test: jellyfin microVM

modules/nixos/services/jellyfin/default.nix

@@ -6,24 +6,15 @@
 let
   inherit (flake.config.people) user0;
   inherit (flake.config.services) instances;
-  serviceCfg = flake.config.services.instances.jellyfin;
-  hostCfg = flake.config.services.instances.web;
-  host = serviceCfg.domains.url0;
+  serviceCfg = instances.jellyfin;
+  hostCfg = instances.web;
   dns0 = instances.web.dns.provider0;
+  host = serviceCfg.domains.url0;
   dns0Path = "dns/${dns0}";
 in
 {
-  users.users.caddy.extraGroups = [ "acme" ];
-
-  security.acme.certs."${host}" = {
-    dnsProvider = dns0;
-    environmentFile = config.sops.secrets.${dns0Path}.path;
-    group = "caddy";
-  };
-
   microvm.vms.jellyin = {
     autostart = true;
-
     restartIfChanged = true;
     config = {
       system.stateVersion = "24.05";
@@ -33,11 +24,6 @@ in
         jellyfin = {
           enable = true;
           openFirewall = true;
-          user = user0;
-        };
-        jellyseerr = {
-          openFirewall = true;
-          enable = true;
         };
 
         openssh = {
@@ -50,10 +36,12 @@ in
       };
 
       networking.firewall.allowedTCPPorts = [
+        22
         serviceCfg.ports.port0
         serviceCfg.ports.port1
         serviceCfg.ports.port2
       ];
+
       systemd.network = {
         enable = true;
         networks."20-lan" = {
@@ -75,6 +63,7 @@ in
       };
 
       systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
+
       microvm = {
         vcpu = 4;
         mem = 4096;
@@ -91,6 +80,7 @@ in
             mac = serviceCfg.interface.macUser;
           }
         ];
+
         forwardPorts = [
           {
             from = "host";
@@ -110,37 +100,50 @@ in
             mountPoint = serviceCfg.varPaths.path0;
             proto = "virtiofs";
             source = serviceCfg.mntPaths.path0;
-            tag = "service_data";
+            tag = "${serviceCfg.name}_data";
           }
           {
             mountPoint = serviceCfg.varPaths.path1;
             proto = "virtiofs";
             source = "${serviceCfg.mntPaths.path0}/cache";
-            tag = "service_cache";
+            tag = "${serviceCfg.name}_cache";
           }
         ];
       };
     };
   };
 
-  systemd.tmpfiles.rules = [
-    "d ${serviceCfg.mntPaths.path0} 0755 root root -"
-  ];
+  security.acme.certs."${host}" = {
+    dnsProvider = dns0;
+    environmentFile = config.sops.secrets.${dns0Path}.path;
+    group = "caddy";
+  };
 
   services = {
     caddy = {
       virtualHosts = {
         "${host}" = {
           extraConfig = ''
+            reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} {
+              header_up X-Real-IP {remote_host}
+            }
+
             redir /.well-known/carddav /remote.php/dav/ 301
             redir /.well-known/caldav /remote.php/dav/ 301
 
-            reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0}
-
             tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
+            encode zstd gzip
           '';
         };
       };
     };
   };
+
+  users.users.caddy.extraGroups = [ "acme" ];
+
+  systemd.tmpfiles.rules = [
+    "d ${serviceCfg.mntPaths.path0} 0755 root root -"
+    "d ${serviceCfg.mntPaths.path0}/cache 0755 root root -"
+  ];
+
 }