navidrome + soulbeet start · thundertheidiot.bsky.social/nixdots@faeefa5

+2

certs/default.nix

··· 30 30 "bazarr.home" 31 31 "immich.home" 32 32 "homeassistant.home" 33 + "navidrome.home" 34 + "soulbeet.home" 33 35 ]; 34 36 35 37 "local.crt" = ./local.crt;

+24 -24

certs/local.crt

··· 1 1 -----BEGIN CERTIFICATE----- 2 - MIIE5zCCAs+gAwIBAgIUN48KUa99xHaCkNLvj9XDkiIOfK4wDQYJKoZIhvcNAQEL 3 - BQAwFzEVMBMGA1UEAwwMTG9jYWwgRGV2IENBMB4XDTI1MTAxNTA4NTcwN1oXDTI4 4 - MDExODA4NTcwN1owETEPMA0GA1UEAwwGKi5ob21lMIIBIjANBgkqhkiG9w0BAQEF 5 - AAOCAQ8AMIIBCgKCAQEApnsgTHuthoTwCmsblxKJfLMSjIxv/m8Ka6aV56IJZRms 6 - phaoHy1m5UcmwZPxHgUfBf0z+3HmOvAyCbPmEJ80jRrY5KPQehI4QakqP8M36Ikx 7 - I2mw5NpFW+R3Wqjb3MPN8O7LP2RNouNc6jX2kJIR7NWnbCXNpmJCaHXccfXmY+ec 8 - IRGJvbMPh74SfL+9KFqiUBOzwtNgzpmwXQCb8gEj2LdTNJJy87uJlwPFpva44SEi 9 - b/NHycmwmCb6gMll0OkK79U0/guyrOl2zNDYwuHbHzSrmKxNH6F0edF3aGZ6HB94 10 - Cf4SqLTTR2t22CW8oU1UvgpIwlxuiTe3M++cdsy4LQIDAQABo4IBLzCCASswHwYD 11 - VR0jBBgwFoAUD3D9Gy99l9qiiKRWLZYAIR8RMWYwCQYDVR0TBAIwADCB3QYDVR0R 12 - BIHVMIHSgglhdXRoLmhvbWWCCG44bi5ob21lgghnaXQuaG9tZYINamVsbHlmaW4u 2 + MIIFBjCCAu6gAwIBAgIUBHzveSJdDVEhZOX45ynmAW98vAEwDQYJKoZIhvcNAQEL 3 + BQAwFzEVMBMGA1UEAwwMTG9jYWwgRGV2IENBMB4XDTI2MDQwNjIxMTkyOFoXDTI4 4 + MDcwOTIxMTkyOFowETEPMA0GA1UEAwwGKi5ob21lMIIBIjANBgkqhkiG9w0BAQEF 5 + AAOCAQ8AMIIBCgKCAQEAn6E9eccbEhWcHGbAbf+BZ0h61TEZgxvw+xg0opKCA9zY 6 + ry0lTEuZdEdmwFMismYrgDW8NScnq1w9mh1cZSar8Gcs38a7ki0T4f44jNDjVB/7 7 + FW9cmP/3T7tiRPQu1jCuMGuKrgK84kSr/mk04qfz7bZXU3pYWJiKMxXrR5AoN6p2 8 + 4P0eO8Xj2IkYHelwtpRl+wSgOilGXuInec/p9pCHbY54oTLPI4TpIrPW3oh76Mi+ 9 + DCZxiHYYaEvHe0xaFDiIUQ+qodP2Tw9mMVdQ4WNyB7nCQR2Jed1bTQFsnFKleff9 10 + NNyq1e3gd+fvSGjZbLAXQ70TRtOd6tfU5R2SzSYhmQIDAQABo4IBTjCCAUowHwYD 11 + VR0jBBgwFoAU7V8luXigmtJNBwWAsZg4NRCZS6QwCQYDVR0TBAIwADCB/AYDVR0R 12 + BIH0MIHxgglhdXRoLmhvbWWCCG44bi5ob21lgghnaXQuaG9tZYINamVsbHlmaW4u 13 13 aG9tZYILcmVkZGl0LmhvbWWCDGZpcmVmb3guaG9tZYIMdG9ycmVudC5ob21lggty 14 14 