nix-config/hosts/library/default.nix

{ config, pkgs, ... }:

{
  imports = [
    ./hardware-configuration.nix
    ../server.nix
  ];

  nixpkgs.hostPlatform = "x86_64-linux";

  boot = {
    loader.systemd-boot.enable = true;
    loader.efi.canTouchEfiVariables = true;
    zfs.extraPools = [ "library" ];
  };

  networking = {
    hostId = "d24ae953";
    hosts = {
      "100.64.0.1" = [ "auth.vimium.com" ];
    };
    firewall = {
      enable = true;
      allowedTCPPorts = [
        22 # SSH
      ];
    };
  };

  services.zfs = {
    autoScrub = {
      enable = true;
      pools = [ "library" ];
    };
    autoSnapshot = {
      enable = true;
      flags = "-k -p --utc";
      frequent = 0;
      hourly = 0;
      daily = 7;
      monthly = 1;
    };
  };

  services.nfs.server = {
    enable = true;
  };

  services.grafana = {
    enable = true;
    settings = {
      server = {
        domain = "library.mesh.vimium.net";
        http_addr = "0.0.0.0";
        http_port = 3000;
      };
    };
  };

  services.prometheus = {
    enable = true;
    port = 9001;
    exporters = {
      node = {
        enable = true;
        enabledCollectors = [ "systemd" ];
        port = 9002;
      };
      zfs = {
        enable = true;
        port = 9003;
      };
    };
    scrapeConfigs = [
      {
        job_name = "node";
        static_configs = [
          {
            targets = [
              "127.0.0.1:${toString config.services.prometheus.exporters.node.port}"
              "127.0.0.1:${toString config.services.prometheus.exporters.zfs.port}"
            ];
          }
        ];
      }
    ];
  };

  systemd.services.vps1-tunnel = {
    enable = true;
    description = "vps1.mesh.vimium.net SSH tunnel";
    after = [
      "network-online.target"
      "jellyfin.service"
    ];
    wants = [ "network-online.target" ];
    serviceConfig = {
      Type = "simple";
      ExecStart = pkgs.lib.mkForce ''
        ${pkgs.openssh}/bin/ssh \
          -NT \
          -o ExitOnForwardFailure=yes \
          -o ServerAliveInterval=60 \
          -o TCPKeepAlive=no \
          -i %h/.ssh/id_jellyfin \
          -R localhost:8000:localhost:8000 \
          jellyfin@vps1.mesh.vimium.net
      '';
      Restart = "always";
      RestartSec = 20;
    };
    wantedBy = [ "default.target" ];
  };

  services.nginx =
    let
      proxyConfig = ''
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;

        proxy_set_header Range $http_range;
        proxy_set_header If-Range $http_if_range;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
      '';
    in
    {
      enable = true;
      package = pkgs.openresty;
      recommendedGzipSettings = true;
      recommendedOptimisation = true;
      recommendedTlsSettings = true;
      clientMaxBodySize = "2G";
      virtualHosts = {
        "library.mesh.vimium.net" = {
          locations."/" = {
            root = "/mnt/library";
            extraConfig = ''
              autoindex on;
            '';
          };
        };
        "jellyfin.vimium.com" = {
          default = true;
          listen = [
            {
              addr = "127.0.0.1";
              port = 8000;
            }
          ];
          locations."/" = {
            proxyPass = "http://localhost:8096";
            extraConfig = proxyConfig;
          };
          locations."/metrics" = {
            return = "404";
          };
        };
      };
    };

  hardware.graphics = {
    enable = true;
    extraPackages = with pkgs; [
      vaapiVdpau
    ];
  };
  users.users.jellyfin.extraGroups = [
    "video"
    "render"
  ];
  services.jellyfin = {
    enable = true;
    package = pkgs.unstable.jellyfin;
    cacheDir = "/var/cache/jellyfin";
    dataDir = "/var/lib/jellyfin";
  };

  modules = {
    podman.enable = true;
    services = {
      borgmatic = {
        enable = true;
        directories = [
          config.services.jellyfin.dataDir
          "/home/jordan"
        ];
        repoPath = "ssh://b61758r4@b61758r4.repo.borgbase.com/./repo";
      };
    };
  };

  system.stateVersion = "22.11";
}