rope
40ef4444fa
Fixes Sonarr/Radarr import fail-loop (can't delete sources → mergerfs thrash). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
83 lines
No EOL
3 KiB
Nix
83 lines
No EOL
3 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
let
|
|
# SAB rejects requests whose Host header isn't in host_whitelist. We need:
|
|
# - sabnzbd.nordhammer.it (the nginx-fronted public path)
|
|
# - 127.0.0.1 + localhost (so Sonarr/Radarr can hit SAB locally via
|
|
# arr-interconnect without hitting "Hostname verification failed")
|
|
patchConfig = pkgs.writeShellScript "sabnzbd-patch-config" ''
|
|
CONFIG=/var/lib/sabnzbd/sabnzbd.ini
|
|
WHITELIST="sabnzbd.nordhammer.it,127.0.0.1,localhost"
|
|
# Completed downloads must land on the setgid, group-writable pool dir
|
|
# (see tmpfiles below), NOT sabnzbd's default /var/lib/sabnzbd/Downloads/
|
|
# complete which is 0755 — there Sonarr/Radarr (group media) can copy the
|
|
# file out but can't delete the source, so imports fail-loop forever with
|
|
# "Permission denied" and thrash the mergerfs pool. permissions=0775 makes
|
|
# sabnzbd force group-write on completed files/dirs so the *arrs can remove
|
|
# them after import.
|
|
COMPLETE_DIR="/mnt/storage/usenet/downloads"
|
|
PERMISSIONS="0775"
|
|
|
|
if [ ! -f "$CONFIG" ]; then
|
|
printf '[misc]\nhost_whitelist = %s\nport = 8085\ncomplete_dir = %s\npermissions = %s\n' \
|
|
"$WHITELIST" "$COMPLETE_DIR" "$PERMISSIONS" > "$CONFIG"
|
|
exit 0
|
|
fi
|
|
|
|
# Idempotently set a key in the [misc] section (create or replace).
|
|
set_misc() {
|
|
key="$1"; val="$2"
|
|
if ${pkgs.gnugrep}/bin/grep -q "^$key" "$CONFIG"; then
|
|
${pkgs.gnused}/bin/sed -i "s|^$key =.*|$key = $val|" "$CONFIG"
|
|
else
|
|
${pkgs.gnused}/bin/sed -i "/^\[misc\]/a $key = $val" "$CONFIG"
|
|
fi
|
|
}
|
|
|
|
set_misc host_whitelist "$WHITELIST"
|
|
set_misc complete_dir "$COMPLETE_DIR"
|
|
set_misc permissions "$PERMISSIONS"
|
|
'';
|
|
in
|
|
{
|
|
config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
|
|
|
|
users.users.sabnzbd = {
|
|
isSystemUser = true;
|
|
group = "media";
|
|
extraGroups = [ "media" ];
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /var/lib/sabnzbd 0755 sabnzbd media -"
|
|
"Z /var/lib/sabnzbd 0755 sabnzbd media -"
|
|
"d /mnt/storage/usenet/downloads 2775 sabnzbd media -"
|
|
"Z /mnt/storage/usenet/downloads 2775 sabnzbd media -"
|
|
"d /mnt/storage/usenet/incomplete 2775 sabnzbd media -"
|
|
"Z /mnt/storage/usenet/incomplete 2775 sabnzbd media -"
|
|
];
|
|
|
|
systemd.services.sabnzbd = {
|
|
description = "SABnzbd usenet downloader";
|
|
after = [ "network.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
User = "sabnzbd";
|
|
Group = "media";
|
|
ExecStartPre = patchConfig;
|
|
ExecStart = "${pkgs.sabnzbd}/bin/sabnzbd --config-file /var/lib/sabnzbd/sabnzbd.ini --server 127.0.0.1:8085";
|
|
Restart = "on-failure";
|
|
UMask = "0002";
|
|
NoNewPrivileges = true;
|
|
PrivateTmp = true;
|
|
ProtectSystem = "strict";
|
|
ProtectHome = false;
|
|
ReadWritePaths = [
|
|
"/var/lib/sabnzbd"
|
|
"/mnt/storage/usenet"
|
|
];
|
|
WorkingDirectory = "/var/lib/sabnzbd";
|
|
};
|
|
};
|
|
};
|
|
} |