YWRhcnIuaG9tZYILc29uYXJyLmhvbWWCDXNvdWxzZWVrLmhvbWWCDXByb3dsYXJy 15 15 LmhvbWWCC2xpZGFyci5ob21lggtiYXphcnIuaG9tZYILaW1taWNoLmhvbWWCEmhv 16 - bWVhc3Npc3RhbnQuaG9tZYIGKi5ob21lMB0GA1UdDgQWBBR8A5UsEYTRPZ+ObaAg 17 - kBs6GQfpkzANBgkqhkiG9w0BAQsFAAOCAgEAjqDFQSQlm6xJLldST5aJ8fFbGwF+ 18 - iE0sI81g4cWVKKOEXotQtxYtd6fzcAZX5sJYnvsLdxUWA9atl14IYa5yNAT1wLer 19 - bwTHqUDztl1IktjcXu9B6OiZ+kp9L/SXMVkyVLwP9JMUxOB4oETopQi3LV56EWbq 20 - 9kqKUFDBXLjichziYnKiBvE8OEKd90ZpU9I5jLyFFs9vl20RaTlGJQGLsgIMwdeF 21 - ruQ1/RoeNMooPbeSzG2oYglgLTuLD5+wk2amrbtOlGPi4w0HzW861HZ5C35heByq 22 - 55D2pPozZEMb2yzf+kawur+XJwqjp7HKlBlKE953fb/t9EVn1Be4aIxr0+G+8kxx 23 - dFkdkbT30/d51P90+0Xl8KTgEtJsrJYvqo2jmlnnhi0Fbu+zMsamx3ROS4HW7OA5 24 - u0U4Dm8J79ksonqiTjuh7aBCyU2t6Nepuia71HjB2X0yCYI0LP2A+IYQuqCeKFya 25 - yJUzFY7wSt/2ntNaxOwvkfChYYNw1rZQznL25BPvtmZ4auwFjMLJO03/wxOk6o8T 26 - HFG+rOX8slm8P10adpllQLvXclI3vkW4ZlkHKhWR8LeGNAfFc39C3SOR6FP2xsZT 27 - SM4ROFb4FLHyezKiVyp6V9JR41Bvbq2jwAokFA6S4mlfLglZeUveaSc+rYIEiU6l 28 - YhVEJgDFPUvscZY= 16 + bWVhc3Npc3RhbnQuaG9tZYIObmF2aWRyb21lLmhvbWWCDXNvdWxiZWV0LmhvbWWC 17 + BiouaG9tZTAdBgNVHQ4EFgQUtxp+56/I0AsMMTj9sQjmXoDZQoEwDQYJKoZIhvcN 18 + AQELBQADggIBAEQi3GNFs0sn3f+rgms15BXTseMkUFhHE4EjQ9hZKqJntf8vQCcK 19 + nob8mHnhWI4YXVphksAKili8tNWbWAF9Elk0+SVuQmIH/N3Epsf1duHorX3oi5IB 20 + 1P9CxC69ukdt1XhNPfe40tftocPnshoSpaxEglQP7okzQQJHYN1mVWzhj7vsfFwm 21 + UpKwv+6Kq1nwqlNmYUFxQBBSLnLdhXNzTfippMj6w8U3lXvMfXueJyetp7YUQXP6 22 + tGILixSxJWaScpIltDKQTe0b2fk+1q81SosE2edM9cVM4RQe6CTDdc3j5GVJlgL9 23 + jp3BKWAy2pIO/cH9aunc8Q5JJ5yxH+WaH4RADcP7PN+eqtoXMy+3P+nvODAy0F74 24 + 87UUcOAT8QVlQk7x9wwE3RwEFf4UwOv3p449l3Ylrr6eac6dkeuY1b6SHlBFNk8u 25 + FWEiu24kJRul/crf20LYLbxKYzMXKBjItlMWnJQsVAd8gNARIp6tGDpThq2rRHYC 26 + nQi9Z5BqNrCI9mLCClxFkUjQL4OrxZEOi/8Ck/RCWCMWu1Cow34vrdN8taV0R40D 27 + QSAU95qnDUG+NmQ1Eg19LQSSkyuSXdlbp2Za3bygQpHDCLGY7J2PreSYHiObVMPT 28 + 3wtA3VfcVPcs3/yegp7rKznJ3eTBY1aYWyPZ9DPZJZf/yZo1DzIz3/ou 29 29 -----END CERTIFICATE-----

