Serverraum-mit-Matratze/infra
2
0
Fork 0
Code Issues 3 Pull requests Projects 1 Releases Packages Wiki Activity Actions

Configured SMB Shares
All checks were successful
/ Check Nix Flake (push) Successful in 1m48s
Details

Browse source
This commit is contained in:
Kaybee 2025-06-10 19:55:05 +02:00
parent 67087d724e
commit 46e563dde1
Signed by: kb01
SSH key fingerprint: SHA256:kv2GYUy1MZEqusYnS+Y9nMgrpv77jhm+3kknl3UGV1k
5 changed files with 88 additions and 98 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
modules/nixos/services/traefik-proxy/default.nix
View file

@ -32,7 +32,6 @@ in
websecure = {
address = ":443";
asDefault = true;
http.tls.certResolver = "letsencrypt";
};
};
};
@ -42,7 +41,6 @@ in
# Configure Letsencrypt
services.traefik.staticConfigOptions = {
certificatesResolvers.letsencrypt.acme = {
email = "kb01@kb-one.de";
tlsChallenge = {};
storage = "/var/secrets/traefik/acme.json";
};

94
modules/nixos/suites/nas/default.nix
View file

@ -10,10 +10,12 @@ let
cfg = config.suites.nas;
in
{
imports = [
./jellyfin.nix
./kavita.nix
];
# imports = [
# ];
###########
# Options #
###########
options.suites.nas.enable = lib.mkOption {
type = with lib.types; uniq bool;
default = false;
@ -31,18 +33,22 @@ in
};
options.suites.nas.media.folder = lib.mkOption {
type = with lib.types; str;
default = "/home/media/media";
default = "/home/media";
description = "Media Root Directory";
};
options.suites.nas.media.servers.enable = lib.mkOption {
type = with lib.types; uniq bool;
default = true;
description = "Enable Preconfigured Media Servers";
};
# Media Config
config = lib.mkIf (cfg.enable && cfg.media.enable) {
# Media Defaults
suites.nas.media.jellyfin.enable = true;
suites.nas.media.kavita.enable = false;
# NAS Config
config = lib.mkIf (cfg.enable) {
# Create Media User
#########
# Users #
#########
users.groups.media = {};
users.users.media = {
isSystemUser = true;
@ -52,8 +58,70 @@ in
home = "/home/media";
};
##################
# Network Drives #
##################
services.samba = {
enable = true;
openFirewall = true;
settings = {
global = {
# Discorvery
"workgroup" = "WORKGROUP";
"netbios name" = "mow0m";
"netbios aliases" = "";
"server string" = "mow0m Server";
# Guest Access
#"restrict anonymous" = "0"; # Default 0
"guest account" = "nobody";
"map to guest" = "Bad User";
# Security
"local master" = "True";
"create mask" = "0664";
"directory mask" = "0775";
#"ntlm auth" = "False";
security = "user";
"invalid users" = [ "root" ];
"passwd program" = "/run/wrappers/bin/passwd %u";
# Networking
"winbind request timeout" = "2";
};
media = {
comment = "Public Media Share";
browsable = "yes";
"guest ok" = "yes"; # same as public = true
"writable" = "yes";
path = "/laowu/media";
"create mask" = "0644";
"directory mask" = "0755";
"force user" = "media";
"force group" = "media";
};
};
};
services.samba-wsdd = { # Web Service Discorvery Daemon
enable = true;
openFirewall = true;
};
networking.firewall.allowPing = true;
#################
# Media Servers #
#################
# Jellyfin
services.jellyfin.enable = cfg.media.servers.enable;
services.jellyfin.user = "media";
services.traefik.dynamicConfigOptions = {
http.services.jellyfin.loadBalancer.servers = [ { url = "http://localhost:8096/"; } ];
http.routers.jellyfin.entrypoints = "websecure";
http.routers.jellyfin.tls = true;
#http.routers.jellyfin.tls.certresolver = "letsencrypt";
http.routers.jellyfin.rule = "Host(`jellyfin.${config.suites.nas.domain}`)";
http.routers.jellyfin.service = "jellyfin";
};
};
}

41
modules/nixos/suites/nas/jellyfin.nix
View file

@ -1,41 +0,0 @@
{
inputs,
config,
lib,
pkgs,
system,
...
}:
let
cfg = config.suites.nas.media.jellyfin;
in
{
options.suites.nas.media.jellyfin.enable = lib.mkOption {
type = with lib.types; uniq bool;
default = false;
description = "Enable Preconfigured Jellyfin Config";
};
options.suites.nas.media.jellyfin.subdomain = lib.mkOption {
type = with lib.types; string;
default = "watch";
description = "Subdomain for Jellyfin Server";
};
config = lib.mkIf (cfg.enable) {
services.jellyfin.enable = true;
services.jellyfin.user = "media";
# Configure Reverse-Proxy
services.traefik.dynamicConfigOptions = {
http.services.jellyfin.loadBalancer.servers = [ { url = "http://localhost:8096/"; } ];
http.routers.jellyfin.entrypoints = "websecure";
http.routers.jellyfin.tls = true;
#http.routers.jellyfin.tls.certresolver = "letsencrypt";
http.routers.jellyfin.rule = "Host(`${cfg.subdomain}.${config.suites.nas.domain}`)";
http.routers.jellyfin.service = "jellyfin";
};
};
}

42
modules/nixos/suites/nas/kavita.nix
View file

@ -1,42 +0,0 @@
{
inputs,
config,
lib,
pkgs,
system,
...
}:
let
cfg = config.suites.nas.media.kavita;
in
{
options.suites.nas.media.kavita.enable = lib.mkOption {
type = with lib.types; uniq bool;
default = false;
description = "Enable Preconfigured kavita Config";
};
options.suites.nas.media.kavita.subdomain = lib.mkOption {
type = with lib.types; string;
default = "read";
description = "Kavita Subdomain";
};
config = lib.mkIf (cfg.enable) {
services.kavita.enable = true;
services.kavita.user = "media";
services.kavita.tokenKeyFile = "/home/media/secrets/kavita-secret";
# Configure Reverse-Proxy
services.traefik.dynamicConfigOptions = {
http.services.kavita.loadBalancer.servers = [ { url = "http://localhost:5000/"; } ];
http.routers.kavita.entrypoints = "websecure";
http.routers.kavita.tls = true;
#http.routers.kavita.tls.certresolver = "letsencrypt";
http.routers.kavita.rule = "Host(`${cfg.subdomain}.${config.suites.nas.domain}`)";
http.routers.kavita.service = "kavita";
};
};
}

7
systems/x86_64-linux/mow0m/default.nix
View file

@ -73,6 +73,13 @@
services.asterisk-phony.enable = true;
# Enable NAS Suite
suites.nas.enable = true;
suites.nas.domain = "mow0m.lan";
suites.nas.media.enable = true;
suites.nas.media.folder = "/laowu/media";
suites.nas.media.servers.enable = false;
# Firewall
# networking.firewall.allowedTCPPorts = [ ... ];
# networking.firewall.allowedUDPPorts = [ ... ];