From a86372fcc145f87c867b3cb00794f523b7bbbe3a Mon Sep 17 00:00:00 2001 From: Ethan Turkeltaub Date: Sun, 13 Sep 2026 20:16:57 -0400 Subject: [PATCH 1/6] Update secrets, re-add to `gateway` --- flake.lock | 8 +++--- hosts/gateway/configuration.nix | 11 ++++++-- hosts/gateway/profiles/caddy/default.nix | 8 +++--- .../profiles/observability/gatus/default.nix | 26 ++++++++++++++++--- 4 files changed, 39 insertions(+), 14 deletions(-) diff --git a/flake.lock b/flake.lock index 931c730..90fc2bf 100644 --- a/flake.lock +++ b/flake.lock @@ -263,11 +263,11 @@ ] }, "locked": { - "lastModified": 1784495994, - "narHash": "sha256-VV+mSFXAhY9Vl4n3IizYudLOIoOc7KLGcOLVjQTDuw0=", + "lastModified": 1789331947, + "narHash": "sha256-MeZm0C9pj7Ks5Z2qWrJTL6LCZolaEpCBAW4u3aiBe8g=", "ref": "refs/heads/main", - "rev": "ecee262a4c82c319b95572d51e8bb46f68433d4e", - "revCount": 3, + "rev": "1ec13a6c6b81ad62e3b92f6f7037b55b4853b34b", + "revCount": 4, "type": "git", "url": "ssh://git@github.com/ethnt/e10-secrets" }, diff --git a/hosts/gateway/configuration.nix b/hosts/gateway/configuration.nix index 734d39e..193f8f2 100644 --- a/hosts/gateway/configuration.nix +++ b/hosts/gateway/configuration.nix @@ -1,4 +1,10 @@ -{ suites, profiles, ... }: { +{ + suites, + profiles, + secrets, + ... +}: +{ imports = with suites; core @@ -14,7 +20,8 @@ ++ [ ./disk-config.nix ./hardware-configuration.nix - ]; + ] + ++ [ secrets.hosts.gateway.configuration ]; deployment = { vmType = "hcloud"; diff --git a/hosts/gateway/profiles/caddy/default.nix b/hosts/gateway/profiles/caddy/default.nix index 4c043be..bf71c93 100644 --- a/hosts/gateway/profiles/caddy/default.nix +++ b/hosts/gateway/profiles/caddy/default.nix @@ -284,10 +284,10 @@ in port = 8123; }; - "frigate.e10.camp" = { - host = hosts.whirlwind; - port = 8971; - }; + # "frigate.e10.camp" = { + # host = hosts.whirlwind; + # port = 8971; + # }; "analytics.e10.camp" = { host = hosts.matrix; diff --git a/modules/profiles/observability/gatus/default.nix b/modules/profiles/observability/gatus/default.nix index 0e72d23..aec39bc 100644 --- a/modules/profiles/observability/gatus/default.nix +++ b/modules/profiles/observability/gatus/default.nix @@ -211,16 +211,33 @@ in url = "http://htpc:9100"; group = "HTPC"; }) + (mkEndpoint { + name = "Wizarr"; + url = "https://setup.e10.video"; + group = "HTPC"; + }) + ]; + whirlwind = [ (mkEndpoint { name = "FileFlows"; url = "https://fileflows.e10.camp"; - group = "HTPC"; + group = "Whirlwind"; protected = true; }) (mkEndpoint { name = "Frigate"; - url = "https://frigate.e10.camp"; - group = "HTPC"; + url = "http://whirlwind:8971"; + group = "Whirlwind"; + }) + (mkEndpoint { + name = "Prometheus DCGM Exporter"; + url = "http://whirlwind:9400"; + group = "Whirlwind"; + }) + (mkEndpoint { + name = "Prometheus Node Exporter"; + url = "http://whirlwind:9100"; + group = "Whirlwind"; }) ]; matrix = [ @@ -481,7 +498,8 @@ in ++ elderflower-kvm ++ fabricator ++ nut-network - ++ nut-homelab; + ++ nut-homelab + ++ whirlwind; }; }; } From 260741d1be1535cafadbcd763bc02f4cca44fdf1 Mon Sep 17 00:00:00 2001 From: Ethan Turkeltaub Date: Sun, 13 Sep 2026 21:11:42 -0400 Subject: [PATCH 2/6] Use built-in `sonarr` settings --- hosts/gateway/profiles/caddy/default.nix | 2 +- hosts/htpc/configuration.nix | 1 + modules/nixos/services/sonarr/default.nix | 13 ---- .../media-management/sonarr/default.nix | 76 +++++++++---------- .../telemetry/prometheus-sonarr-exporter.nix | 9 +++ 5 files changed, 46 insertions(+), 55 deletions(-) delete mode 100644 modules/nixos/services/sonarr/default.nix create mode 100644 modules/profiles/telemetry/prometheus-sonarr-exporter.nix diff --git a/hosts/gateway/profiles/caddy/default.nix b/hosts/gateway/profiles/caddy/default.nix index bf71c93..970341d 100644 --- a/hosts/gateway/profiles/caddy/default.nix +++ b/hosts/gateway/profiles/caddy/default.nix @@ -105,7 +105,7 @@ in "sonarr.e10.camp" = { host = hosts.htpc; - inherit (hosts.htpc.config.services.sonarr) port; + inherit (hosts.htpc.config.services.sonarr.settings.server) port; }; "bazarr.e10.camp" = { diff --git a/hosts/htpc/configuration.nix b/hosts/htpc/configuration.nix index 9c9a305..34e91fe 100644 --- a/hosts/htpc/configuration.nix +++ b/hosts/htpc/configuration.nix @@ -30,6 +30,7 @@ profiles.services.attic-watch-store.default profiles.sharing.nfs-client profiles.telemetry.prometheus-dcgm-exporter + profiles.telemetry.prometheus-sonarr-exporter