+28 -28

certs/rootCA.pem

··· 1 1 -----BEGIN CERTIFICATE----- 2 - MIIFDzCCAvegAwIBAgIUKg8zHjNkh8Zs+w2Z+hhVroL+zL0wDQYJKoZIhvcNAQEL 3 - BQAwFzEVMBMGA1UEAwwMTG9jYWwgRGV2IENBMB4XDTI1MTAxNTA4NTcwN1oXDTMw 4 - MTAxNDA4NTcwN1owFzEVMBMGA1UEAwwMTG9jYWwgRGV2IENBMIICIjANBgkqhkiG 5 - 9w0BAQEFAAOCAg8AMIICCgKCAgEAx5ak6sc4uayqWomvJNxAEt2C4sDhh+lDGeli 6 - HYzLFUnGReyvH++9+nPkFzkI+gBI6XrDyJn45I6wERTeGtlBLtSpoK0kPwx+fedI 7 - kPDnnQ6qwsH4ZE1E8AQy9YB7aQ5PZbjyJBDUj75rxUGmXdgm8U88NrnZLdjQMINr 8 - +WB0iKDSqvhjRrT7K8ZcooZL+Mue+Rlh+YagDUDgsOrIkukOBpl15Jx4Ms+zNAon 9 - coND1ekL+eVIMRz1bvDBFITVywsgqQf0juJLcVBVJPkmxM0IfFXWIZ7joaK5MRab 10 - Bk2qR4/m2hcu2MEKXmLWYYvXncBk84FnZtTrYqUz+dNwm/0W2TaTwiDbUhi+dqoG 11 - kRML8FekY2j74pEMOvAJBbO3m4GmpLLkopbPFQFTTaohBOqEFQYGWLv/4Vkefz69 12 - c3nVcT+jAU+MlQ6M4n+FHHMeN3fuL3MujzLPZ/rynW+pB/cGpat6Vk8F0xnEWpZT 13 - QwnC0pgdJL2GfKVuthwYmEfGLg3ex4UD87551MquRoyWAb50YPq15S5m6JdUm98f 14 - jarqc3BKgodWCG2wh+VF7AQlgAyowd/54SsTtQuN8eCd9wSQa1xBCR9fQCK1HS3Q 15 - c+CcUEevosugWHnb6W9AZCLsITEqdWemGAvH5CbuGH0hx4YvGKR03a/ytxeHlYd2 16 - vzl7zw8CAwEAAaNTMFEwHQYDVR0OBBYEFA9w/RsvfZfaooikVi2WACEfETFmMB8G 17 - A1UdIwQYMBaAFA9w/RsvfZfaooikVi2WACEfETFmMA8GA1UdEwEB/wQFMAMBAf8w 18 - DQYJKoZIhvcNAQELBQADggIBAIh4cLGDFo8MMCgb24118soL72CS9EqYD2juKAIC 19 - 0OxHrj3Q35oLBW7t1HZhmPo1+TFJM4gzi4BIetc3FzfnSms9eNMI+apB6x9JIcR9 20 - TuY5H2ZeJsp9NNRKTq27W8/fpQ5yYQNuj1RHNsma37trTgm5DKqkefMXT1Pd4Kjy 21 - QleGQlTtg89LGiqo0M6iZTXswKyR9YLVsntzNnJbsmenJBHOyz/rkBRpa6vmwKel 22 - p10aNlQq6ssFBcJioO5W7HTSIH4JYNoPbV0foebBfeBjx89l+GftMk/3Kzdej6i8 23 - Ix0IGkUuU0/Ha6S2Qf/ECRbrtY7e+uNy1YYPGDqLQvx7iuKEuVPr6wM3T6MgTJkv 24 - dqU8bE6UanbJst6+jVoeb3M3a/lpx6n9rYvQ4T0WCaR2ETV47/xrlK9MD03zQ+2q 25 - TS8CgDZCCR7iqvkuZfib7JpW0CdPCwh78fHSbtfImiUqzXKoXiV2Ck60ShHyHnYX 26 - AYELkuc9t8OwvwVAj5WMcFcLqWrJR56+fe3FQ2jpHrECCd1oN1mtJwWFwzsCElou 27 - btKN9xeYdeSvtJMt3vx+l8XiiqMW/w/TeTYvTADq1+WHxL6FdbDNd+g8VuTX5Ybe 28 - NDCMLdrrXbeRpqLkEzPKh9bq8/NKSNKMFUKilqDKOVRUCLxYHNmzVaNSLnYVZ6Fn 