraConfig = ''
|
|
proxy_pass http://127.0.0.1:9000/;
|
|
proxy_set_header Host $host;
|
|
proxy_redirect http:// https://;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
'';
|
|
};
|
|
|
|
system.stateVersion = "23.05";
|
|
};
|
|
};
|
|
}
|