profiles.telemetry.prometheus-plex-exporter.default profiles.virtualisation.docker ] diff --git a/modules/nixos/services/sonarr/default.nix b/modules/nixos/services/sonarr/default.nix deleted file mode 100644 index 8bb7fbd..0000000 --- a/modules/nixos/services/sonarr/default.nix +++ /dev/null @@ -1,13 +0,0 @@ -{ lib, ... }: - -with lib; - -{ - options.services.sonarr = { - port = mkOption { - type = types.port; - description = "Port that Sonarr is running on"; - default = 8989; - }; - }; -} diff --git a/modules/profiles/media-management/sonarr/default.nix b/modules/profiles/media-management/sonarr/default.nix index 24edabf..e532f6f 100644 --- a/modules/profiles/media-management/sonarr/default.nix +++ b/modules/profiles/media-management/sonarr/default.nix @@ -1,5 +1,4 @@ { - flake, config, profiles, ... @@ -8,38 +7,10 @@ imports = [ profiles.secrets.sonarr.default ] ++ [ ./postgresql.nix ]; sops = { - templates."sonarr/config.xml" = { - content = - flake.lib.generators.toXML - { - rootName = "Config"; - xmlns = { }; - } - { - ApiKey = "${config.sops.placeholder.sonarr_api_key}"; - AuthenticationMethod = "Forms"; - AuthenticationRequired = "Enabled"; - BindAddress = "*"; - Branch = "main"; - EnableSsl = false; - InstanceName = "Sonarr"; - LaunchBrowser = true; - LogLevel = "info"; - Port = config.services.sonarr.port; - PostgresHost = "localhost"; - PostgresLogDb = "sonarr_logs"; - PostgresMainDb = "sonarr"; - PostgresPassword = ""; - PostgresPort = config.services.postgresql.settings.port; - PostgresUser = "sonarr"; - SslCertPassword = null; - SslCertPath = null; - SslPort = 9898; - UpdateMechanism = "builtin"; - UrlBase = null; - }; - - path = "${config.services.sonarr.dataDir}/config.xml"; + templates."sonarr/environment_file" = { + content = '' + SONARR__AUTH__APIKEY=${config.sops.placeholder.sonarr_api_key} + ''; owner = config.services.sonarr.user; inherit (config.services.sonarr) group; mode = "0660"; @@ -49,13 +20,36 @@ services.sonarr = { enable = true; openFirewall = true; - }; - - services.prometheus.exporters.exportarr-sonarr = { - enable = true; - url = "https://sonarr.e10.camp"; - openFirewall = true; - apiKeyFile = config.sops.secrets.sonarr_api_key.path; - port = 9708; + environmentFiles = [ config.sops.templates."sonarr/environment_file".path ]; + settings = { + app = { + instancename = "Sonarr"; + launchbrowser = false; + }; + server = { + bindaddress = "*"; + port = 8989; + enablessl = false; + }; + postgres = { + host = "localhost"; + port = config.services.postgresql.settings.port; + maindb = "sonarr"; + logdb = "sonarr_logs"; + user = "sonarr"; + password = ""; + }; + log = { + level = "info"; + }; + auth = { + method = "Forms"; + required = "Enabled"; + }; + update = { + automatically = false; + mechanism = "external"; + }; + }; }; } diff --git a/modules/profiles/telemetry/prometheus-sonarr-exporter.nix b/modules/profiles/telemetry/prometheus-sonarr-exporter.nix new file mode 100644 index 0000000..3d5c970 --- /dev/null +++ b/modules/profiles/telemetry/prometheus-sonarr-exporter.nix @@ -0,0 +1,9 @@ +{ config, ... }: { + services.prometheus.exporters.exportarr-sonarr = { + enable = true; + url = "https://sonarr.e10.camp"; + apiKeyFile = config.sops.secrets.sonarr_api_key.path; + port = 9708; + openFirewall = true; + }; +} From 864b1f49dbf24f319b0ec446f6d7bcc5878a83e7 Mon Sep 17 00:00:00 2001 From: Ethan Turkeltaub Date: Sun, 13 Sep 2026 21:20:06 -0400 Subject: [PATCH 3/6] Use built-in `radarr` settings --- hosts/gateway/profiles/caddy/default.nix | 2 +- hosts/htpc/configuration.nix | 1 + modules/nixos/services/radarr/default.nix | 13 ---- .../media-management/radarr/default.nix | 74 +++++++++---------- .../media-management/sonarr/default.nix | 1 + .../telemetry/prometheus-radarr-exporter.nix | 9 +++ 6 files changed, 47 insertions(+), 53 deletions(-) delete mode 100644 modules/nixos/services/radarr/default.nix create mode 100644 modules/profiles/telemetry/prometheus-radarr-exporter.nix diff --git a/hosts/gateway/profiles/caddy/default.nix b/hosts/gateway/profiles/caddy/default.nix index 970341d..60dbff8 100644 --- a/hosts/gateway/profiles/caddy/default.nix +++ b/hosts/gateway/profiles/caddy/default.nix @@ -100,7 +100,7 @@ in "radarr.e10.camp" = { host = hosts.htpc; - inherit (hosts.htpc.config.services.radarr) port; + inherit (hosts.htpc.config.services.radarr.settings.server) port; }; "sonarr.e10.camp" = { diff --git a/hosts/htpc/configuration.nix