29 - 2Ckt 2 + MIIFDzCCAvegAwIBAgIUJmDm6BndejBk+oowjE+OuMnEilAwDQYJKoZIhvcNAQEL 3 + BQAwFzEVMBMGA1UEAwwMTG9jYWwgRGV2IENBMB4XDTI2MDQwNjIxMTkyOFoXDTMx 4 + MDQwNTIxMTkyOFowFzEVMBMGA1UEAwwMTG9jYWwgRGV2IENBMIICIjANBgkqhkiG 5 + 9w0BAQEFAAOCAg8AMIICCgKCAgEArotJJKLPNf1O3RqUwium0P7Z2ou8XDSqO4zc 6 + O/qccdfCUsmx/mzPbj4n8ZkD+tFnZ31kkNmnVX2Hy/UaLPMd0S1RMPIJBGc/VMHq 7 + yTCYAEkET/X79ckDwlyRImrvDTtWXpMtFIEY/a6iO3QcM4ZOL4Wq+7sCtAMwKwl1 8 + cjtwpOUXeLuZj97i2utD6zDYC3j0+pcD4fcxFRcsJbheu1p8cuaV4zzegRpdhMDa 9 + iumxPwdmm8ysspNklsmII5twZgdG7fvYUkfzc4TO/WdrmbTA2Wrj3P/dOox0NPO5 10 + sBGGKJ33cr6MV7SDYNas/FxQIOrv+72qHlj1roHpU06xJtndwMTCUswtafbKQFMm 11 + 8vwZvVHjeMqdoZHwrg5651rTY8/aXSuAdkpIQLKRLY2PqNfhbDeYd+zKM5wAcguv 12 + xjOJEGe5xRaDzU7ztlHCu166Xt8PYZW9QJlzeA5hl4cE9ItoWrB53POJiRw5q96r 13 + e+3oPJpPL3V3tSgUpa1lOmCt5R/4g4lfad1ygxp/Ftu53uM1j69JYFVJbGZBYREd 14 + FNPG7ER3iWQS7iRr1UrDHBFIBpSa27AJjOuF7EvAPlGNn3wRb6KXHD5kdCbuzdRA 15 + D4JXpqEclxxcXpmkLrM8IJ3d/KIe1btKC+nQcyqEKZRFlYpuW0VCWihFxG2ENbkR 16 + eyf/y8UCAwEAAaNTMFEwHQYDVR0OBBYEFO1fJbl4oJrSTQcFgLGYODUQmUukMB8G 17 + A1UdIwQYMBaAFO1fJbl4oJrSTQcFgLGYODUQmUukMA8GA1UdEwEB/wQFMAMBAf8w 18 + DQYJKoZIhvcNAQELBQADggIBAFfRtunJP2zWvq/6AQSFsT3ga2DN56xv2zCNI2nO 19 + 0pYnbYSzak6PUdMYZ8j7Lvm1QWgqt3iWxOH3Eu3QThSLArGaFFqKKdCqHnz6SpCY 20 + da1pZS2CtBfXg/hRn6vrJLRokkCGY4n7rs6GJqDmeQeoGCXXbTOU7YEpEKy7GZE7 21 + vtkHqb4MuWZc8efgwS+aTs9F7sIj8R29dOnGjRG5/h0VHVuB1u01OKTi1+c3ETFI 22 + YgHBrraQa9Qsb6px79G6QAgOMoaPAFHgLAavyPpu9JbwfS7VLWlAeYPYu58MShlJ 23 + rlj+jqW5xk4uuuGh2B8CImv7XzenRN7DKu7H2My/VpB5MCdSh8Km/6bgoU+CnZW9 24 + UrcAAPECeFhbog3gJX1qgR9hEQvsMPxdApXtbYELuhi1seeEb4V1BzNYVWgDWn9q 25 + csdocEbhp97p+/HuWhU8n8xAA0HpdIGCVyu9xs660LQZLpY8Xbx/oSFIF4pI+I18 26 + sEK5969r09swTHuxuiuWUcF5jVq2MDEd+30YWdx0lWa0JuVeACcbsU/Mw7QJndx2 27 + 2QE9TZDhxsJ2Gcyp7Fn0n9YUNaj1WR68qZDwJTv1no4QtBgisXCT7RUqFSM5AO6E 28 + 9IBkr8MOGn3SpO4BKxgkyTyO1xiEXsjC096zpZt8xA1GjBy2sOVk1NallIk03/eN 29 + xNzZ 30 30 -----END CERTIFICATE-----

