test: jellyfin microVM

modules/nixos/services/jellyfin/default.nix

@@ -1,23 +1,133 @@
-{ flake, ... }:
+{
+  config,
+  flake,
+  ...
+}:
 let
   inherit (flake.config.people) user0;
-  inherit (flake.config.machines.devices) ceres;
-  inherit (flake.config.services.instances) jellyfin web;
-  service = jellyfin;
-  localhost = web.localhost.address0;
-  host = service.domains.url0;
+  inherit (flake.config.services) instances;
+  serviceCfg = flake.config.services.instances.jellyfin;
+  hostCfg = flake.config.services.instances.web;
+  host = serviceCfg.domains.url0;
+  dns0 = instances.web.dns.provider0;
+  dns0Path = "dns/${dns0}";
 in
 {
+  users.users.caddy.extraGroups = [ "acme" ];
+
+  security.acme.certs."${host}" = {
+    dnsProvider = dns0;
+    environmentFile = config.sops.secrets.${dns0Path}.path;
+    group = "caddy";
+  };
+
+  microvm.vms.jellyin = {
+    autostart = true;
+
+    restartIfChanged = true;
+    config = {
+      system.stateVersion = "24.05";
+      time.timeZone = "America/Winnipeg";
+      users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
+      services = {
+        jellyfin = {
+          enable = true;
+          openFirewall = true;
+          user = user0;
+        };
+        jellyseerr = {
+          openFirewall = true;
+          enable = true;
+        };
+
+        openssh = {
+          enable = true;
+          settings = {
+            PasswordAuthentication = false;
+            PermitRootLogin = "prohibit-password";
+          };
+        };
+      };
+
+      networking.firewall.allowedTCPPorts = [
+        serviceCfg.ports.port0
+        serviceCfg.ports.port1
+        serviceCfg.ports.port2
+      ];
+      systemd.network = {
+        enable = true;
+        networks."20-lan" = {
+          matchConfig.Name = "enp0s5";
+          addresses = [
+            { Address = "${serviceCfg.interface.ip}/24"; }
+          ];
+          routes = [
+            {
+              Destination = "${hostCfg.localhost.address1}/0";
+              Gateway = serviceCfg.interface.gate;
+            }
+          ];
+          dns = [
+            "1.1.1.1"
+            "8.8.8.8"
+          ];
+        };
+      };
+
+      systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
+      microvm = {
+        vcpu = 4;
+        mem = 4096;
+        hypervisor = "qemu";
+        interfaces = [
+          {
+            type = "tap";
+            id = serviceCfg.interface.id;
+            mac = serviceCfg.interface.mac;
+          }
+          {
+            type = "user";
+            id = serviceCfg.interface.idUser;
+            mac = serviceCfg.interface.macUser;
+          }
+        ];
+        forwardPorts = [
+          {
+            from = "host";
+            host.port = serviceCfg.interface.ssh;
+            guest.port = 22;
+          }
+        ];
+
+        shares = [
+          {
+            mountPoint = "/nix/.ro-store";
+            proto = "virtiofs";
+            source = "/nix/store";
+            tag = "read_only_nix_store";
+          }
+          {
+            mountPoint = serviceCfg.varPaths.path0;
+            proto = "virtiofs";
+            source = serviceCfg.mntPaths.path0;
+            tag = "service_data";
+          }
+          {
+            mountPoint = serviceCfg.varPaths.path1;
+            proto = "virtiofs";
+            source = "${serviceCfg.mntPaths.path0}/cache";
+            tag = "service_cache";
+          }
+        ];
+      };
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "d ${serviceCfg.mntPaths.path0} 0755 root root -"
+  ];
+
   services = {
-    jellyfin = {
-      enable = true;
-      openFirewall = true;
-      user = user0;
-    };
-    jellyseerr = {
-      openFirewall = true;
-      enable = true;
-    };
     caddy = {
       virtualHosts = {
         "${host}" = {
@@ -25,50 +135,12 @@ in
             redir /.well-known/carddav /remote.php/dav/ 301
             redir /.well-known/caldav /remote.php/dav/ 301
 
-            reverse_proxy ${localhost}:${toString service.ports.port0}
+            reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0}
 
-            tls ${service.ssl.cert} ${service.ssl.key}
+            tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
           '';
         };
       };
     };
   };
-
-  fileSystems =
-    let
-      settings = {
-        fsType = "none";
-        options = [
-          "bind"
-        ];
-        depends = [
-          ceres.storage0.mount
-        ];
-      };
-    in
-    {
-      "/var/lib/${service.name}" = {
-        device = service.paths.path0;
-      }
-      // settings;
-      "/var/cache/${service.name}" = {
-        device = "${service.paths.path1}";
-      }
-      // settings;
-    };
-
-  systemd.tmpfiles.rules = [
-    "Z ${service.paths.path0} 0755 ${user0} ${service.name} -"
-    "Z ${service.paths.path0} 0755 ${user0} ${service.name} -"
-  ];
-
-  networking = {
-    firewall = {
-      allowedTCPPorts = [
-        service.ports.port0
-        service.ports.port1
-        service.ports.port2
-      ];
-    };
-  };
 }