b/hosts/htpc/configuration.nix index 34e91fe..e8d2032 100644 --- a/hosts/htpc/configuration.nix +++ b/hosts/htpc/configuration.nix @@ -31,6 +31,7 @@ profiles.sharing.nfs-client profiles.telemetry.prometheus-dcgm-exporter profiles.telemetry.prometheus-sonarr-exporter + profiles.telemetry.prometheus-radarr-exporter profiles.telemetry.prometheus-plex-exporter.default profiles.virtualisation.docker ] diff --git a/modules/nixos/services/radarr/default.nix b/modules/nixos/services/radarr/default.nix deleted file mode 100644 index 6f71734..0000000 --- a/modules/nixos/services/radarr/default.nix +++ /dev/null @@ -1,13 +0,0 @@ -{ lib, ... }: - -with lib; - -{ - options.services.radarr = { - port = mkOption { - type = types.port; - description = "Port that Radarr is running on"; - default = 7878; - }; - }; -} diff --git a/modules/profiles/media-management/radarr/default.nix b/modules/profiles/media-management/radarr/default.nix index e372b96..79fd1a0 100644 --- a/modules/profiles/media-management/radarr/default.nix +++ b/modules/profiles/media-management/radarr/default.nix @@ -1,5 +1,4 @@ { - flake, config, profiles, ... @@ -8,36 +7,10 @@ imports = [ profiles.secrets.radarr.default ] ++ [ ./postgresql.nix ]; sops = { - templates."radarr/config.xml" = { - content = - flake.lib.generators.toXML - { - rootName = "Config"; - xmlns = { }; - } - { - ApiKey = "${config.sops.placeholder.radarr_api_key}"; - AuthenticationMethod = "Forms"; - AuthenticationRequired = "Enabled"; - BindAddress = "*"; - Branch = "master"; - EnableSsl = false; - InstanceName = "Radarr"; - LaunchBrowser = false; - LogLevel = "info"; - Port = config.services.radarr.port; - PostgresHost = "localhost"; - PostgresLogDb = "radarr_logs"; - PostgresMainDb = "radarr"; - PostgresPassword = ""; - PostgresPort = config.services.postgresql.settings.port; - PostgresUser = "radarr"; - SslCertPassword = null; - SslCertPath = null; - SslPort = 9898; - UrlBase = null; - }; - path = "${config.services.radarr.dataDir}/config.xml"; + templates."radarr/environment_file" = { + content = '' + RADARR__AUTH__APIKEY=${config.sops.placeholder.radarr_api_key} + ''; owner = config.services.radarr.user; inherit (config.services.radarr) group; mode = "0660"; @@ -47,13 +20,36 @@ services.radarr = { enable = true; openFirewall = true; - }; - - services.prometheus.exporters.exportarr-radarr = { - enable = true; - url = "https://radarr.e10.camp"; - openFirewall = true; - apiKeyFile = config.sops.secrets.radarr_api_key.path; - port = 9709; + environmentFiles = [ config.sops.templates."radarr/environment_file".path ]; + settings = { + app = { + instancename = "Radarr"; + launchbrowser = false; + }; + server = { + bindaddress = "*"; + port = 9898; + enablessl = false; + }; + postgres = { + host = "localhost"; + port = config.services.postgresql.settings.port; + maindb = "radarr"; + user = "radarr"; + password = ""; + }; + log = { + level = "info"; + dbenabled = false; + }; + auth = { + method = "Forms"; + required = "Enabled"; + }; + update = { + automatically = false; + mechanism = "external"; + }; + }; }; } diff --git a/modules/profiles/media-management/sonarr/default.nix b/modules/profiles/media-management/sonarr/default.nix index e532f6f..cadd1b2 100644 --- a/modules/profiles/media-management/sonarr/default.nix +++ b/modules/profiles/media-management/sonarr/default.nix @@ -41,6 +41,7 @@ }; log = { level = "info"; + dbenabled = false; }; auth = { method = "Forms"; diff --git a/modules/profiles/telemetry/prometheus-radarr-exporter.nix b/modules/profiles/telemetry/prometheus-radarr-exporter.nix new file mode 100644 index 0000000..e6bc310 --- /dev/null +++ b/modules/profiles/telemetry/prometheus-radarr-exporter.nix @@ -0,0 +1,9 @@ +{ config, ... }: { + services.prometheus.exporters.exportarr-radarr = { + enable = true; + url = "https://radarr.e10.camp"; + openFirewall = true; + apiKeyFile = config.sops.secrets.radarr_api_key.path; + port = 9709; + }; +} From 23878b7a063d2d90d3a40257cba1b44bd592e023 Mon Sep 17 00:00:00 2001 From: Ethan Turkeltaub Date: Sun, 13 Sep 2026 21:42:19 -0400 Subject: [PATCH 4/6] Use `secretValues` for `sabnzbd` --- hosts/htpc/configuration.nix | 3 +- modules/profiles/media-management/plex.nix | 2 + .../media-management/sabnzbd/default.nix | 115 +++++++----------- .../telemetry/prometheus-sabnzbd-exporter.nix | 9 ++ 4 files changed, 55 insertions(+), 74 deletions(-) create mode 100644 