+1

hosts/server2/default.nix

··· 23 23 ./home-assistant 24 24 ./homepage.nix 25 25 ./jellyfin.nix 26 + ./navidrome.nix 26 27 ./redlib.nix 27 28 ./secrets 28 29 ./urlwatch.nix

+77

hosts/server2/navidrome.nix

··· 1 + {config, ...}: let 2 + certs = import ../../certs; 3 + in { 4 + server.domains = [ 5 + "navidrome.home" 6 + "soulbeet.home" 7 + ]; 8 + 9 + services.nginx.virtualHosts."navidrome.home" = { 10 + forceSSL = true; 11 + sslCertificate = certs."local.crt"; 12 + sslCertificateKey = config.sops.secrets.localKey.path; 13 + locations = { 14 + "/" = { 15 + proxyPass = "http://127.0.0.1:${toString config.services.navidrome.settings.Port}"; 16 + recommendedProxySettings = true; 17 + extraConfig = '' 18 + proxy_set_header Upgrade $http_upgrade; 19 + proxy_set_header Connection "Upgrade"; 20 + ''; 21 + }; 22 + }; 23 + }; 24 + 25 + sops.secrets.navidrome_env = { 26 + owner = config.services.navidrome.user; 27 + }; 28 + 29 + systemd.services.navidrome.serviceConfig.BindReadOnlyPaths = ["/mnt/storage/media"]; 30 + 31 + services.navidrome = { 32 + enable = true; 33 + openFirewall = true; 34 + environmentFile = config.sops.secrets.navidrome_env.path; 35 + settings = { 36 + Address = "0.0.0.0"; 37 + MusicFolder = "/mnt/storage/media/music"; 38 + DataFolder = "${config.meow.impermanence.persist}/navidrome"; 39 + }; 40 + }; 41 + 42 + services.nginx.virtualHosts."soulbeet.home" = { 43 + forceSSL = true; 44 + sslCertificate = certs."local.crt"; 45 + sslCertificateKey = config.sops.secrets.localKey.path; 46 + locations = { 47 + "/" = { 48 + proxyPass = "http://127.0.0.1:9765"; 49 + recommendedProxySettings = true; 50 + extraConfig = '' 51 + proxy_set_header Upgrade $http_upgrade; 52 + proxy_set_header Connection "Upgrade"; 53 + ''; 54 + }; 55 + }; 56 + }; 57 + 58 + virtualisation.oci-containers.containers.soulbeet = { 59 + image = "docker.io/docccccc/soulbeet:latest"; 60 + ports = [ 61 + "9765:9765" 62 + ]; 63 + environment = { 64 + "DATABASE_URL" = "sqlite:/data/soulbeet.db"; 65 + "DOWNLOAD_PATH" = "/downloads"; 66 + "NAVIDROME_URL" = "http://host.docker.internal:${toString config.services.navidrome.settings.Port}"; 67 + }; 68 + environmentFiles = [config.sops.secrets.soulbeet_env.path]; 69 + volumes = [ 70 + "/mnt/storage/media:/mnt/storage/media:rw" 71 + "/nix/persist/soulbeet:/data" 72 + "/mnt/storage/media/downloads/soulseek:/downloads" 73 + ]; 74 + 75 + extraOptions = ["--add-host=host.docker.internal:host-gateway" "--network=server2_default"]; 76 + }; 77 + }

+10

hosts/server2/secrets/default.nix

··· 11 11 format = "dotenv"; 12 12 }; 13 13 14 + navidrome_env = { 15 + sopsFile = ./navidrome.env; 16 + format = "dotenv"; 17 + }; 18 + 19 + soulbeet_env = { 20 + sopsFile = ./soulbeet.env; 21 + format = "dotenv"; 22 + }; 23 + 14 24 home_assistant_secrets = { 15 25 sopsFile = ./home-assistant.yaml; 16 26 format = "yaml";

+1 -1

hosts/uwu/docker/generated.nix

··· 423 423 volumes = [ 424 424 "/mnt/storage/media:/media:rw" 425 425 "/mnt/storage/media/downloads/soulseek:/app/downloads:rw" 426 - "/mnt/storage/media/downloads/soulseek/incomplete:/app/incomplete:rw" 426 + "/mnt/storage/media/downloads/soulseek_incomplete:/app/incomplete:rw" 427 427 "/mnt/storage/torrent_stack/config/slskd:/app:rw" 428 428 ]; 429 429 dependsOn = [

+1 -1

hosts/uwu/docker/media_stack.yml

··· 58 58 - GID=1000 59 59 volumes: 60 60 - /mnt/storage/torrent_stack/config/slskd:/app 61 - - /mnt/storage/media/downloads/soulseek/incomplete:/app/incomplete 61 + - /mnt/storage/media/downloads/soulseek_incomplete:/app/incomplete 62 62 - /mnt/storage/media/downloads/soulseek:/app/downloads 63 63 - /mnt/storage/media:/media 64 64 restart: unless-stopped

+1

hosts/vps/default.nix

··· 83 83 mainDomain = "kotiboksi.xyz"; 84 84 reverseProxy = { 85 85 "img.${config.meow.server.mainDomain}" = "http://${server.homeServer}:2283"; 86 + "navidrome.meowcloud.net" = "http://${server.homeServer2}:4533"; 86 87 "vw.meowcloud.net" = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}"; 87 88 }; 88 89

Configure Feed

Configure Feed