From 666435f968731b49b1fd5234a898516d76df6bde Mon Sep 17 00:00:00 2001 From: Satria Date: Fri, 6 Mar 2026 19:34:45 +0700 Subject: [PATCH 1/3] enable jellyfin --- modules/system/homelab/dash.nix | 1 + modules/system/homelab/media.nix | 65 ++++++++++++++++---------------- modules/system/homelab/proxy.nix | 8 +--- modules/system/server.nix | 2 +- 4 files changed, 35 insertions(+), 41 deletions(-) diff --git a/modules/system/homelab/dash.nix b/modules/system/homelab/dash.nix index 12bf237..ca9b62a 100644 --- a/modules/system/homelab/dash.nix +++ b/modules/system/homelab/dash.nix @@ -58,6 +58,7 @@ [ "AdGuardHome" "adguard" "https://dns.proxy.${homelab.domain}" "http://localhost:8088/" ] [ "ApacheHTTPD" "apache" "https://cdn.proxy.${homelab.domain}" "http://localhost:3000/" ] [ "Immich" "immich" "https://gallery.proxy.${homelab.domain}" "http://localhost:2283/" ] + [ "Jellyfin" "jellyfin" "https://media.proxy.${homelab.domain}" "http://localhost:8096/" ] [ "VaultWarden" "vaultwarden" "https://pass.proxy.${homelab.domain}" "http://localhost:8060/" ] [ "Ollama" "ollama" "https://ai.proxy.${homelab.domain}" "http://localhost:8080/" ] [ "Dockge" "docker" "https://containers.proxy.${homelab.domain}" "http://localhost:5001/" ] diff --git a/modules/system/homelab/media.nix b/modules/system/homelab/media.nix index 949e6cd..0fde8ce 100644 --- a/modules/system/homelab/media.nix +++ b/modules/system/homelab/media.nix @@ -1,5 +1,4 @@ { pkgs, ... }: { - # WIP: declaratively integrate media services into homelab configuration environment.systemPackages = with pkgs; [ jellyfin jellyfin-web jellyfin-ffmpeg ]; @@ -8,37 +7,37 @@ enable = true; hardwareAcceleration.enable = true; }; - jellyseerr = { - enable = true; - port = 5055; - }; - radarr = { - enable = true; - settings = { - server = { - port = 7878; - bindaddress = "127.0.0.1"; - }; - }; - }; - sonarr = { - enable = true; - server = { - port = 8989; - bindaddress = "127.0.0.1"; - }; - }; - qbittorrent = { - enable = true; - webuiPort = 8020; - }; - jackett = { - enable = true; - port = 9117; - }; - flaresolverr = { - enable = true; - port = 8191; - }; + # jellyseerr = { + # enable = true; + # port = 5055; + # }; + # radarr = { + # enable = true; + # settings = { + # server = { + # port = 7878; + # bindaddress = "127.0.0.1"; + # }; + # }; + # }; + # sonarr = { + # enable = true; + # server = { + # port = 8989; + # bindaddress = "127.0.0.1"; + # }; + # }; + # qbittorrent = { + # enable = true; + # webuiPort = 8020; + # }; + # jackett = { + # enable = true; + # port = 9117; + # }; + # flaresolverr = { + # enable = true; + # port = 8191; + # }; }; } \ No newline at end of file diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix index ac88036..b0d66e3 100644 --- a/modules/system/homelab/proxy.nix +++ b/modules/system/homelab/proxy.nix @@ -4,19 +4,13 @@ "dns" = { dest = "http://localhost:8088"; auth = true; }; "ai" = { dest = "http://localhost:8080"; auth = true; }; - # "jsr" = { dest = "http://localhost:5055"; auth = false; }; - # "rdr" = { dest = "http://localhost:5055"; auth = false; }; - # "snr" = { dest = "http://localhost:5055"; auth = false; }; - # "qbt" = { dest = "http://localhost:8020"; auth = false; }; - # "jkt" = { dest = "http://localhost:9117"; auth = false; }; - # "media" = { dest = "http://localhost:8096"; auth = false; }; - "auth" = { dest = "http://localhost:1411"; auth = false; }; "git" = { dest = "http://localhost:5080"; auth = false; }; "containers" = { dest = "http://localhost:5001"; auth = false; }; "gallery" = { dest = "http://localhost:2283"; auth = false; }; "remote" = { dest = "http://localhost:8085"; auth = false; }; + "media" = { dest = "http://localhost:8096"; auth = false; }; "pass" = { dest = "http://localhost:8060"; auth = false; }; "cdn" = { dest = "http://localhost:3000"; auth = false; }; "@" = { dest = "http://localhost:5070"; auth = false; }; diff --git a/modules/system/server.nix b/modules/system/server.nix index bce1b6e..a058067 100644 --- a/modules/system/server.nix +++ b/modules/system/server.nix @@ -10,7 +10,7 @@ in { ./homelab/gallery.nix ./homelab/tunnels.nix ./homelab/remote.nix - # ./homelab/media.nix # wip + ./homelab/media.nix ./homelab/share.nix ./homelab/proxy.nix ./homelab/auth.nix From 35e59b9e50c91f20d9305108f0ab3a30341173bb Mon Sep 17 00:00:00 2001 From: Satria Date: Fri, 6 Mar 2026 19:34:58 +0700 Subject: [PATCH 2/3] dns reorder --- lib/options.nix | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/lib/options.nix b/lib/options.nix index e1f12f2..f0024ba 100644 --- a/lib/options.nix +++ b/lib/options.nix @@ -15,23 +15,24 @@ homelab = rec { domain = "satr14.my.id"; # root domain for dns, ssl certs, reverse proxy, etc. + cf-tunnel-id = "26318288-cdd7-4e58-904b-c45f10d3e40a"; disks = { share = "/dev/disk/by-uuid/ac61f6c8-ac20-41dd-ba93-41c4a225dc98"; # disk for nas share data = "/dev/disk/by-uuid/a5752dd6-092d-484c-969c-2fdc7cb4a5f0"; # disk for app data }; records = [ - [ "router.dns.${domain}" "10.3.14.1" ] - [ "workspace.dns.${domain}" "10.3.14.57" ] - [ "server.dns.${domain}" "10.3.14.69" ] - [ "home.dns.${domain}" "10.3.14.235" ] + [ "server.dns.${domain}" "10.3.14.69" ] + [ "router.dns.${domain}" "10.3.14.1" ] + [ "home.dns.${domain}" "10.3.14.235" ] + [ "workspace.dns.${domain}" "10.3.14.57" ] + [ "old-main.dns.${domain}" "10.3.14.42" ] # old main machine for connecting while migrating - [ "main.dns.${domain}" "10.3.14.215" ] # this machine - [ "old-main.dns.${domain}" "10.3.14.42" ] # old main machine for connecting while migrating + [ "main.dns.${domain}" "10.3.14.215" ] # this machine [ "proxy.${domain}" "main.dns.${domain}" ] [ "*.proxy.${domain}" "proxy.${domain}" ] - # [ "lancache.steamcontent.com" "main.dns.${domain}" ] - # [ "steam.cache.lancache.net" "main.dns.${domain}" ] + # [ "lancache.steamcontent.com" "main.dns.${domain}" ] + # [ "steam.cache.lancache.net" "main.dns.${domain}" ] ]; }; From fc663163439bc8c425dd0cc4fe98ac88c444f93c Mon Sep 17 00:00:00 2001 From: Satria Date: Fri, 6 Mar 2026 19:35:05 +0700 Subject: [PATCH 3/3] tunnel config --- modules/system/homelab/tunnels.nix | 32 ++++++++++++++++++++++++------ 1 file changed, 26 insertions(+), 6 deletions(-) diff --git a/modules/system/homelab/tunnels.nix b/modules/system/homelab/tunnels.nix index 7214d4b..25c06bc 100644 --- a/modules/system/homelab/tunnels.nix +++ b/modules/system/homelab/tunnels.nix @@ -1,16 +1,36 @@ -{ homelab, ... }: { +{ pkgs, lib, homelab, ... }: let + routes = { + "git.${homelab.domain}" = "http://localhost:3000"; + "auth.${homelab.domain}" = "http://localhost:1411"; + "dash.${homelab.domain}" = "http://localhost:5070"; + "gallery.${homelab.domain}" = "http://localhost:2284"; + }; +in { services.cloudflared = { enable = true; tunnels.homelab = { credentialsFile = "/mnt/data/cloudflared/homelab.json"; certificateFile = "/mnt/data/cloudflared/cert.pem"; default = "http_status:404"; - ingress = { - "git.${homelab.domain}" = "http://localhost:3000"; - "auth.${homelab.domain}" = "http://localhost:1411"; - "dash.${homelab.domain}" = "http://localhost:5070"; - "gallery.${homelab.domain}" = "http://localhost:2284"; + ingress = routes; + }; + + systemd.services.cloudflared-dns-route = { + description = "Sync Cloudflare Tunnel DNS routes"; + after = [ "network-online.target" ]; + wants = [ "network-online.target" ]; + wantedBy = [ "multi-user.target" ]; + + serviceConfig = { + RemainAfterExit = true; + Type = "oneshot"; + User = "root"; }; + + script = lib.concatMapStringsSep "\n" (domain: '' + echo "Ensuring DNS route for ${domain}..." + ${pkgs.cloudflared}/bin/cloudflared tunnel --origincert /mnt/data/cloudflared/cert.pem route dns ${homelab.cf-tunnel-id} ${domain} || true + '') builtins.attrNames routes; }; }; } \ No newline at end of file