modules/profiles/telemetry/prometheus-sabnzbd-exporter.nix diff --git a/hosts/htpc/configuration.nix b/hosts/htpc/configuration.nix index e8d2032..cce23f0 100644 --- a/hosts/htpc/configuration.nix +++ b/hosts/htpc/configuration.nix @@ -30,8 +30,9 @@ profiles.services.attic-watch-store.default profiles.sharing.nfs-client profiles.telemetry.prometheus-dcgm-exporter - profiles.telemetry.prometheus-sonarr-exporter profiles.telemetry.prometheus-radarr-exporter + profiles.telemetry.prometheus-sabnzbd-exporter + profiles.telemetry.prometheus-sonarr-exporter profiles.telemetry.prometheus-plex-exporter.default profiles.virtualisation.docker ] diff --git a/modules/profiles/media-management/plex.nix b/modules/profiles/media-management/plex.nix index 57256c5..cb6233c 100644 --- a/modules/profiles/media-management/plex.nix +++ b/modules/profiles/media-management/plex.nix @@ -7,4 +7,6 @@ systemd.tmpfiles.rules = [ "d '/data/local/tmp/plex/transcode' 0777 ${config.services.plex.user} ${config.services.plex.group} - -" ]; + + systemd.services.plex.unitConfig.RequiresMountsFor = [ "/mnt/blockbuster" ]; } diff --git a/modules/profiles/media-management/sabnzbd/default.nix b/modules/profiles/media-management/sabnzbd/default.nix index e82178a..4503aee 100644 --- a/modules/profiles/media-management/sabnzbd/default.nix +++ b/modules/profiles/media-management/sabnzbd/default.nix @@ -1,4 +1,4 @@ -{ flake, config, ... }: +{ config, ... }: let downloadDir = "/mnt/blockbuster/tmp/sabnzbd/inter"; completeDir = "/mnt/blockbuster/tmp/sabnzbd/dst"; @@ -9,130 +9,110 @@ in sabnzbd_admin_password = { format = "yaml"; sopsFile = ./secrets.yml; + owner = config.services.sabnzbd.user; }; sabnzbd_api_key = { format = "yaml"; sopsFile = ./secrets.yml; + owner = config.services.sabnzbd.user; }; sabnzbd_nzb_key = { format = "yaml"; sopsFile = ./secrets.yml; + owner = config.services.sabnzbd.user; }; sabnzbd_newsgroup_ninja_username = { format = "yaml"; sopsFile = ./secrets.yml; + owner = config.services.sabnzbd.user; }; sabnzbd_newsgroup_ninja_password = { format = "yaml"; sopsFile = ./secrets.yml; + owner = config.services.sabnzbd.user; }; sabnzbd_eweka_username = { format = "yaml"; sopsFile = ./secrets.yml; + owner = config.services.sabnzbd.user; }; sabnzbd_eweka_password = { format = "yaml"; sopsFile = ./secrets.yml; + owner = config.services.sabnzbd.user; }; sabnzbd_newshosting_username = { format = "yaml"; sopsFile = ./secrets.yml; + owner = config.services.sabnzbd.user; }; sabnzbd_newshosting_password = { format = "yaml"; sopsFile = ./secrets.yml; + owner = config.services.sabnzbd.user; }; sabnzbd_newsgroup_direct_username = { format = "yaml"; sopsFile = ./secrets.yml; + owner = config.services.sabnzbd.user; }; sabnzbd_newsgroup_direct_password = { format = "yaml"; sopsFile = ./secrets.yml; - }; - - sabnzbd_supernews_username = { - format = "yaml"; - sopsFile = ./secrets.yml; - }; - - sabnzbd_supernews_password = { - format = "yaml"; - sopsFile = ./secrets.yml; + owner = config.services.sabnzbd.user; }; sabnzbd_xsnews_username = { format = "yaml"; sopsFile = ./secrets.yml; + owner = config.services.sabnzbd.user; }; sabnzbd_xsnews_password = { format = "yaml"; sopsFile = ./secrets.yml; + owner = config.services.sabnzbd.user; }; }; - - templates."sabnzbd/secrets.ini" = { - content = flake.lib.generators.toINI { - globalSection = { }; - sections = { - misc = { - password = config.sops.placeholder.sabnzbd_admin_password; - api_key = config.sops.placeholder.sabnzbd_api_key; - nzb_key = config.sops.placeholder.sabnzbd_nzb_key; - }; - servers = { - "news-us.newsgroup.ninja" = { - username = config.sops.placeholder.sabnzbd_newsgroup_ninja_username; - password = config.sops.placeholder.sabnzbd_newsgroup_ninja_password; - }; - "news.supernews.com" = { - username = config.sops.placeholder.sabnzbd_supernews_username; - password = config.sops.placeholder.sabnzbd_supernews_password; - }; - "reader.xsnews.nl" = { - username = config.sops.placeholder.sabnzbd_xsnews_username; - password = config.sops.placeholder.sabnzbd_xsnews_password; - }; - "news.newshosting.com" = { - username = config.sops.placeholder.sabnzbd_newshosting_username; - password = config.sops.placeholder.sabnzbd_newshosting_password; - }; - "news.newsgroupdirect.com" = { - username = config.sops.placeholder.sabnzbd_newsgroup_direct_username; - password = config.sops.placeholder.sabnzbd_newsgroup_direct_password; - }; - "news.eweka.nl" = { - username = config.sops.placeholder.sabnzbd_eweka_username; - password = config.sops.placeholder.sabnzbd_eweka_password; - }; - }; - }; - }; - owner = config.services.sabnzbd.user; - }; }; services.sabnzbd = { enable = true; openFirewall = true; configFile = null; - secretFiles = [ config.sops.templates."sabnzbd/secrets.ini".path ]; + secretValues = { + "@sabnzbd_admin_password@" = config.sops.secrets.sabnzbd_admin_password.path; + "@sabnzbd_api_key@" = config.sops.secrets.sabnzbd_api_key.path; + "@sabnzbd_nzb_key@" = config.sops.secrets.sabnzbd_nzb_key.path; + "@sabnzbd_newsgroup_ninja_username@" = config.sops.secrets.sabnzbd_newsgroup_ninja_username.path; + "@sabnzbd_newsgroup_ninja_password@" = config.sops.secrets.sabnzbd_newsgroup_ninja_password.path; + "@sabnzbd_xsnews_username@" = config.sops.secrets.sabnzbd_xsnews_username.path; + "@sabnzbd_xsnews_password@" = config.sops.secrets.sabnzbd_xsnews_password.path; + "@sabnzbd_newshosting_username@" = config.sops.secrets.sabnzbd_newshosting_username.path; + "@sabnzbd_newshosting_password@" = config.sops.secrets.sabnzbd_newshosting_password.path; + "@sabnzbd_newsgroup_direct_username@" = config.sops.secrets.sabnzbd_newsgroup_direct_username.path; + "@sabnzbd_newsgroup_direct_password@" = config.sops.secrets.sabnzbd_newsgroup_direct_password.path; + "@sabnzbd_eweka_username@" = config.sops.secrets.sabnzbd_eweka_username.path; + "@sabnzbd_eweka_password@" = config.sops.secrets.sabnzbd_eweka_password.path; + }; settings = { misc = { port = 8080; host = "0.0.0.0"; username = "admin"; + password = "@sabnzbd_admin_password@"; + api_key = "@sabnzbd_api_key@"; + nzb_key = "@sabnzbd_nzb_key@"; permissions = 777; download_dir = downloadDir; complete_dir = completeDir; @@ -148,6 +128,8 @@ in displayname = "news-us.newsgroup.ninja"; host = "news-us.newsgroup.ninja"; port = 563; + username = "@sabnzbd_newsgroup_ninja_username@"; + password = "@sabnzbd_newsgroup_ninja_password@"; connections = 40; ssl = true; ssl_verify = "strict"; @@ -156,23 +138,12 @@ in expire_date = "2026-10-29"; priority = 0; }; - "news.supernews.com" = { - name = "news.supernews.com"; - displayname = "news.supernews.com"; - host = "news.supernews.com"; - port = 119; - connections = 15; - ssl = false; - ssl_verify = "strict"; - enable = false; - required = false; - expire_date = ""; - priority = 0; - }; "reader.xsnews.nl" = { name = "reader.xsnews.nl"; displayname = "reader.xsnews.nl"; host = "reader.xsnews.nl"; + username = "@sabnzbd_xsnews_username@"; + password = "@sabnzbd_xsnews_password@"; port = 563; connections = 15; ssl = true; @@ -186,6 +157,8 @@ in name = "news.newshosting.com"; displayname = "news.newshosting.com"; host = "news.newshosting.com"; + username = "@sabnzbd_newshosting_username@"; + password = "@sabnzbd_newshosting_password@"; port = 563; connections = 100; ssl = true; @@ -199,6 +172,8 @@ in name = "news.newsgroupdirect.com"; displayname = "NewsgroupDirect"; host = "news.newsgroupdirect.com"; + username = "@sabnzbd_newsgroup_direct_username@"; + password = "@sabnzbd_newsgroup_direct_password@"; port = 563; connections = 8; ssl = true; @@ -213,6 +188,8 @@ in name = "news.eweka.nl"; displayname = "news.eweka.nl"; host = "news.eweka.nl"; + username = "@sabnzbd_eweka_username@"; + password = "@sabnzbd_eweka_password@"; port = 563; connections = 50; ssl = true; @@ -270,12 +247,4 @@ in ]; systemd.services.sabnzbd.unitConfig.RequiresMountsFor = [ "/mnt/blockbuster" ]; - - services.prometheus.exporters.exportarr-sabnzbd = { - enable = true; - url = "https://sabnzbd.e10.camp"; - openFirewall = true; - apiKeyFile = config.sops.secrets.sabnzbd_api_key.path; - port = 9712; - }; } diff --git a/modules/profiles/telemetry/prometheus-sabnzbd-exporter.nix b/modules/profiles/telemetry/prometheus-sabnzbd-exporter.nix new file mode 100644 index 0000000..838d70a --- /dev/null +++ b/modules/profiles/telemetry/prometheus-sabnzbd-exporter.nix @@ -0,0 +1,9 @@ +{ config, ... }: { + services.prometheus.exporters.exportarr-sabnzbd = { + enable = true; + url = "https://sabnzbd.e10.camp"; + openFirewall = true; + apiKeyFile = config.sops.secrets.sabnzbd_api_key.path; + port = 9712; + }; +} From 51d1d10ad05f733f50b2c55e5c6fb360f3b04dfb Mon Sep 17 00:00:00 2001 From: Ethan Turkeltaub Date: Sun, 13 Sep 2026 22:09:46 -0400 Subject: [PATCH 5/6] Migrate `prowlarr` to PostgreSQL, remove old `-arr` log databases --- hosts/htpc/configuration.nix | 4 +- .../media-management/bazarr/default.nix | 13 ---- .../media-management/prowlarr/default.nix | 44 +++++++++---- .../media-management/prowlarr/postgresql.nix | 21 +++++++ .../media-management/radarr/postgresql.nix | 42 ------------- .../media-management/sonarr/postgresql.nix | 42 ------------- modules/profiles/secrets/prowlarr/default.nix | 7 +++ .../profiles/secrets/prowlarr/secrets.json | 63 +++++++++++++++++++ .../telemetry/prometheus-bazarr-exporter.nix | 9 +++ .../prometheus-prowlarr-exporter.nix | 14 +++++ .../telemetry/prometheus-radarr-exporter.nix | 4 +- .../telemetry/prometheus-sonarr-exporter.nix | 4 +- 12 files changed, 154 insertions(+), 113 deletions(-) create mode 100644 modules/profiles/media-management/prowlarr/postgresql.nix create mode 100644 modules/profiles/secrets/prowlarr/default.nix create mode 100644 modules/profiles/secrets/prowlarr/secrets.json create mode 100644 modules/profiles/telemetry/prometheus-bazarr-exporter.nix create mode 100644 modules/profiles/telemetry/prometheus-prowlarr-exporter.nix diff --git a/hosts/htpc/configuration.nix b/hosts/htpc/configuration.nix index cce23f0..6ba27b1 100644 --- a/hosts/htpc/configuration.nix +++ b/hosts/htpc/configuration.nix @@ -29,11 +29,13 @@ profiles.media-management.wizarr profiles.services.attic-watch-store.default profiles.sharing.nfs-client + profiles.telemetry.prometheus-bazarr-exporter profiles.telemetry.prometheus-dcgm-exporter + profiles.telemetry.prometheus-plex-exporter.default + profiles.telemetry.prometheus-prowlarr-exporter profiles.telemetry.prometheus-radarr-exporter profiles.telemetry.prometheus-sabnzbd-exporter profiles.telemetry.prometheus-sonarr-exporter - profiles.telemetry.prometheus-plex-exporter.default profiles.virtualisation.docker ] ++ [ diff --git a/modules/profiles/media-management/bazarr/default.nix b/modules/profiles/media-management/bazarr/default.nix index 48298f0..50f3639 100644 --- a/modules/profiles/media-management/bazarr/default.nix +++ b/modules/profiles/media-management/bazarr/default.nix @@ -396,17 +396,4 @@ enable = true; openFirewall = true; }; - - systemd.services.bazarr = { - wants = [ "sops-nix.service" ]; - after = [ "sops-nix.service" ]; - }; - - services.prometheus.exporters.exportarr-bazarr = { - enable = true; - url = "https://bazarr.e10.camp"; - openFirewall = true; - apiKeyFile = config.sops.secrets.bazarr_api_key.path; - port = 9710; - }; } diff --git a/modules/profiles/media-management/prowlarr/default.nix b/modules/profiles/media-management/prowlarr/default.nix index 268d47b..c59cc18 100644 --- a/modules/profiles/media-management/prowlarr/default.nix +++ b/modules/profiles/media-management/prowlarr/default.nix @@ -1,21 +1,39 @@ -{ config, ... }: { - sops.secrets.prowlarr_api_key = { - sopsFile = ./secrets.json; - }; +{ config, profiles, ... }: { + imports = [ profiles.secrets.prowlarr.default ] ++ [ ./postgresql.nix ]; - services.prowlarr = { - enable = true; - openFirewall = true; + sops = { + templates."prowlarr/environment_file" = { + content = '' + PROWLARR__AUTH__APIKEY=${config.sops.placeholder.prowlarr_api_key} + ''; + mode = "0750"; + }; }; - services.prometheus.exporters.exportarr-prowlarr = { + services.prowlarr = { enable = true; - url = "https://prowlarr.e10.camp"; openFirewall = true; - apiKeyFile = config.sops.secrets.prowlarr_api_key.path; - environment = { - PROWLARR__BACKFILL = "true"; + environmentFiles = [ config.sops.templates."prowlarr/environment_file".path ]; + settings = { + postgres = { + host = "localhost"; + port = config.services.postgresql.settings.port; + maindb = "prowlarr"; + user = "prowlarr"; + password = ""; + }; + log = { + level = "info"; + dbenabled = false; + }; + auth = { + method = "Forms"; + required = "Enabled"; + }; + update = { + automatically = false; + mechanism = "external"; + }; }; - port = 9711; }; } diff --git a/modules/profiles/media-management/prowlarr/postgresql.nix b/modules/profiles/media-management/prowlarr/postgresql.nix new file mode 100644 index 0000000..0bcb2b4 --- /dev/null +++ b/modules/profiles/media-management/prowlarr/postgresql.nix @@ -0,0 +1,21 @@ +{ + profiles, + ... +}: +{ + imports = [ profiles.databases.postgresql ]; + + services.postgresqlBackup.databases = [ "prowlarr" ]; + + services.postgresql = { + ensureDatabases = [ + "prowlarr" + ]; + ensureUsers = [ + { + name = "prowlarr"; + ensureDBOwnership = true; + } + ]; + }; +} diff --git a/modules/profiles/media-management/radarr/postgresql.nix