rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden deployment, authentication, firewall and media storage failure paths

Browse source
This commit is contained in:
rope 2026-09-14 11:50:22 +01:00
parent 64ede7bd05
commit 7145a35927
35 changed files with 2529 additions and 499 deletions
Download patch file Download diff file Expand all files Collapse all files

60
services/server-permissions.nix
View file

@ -1,11 +1,57 @@
# services/server-permissions.nix
{ config, pkgs, lib, ... }:
# Media writes are allowed only after the pool and all its branches mount.
# Keep these directory rules out of global tmpfiles: nofail mounts may be
# absent when global tmpfiles runs, and creating paths then fills the root disk.
{ config, pkgs, lib, utils, ... }:
let
pool = "/mnt/storage";
branches = config.fileSystems.${pool}.depends or [ ];
mounts = map (p: "${utils.escapeSystemdPath p}.mount") ([ pool ] ++ branches);
consumers = [
"jellyfin" "sonarr" "radarr" "bazarr" "qbittorrent-nox" "sabnzbd"
"docker-shelfarr" "arr-interconnect" "bazarr-sync" "bazarr-sync-full"
];
directories = pkgs.writeText "media-directories.conf" ''
d /mnt/storage/torrents/downloads 2775 qbittorrent media -
Z /mnt/storage/torrents/downloads 2775 qbittorrent media -
d /mnt/storage/torrents/shows 2775 sonarr media -
Z /mnt/storage/torrents/shows 2775 sonarr media -
d /mnt/storage/torrents/movies 2775 radarr media -
Z /mnt/storage/torrents/movies 2775 radarr media -
d /mnt/storage/torrents/audiobooks 2775 fred media -
Z /mnt/storage/torrents/audiobooks 2775 fred media -
d /mnt/storage/usenet/downloads 2775 sabnzbd media -
Z /mnt/storage/usenet/downloads 2775 sabnzbd media -
d /mnt/storage/usenet/incomplete 2775 sabnzbd media -
Z /mnt/storage/usenet/incomplete 2775 sabnzbd media -
'';
in
{
config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
systemd.tmpfiles.rules = [
# Audiobooks - manually managed, no dedicated service yet
"d /mnt/storage/torrents/audiobooks 2775 fred media -"
"Z /mnt/storage/torrents/audiobooks 2775 fred media -"
];
systemd.services = {
media-storage-ready = {
description = "Prepare media directories on the mounted pool";
requires = mounts;
bindsTo = mounts;
after = mounts;
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
set -euo pipefail
${lib.concatMapStringsSep "\n" (p: ''
${pkgs.util-linux}/bin/mountpoint -q ${lib.escapeShellArg p} || {
echo "Required media mount missing: ${p}" >&2
exit 1
}
'') ([ pool ] ++ branches)}
${pkgs.systemd}/bin/systemd-tmpfiles --create ${directories}
'';
};
} // lib.genAttrs consumers (_: {
requires = [ "media-storage-ready.service" ];
after = [ "media-storage-ready.service" ];
bindsTo = [ "media-storage-ready.service" ];
});
};
}