nixos/services/server-permissions.nix
rope 554eec97b0 Drop recursive media chown and migration backup script
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-09-23 10:08:13 +01:00

51 lines
1.9 KiB
Nix

# Media writes are allowed only after the pool and all its branches mount.
# Keep these directory rules out of global tmpfiles: nofail mounts may be
# absent when global tmpfiles runs, and creating paths then fills the root disk.
{ config, pkgs, lib, utils, ... }:
let
pool = "/mnt/storage";
branches = config.fileSystems.${pool}.depends or [ ];
mounts = map (p: "${utils.escapeSystemdPath p}.mount") ([ pool ] ++ branches);
consumers = [
"jellyfin" "sonarr" "radarr" "bazarr" "qbittorrent-nox" "sabnzbd"
"docker-shelfarr" "arr-interconnect" "bazarr-sync" "bazarr-sync-full"
];
directories = pkgs.writeText "media-directories.conf" ''
d /mnt/storage/torrents/downloads 2775 qbittorrent media -
d /mnt/storage/torrents/shows 2775 sonarr media -
d /mnt/storage/torrents/movies 2775 radarr media -
d /mnt/storage/torrents/audiobooks 2775 fred media -
d /mnt/storage/usenet/downloads 2775 sabnzbd media -
d /mnt/storage/usenet/incomplete 2775 sabnzbd media -
'';
in
{
config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
systemd.services = {
media-storage-ready = {
description = "Prepare media directories on the mounted pool";
requires = mounts;
bindsTo = mounts;
after = mounts;
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
set -euo pipefail
${lib.concatMapStringsSep "\n" (p: ''
${pkgs.util-linux}/bin/mountpoint -q ${lib.escapeShellArg p} || {
echo "Required media mount missing: ${p}" >&2
exit 1
}
'') ([ pool ] ++ branches)}
${pkgs.systemd}/bin/systemd-tmpfiles --create ${directories}
'';
};
} // lib.genAttrs consumers (_: {
requires = [ "media-storage-ready.service" ];
after = [ "media-storage-ready.service" ];
bindsTo = [ "media-storage-ready.service" ];
});
};
}