b/modules/profiles/media-management/radarr/postgresql.nix index 5e6e977..e9b6a98 100644 --- a/modules/profiles/media-management/radarr/postgresql.nix +++ b/modules/profiles/media-management/radarr/postgresql.nix @@ -1,7 +1,4 @@ { - config, - pkgs, - lib, profiles, ... }: @@ -13,7 +10,6 @@ services.postgresql = { ensureDatabases = [ "radarr" - "radarr_logs" ]; ensureUsers = [ { @@ -21,43 +17,5 @@ ensureDBOwnership = true; } ]; - - initialScriptText = lib.mkAfter '' - ALTER DATABASE radarr_logs OWNER TO radarr; - GRANT ALL PRIVILEGES ON DATABASE radarr_logs TO radarr; - GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO radarr; - GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO radarr; - ''; - }; - - systemd = { - services.radarr-logs-cleanup = { - description = "Deletes logs older than one day from radarr_logs table"; - after = [ "postgresql.service" ]; - wants = [ "postgresql.service" ]; - serviceConfig = { - ExecStart = lib.getExe ( - pkgs.writeShellApplication { - name = "radarr-logs-cleanup"; - runtimeInputs = [ - pkgs.sudo - config.services.postgresql.package - ]; - text = '' - sudo -u postgres psql --dbname="radarr_logs" --command="DELETE FROM \"Logs\" WHERE \"Time\" < now() - interval '24 hours'" - ''; - } - ); - }; - }; - - timers.radarr-logs-cleanup = { - description = "Timer for radarr-logs-cleanup service"; - timerConfig = { - OnCalendar = "04:00"; - Persistent = true; - }; - wantedBy = [ "timers.target" ]; - }; }; } diff --git a/modules/profiles/media-management/sonarr/postgresql.nix b/modules/profiles/media-management/sonarr/postgresql.nix index e1ae0ea..085e136 100644 --- a/modules/profiles/media-management/sonarr/postgresql.nix +++ b/modules/profiles/media-management/sonarr/postgresql.nix @@ -1,7 +1,4 @@ { - config, - pkgs, - lib, profiles, ... }: @@ -13,7 +10,6 @@ services.postgresql = { ensureDatabases = [ "sonarr" - "sonarr_logs" ]; ensureUsers = [ { @@ -21,43 +17,5 @@ ensureDBOwnership = true; } ]; - - initialScriptText = lib.mkAfter '' - ALTER DATABASE sonarr_logs OWNER TO sonarr; - GRANT ALL PRIVILEGES ON DATABASE sonarr_logs TO sonarr; - GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO sonarr; - GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO sonarr; - ''; - }; - - systemd = { - services.sonarr-logs-cleanup = { - description = "Deletes logs older than one day from sonarr_logs table"; - after = [ "postgresql.service" ]; - wants = [ "postgresql.service" ]; - serviceConfig = { - ExecStart = lib.getExe ( - pkgs.writeShellApplication { - name = "sonarr-logs-cleanup"; - runtimeInputs = [ - pkgs.sudo - config.services.postgresql.package - ]; - text = '' - sudo -u postgres psql --dbname="sonarr_logs" --command="DELETE FROM \"Logs\" WHERE \"Time\" < now() - interval '24 hours'" - ''; - } - ); - }; - }; - - timers.sonarr-logs-cleanup = { - description = "Timer for sonarr-logs-cleanup service"; - timerConfig = { - OnCalendar = "04:00"; - Persistent = true; - }; - wantedBy = [ "timers.target" ]; - }; }; } diff --git a/modules/profiles/secrets/prowlarr/default.nix b/modules/profiles/secrets/prowlarr/default.nix new file mode 100644 index 0000000..e5325c3 --- /dev/null +++ b/modules/profiles/secrets/prowlarr/default.nix @@ -0,0 +1,7 @@ +{ + sops.secrets = { + prowlarr_api_key = { + sopsFile = ./secrets.json; + }; + }; +} diff --git a/modules/profiles/secrets/prowlarr/secrets.json b/modules/profiles/secrets/prowlarr/secrets.json new file mode 100644 index 0000000..6f7010e --- /dev/null +++ b/modules/profiles/secrets/prowlarr/secrets.json @@ -0,0 +1,63 @@ +{ + "prowlarr_api_key": "ENC[AES256_GCM,data:gaH+ylAgKO4ZEN0KfHRVEXtwWj+44tYu5Hp0J40NGeA=,iv:Glx+e+T6hBJUM1pK8SD3nylfqdBDAx82YqfWGEb0wp8=,tag:nrz0OIsYtRwwdQHAeu3cWg==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6VGJtQ1ZkcjlCdTRHWnNQ\nQ0lNUEs4alcxZTdKK2lGYnYvdHBWWVlxOFhVCnJmVjhMSVhrRExnaCs5U0RhQXZL\nOEdENFdSYytuWFBMczdvWVRQTHl5cjgKLS0tIGJ1MERXSSs1OHo3MXR1b2tpTGM4\ncUhWT3c2V1Y4cDBPR1hIVkx5Z1hCQVUKKXG/Aus1Ym4h9HjT2Z0m1Kt0iO4EMWom\n3lBqcFDtW5NJzIvYlJjdkYYcrdlARJUk7UCrF0GsBy0XPbXYXJAjfg==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age10539mc6shf02hpa8huyjktdw3nfyavxdg8pt247wwvq4xrv8h5zs8nc0k0" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKN0tha2hPTXBMUWhDWHBk\nMlhFWXZuMjlWRkFpVUtkNWxFSkw2UTlUZldZCjQraU04VFM2Uzh2SzYzR2ZUcktm\nejROeTlWWTlwS1k1allJSWtVVXpXOEEKLS0tIFQwUXdtT0xDZ2wyRU1ZNHVkNmRs\nUHIrSnUyN3p0YVBKOC9ubDd6QmhBWncKb1kW7T/ltaCBCZ1jRrXQ17YwqCQqmfrF\nRpx+WMNfZLjqoE+YhClD/m1cZgGVT5Qw9YZ5LKNaqHVHegZBJMJTrg==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1g22ghnrdg858yv6w2ux8hgntj8gkdyjn28axdkmzyx38d4vx6geqj4px9a" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWOCtQaTlDOUVBb2VoYk9u\nM3pTWk1PNEpMUFpPbm1uV1p2YWlDa3lhNnlnCjJLc0FROEhySTd3V3RuOEc1RzhZ\ndzNYaDVhQ1hXTE5oVnhKNm85a3loR0UKLS0tIHJPNUF2QzRXY2N4TUZMSXV6WVBI\nL2NrSW85c0tKOWw3SGgrYjFOUEdKaTAK7ZWBZY3XUhrkeiuaTyqWoqVu8CcqcAlj\nxOKMUTuGyBwkANG+U5vbEApLOT0AOJ+KjL8yMc7uu0VDVfkj8e8/2A==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1k5nzxq4ej2u9ls97c2dhlz96j2vghv0assz5g0p4npzyc8c8fqlqld72hg" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5Nm5Zem4yTE1LV3p2RnQ2\nTHZNY3dLb2QxOTZWNnRIWlcyNzNqRDd3MWdrCnNic2NIS3pZR2FNWkZRT1hYc1ll\nT2dxeHNSYU1aYjRFV0h3aXo3emNnKzQKLS0tIHdaNis0elpLT0lPT1lhcUNiUFVk\nRlk4NHlQRlFYOXl0WUE4UGo0amtQd0UKVCkmcDe6rXeD6RIc5hmNWvD2sLKWpj06\nfpksYI4CyOPSXytAzx18SS/bjNCMaRWGNcF02ue35BgBYQip3CA+AA==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1gkzp905yqkla54l52m4xkqtxpn0sndkx0vh6qqa8d2tu29x8f35q354gpe" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBN2xuUE5EcjVhNXFHcCs0\nQ3cxdzVSTGNHZDh1TXFXS3BuUDAyQ3B3ZjJnCkpWTlpoN1lzTVZ4cEhNNFVUbnFQ\nK2tONGQ5WFlabGpGdE84amF2cmdQVmcKLS0tIEdBUHRIODkxUkV3NDJzV3NGTEtk\nZisrZjZtWXBaTUhIVmg4czV5ZzZuczQKX+2Y/IiKwBlXux3oRB/jl5hAHq5sMP5U\nrqqAABDZv8qq/6hZlWcY4rShl0UTFsLWtdW5ZzUjzGoNnwqsF3L+aA==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1c4d93hmawmx8nt8g2sjrxcngfl7qx7y6vwxpqqg7grrkhjen6fvstljgg9" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwRzA0Ykc1YklKUDFmeEtu\nZGhndXJTK3ZlKzg2NVdTUE1NRWd3aVhmVkNnClNnY3FnYlB4NnJaNTNrc1V6VVc2\neEYzYnBtckNUNVkxRGRsUG5YTXRNSWcKLS0tIGFITWYrVnQwSXVXUndCT3V2ZWxT\nSTRIUzJmUDNEUFlWNW96UXRGdnhJUWMK2d4wNmgxwo/l9Y+0g19C0uD2IEMVvSw+\nZVv70dTZWfxrOEKr7eKR2fnGh7PRFmUMwtyZTN34DhWT4CklngH9TA==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age15jjykch8km3l8atssu0n9us6d2xg58z0ds9s0djtdh9l954sud5szqxv29" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPTTVpTmJEVHBFcUUzeDNN\nYWp5eXZpb3JBRWdwZ1crdm8zTUhJVUpVa1NrCnZBUEJ1S2JTKytmSCsreGNMN0Q5\nTVBtZ0ZlbERNVjBHU2tVNndTbzhNUmsKLS0tIEVCS3RZMGlOenhPcVV5MWl1cXh1\nTjR1azE1VUlKd0dIVjdvRTFmOGc1T0kK/3SXd3MWpKPNB7HT0IAPz12fUplsBBDk\n+v5b5CC+706QhOB88yjJqucJSVc/wKGWW5gka1KLEldSLX5w1C0pLA==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age10jhawn266e3wr6rx0lndkl9a47ewtk6jgh35d2582uu2l7dtn4tqdqc29c" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrNWdKTjlpRlNSZXQ5cnhl\nVERDWWlIeWpZWnVUNnBpQ25jL0FQNWJGK1N3CnhyNk1YQjlsYko3MjdUNUtRSnJF\nOWticE04UVRBNUxoL2NCQ3ppWWJYZkUKLS0tIGRDamtUTVVCcmgrL0FRNmRaVUhy\nbXlPSis1Tm5kZXpvaGNzdTdleEU3dkkKDwI8+OM7tSVJ0e5Q8TpS95BOyKfY9088\nlFYGG+3ewLoYwAjbfdCN8bUPfl/sDWlOTGNx8P1DCbzaSyKog5ah2Q==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age12yvljlgg94z8qfwyezz6mtmrpldxvfcqwzsuyfekszu296fg6upseeyc0t" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrRWE5Q2dnUTBwd1ZTdU84\nQ2cxd1ZuS3FjcTVZR1BWaHBHU1lCZjRuQXdRCkMrNEZJRVJNeFJ6S0x4WWkyK3NE\nTzlsanRYSDREYStERDdwUktGRlJXclUKLS0tIHFzYThGUjRsN01NeUUwZ0xkMFBv\nNlhQMFppVFhPNU1waUVlWVhrYVlyVk0K89+0i76q7KvvUDeijAzQmGal8kQ5K4jM\neUshwgQZXLUhTu32+gdpfxEijHylFMzBHSIviVXfcH6d6goP1L/v2A==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age10zakwy8z5448vj7ur2h7vn8wfzvt2nxwq4pk4wx6cs34mlg58yasdjhc7l" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoK3hqUDJkK0JaNU43Y1Fv\nbjY2Q0FaM1pJMm5pTW5OUmFOZjVNSjdJU2hjCkJreWpEUjhxWVlpNzdvQmtLVE1u\nUG5PVzhxTytkeVFqMlMxdHhGN2o1QjQKLS0tIE4vSWtraEpaV0FvaVpZNmFpZ2NQ\nVXpmZGxBZVVJYUhSZlgybDNzbThucFUKorrpNaRzw2vI4hWTpeOSlFAacm7K8ot3\nkCbolMdJY+f9QlFGKaUq/LSKMOyCaA8ZUCcPvKa3lsFN0YbwLf2uaw==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age10q5gqw4gwts228ayanvalq7c93peqjdsfqcgevd7qr43u5rhnczs9u2ysj" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkZklNODA4VHpTSHMrdzRn\nNzhVUlRiUW5SbkZPc1NPNkNRVVRiZmtEekVzCjBuK0c5MmJ6QW9MYVlTWDFmMEFQ\nM3pwOUF2ZHd0OWVDdDdPdGZtd29WaHcKLS0tIHJWSEJqZGNYRTBDbXdERUI5UXNU\nd052UVkrYm9TM3lPbjVwMFp1MXZUaWsKVFzoNdZCKWoEC3C1yBm9ibB5VKhTpxfc\nBEjigul3rVXE0GVvvDMivVFUpM5YH0ISPpX3Eqjd167XWg4ulusI7Q==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1hxynjkmtgcu9lwejchkjfqjp484at589sznqkxk6weucp37p4p7qaj440h" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaUXk5YnpMUlo1TjBkMGJa\nSDJWMlpqbzNpRGpqMDg1ZEtYanFoZGZBTlRRCkZNU2daQmcxdWgvOXN3bE5tTHlz\nbzVralFaT2ZRNWlXazhobTJBNENnbDgKLS0tIE5sdER5SktYdjZ2NXBrSnJEQTBS\nL3JCa0lMczhyQ3kxNkQvQU1uZGhpSzAK0WNnujwjXKiuXUU9Nwr+uIatKokQHCpw\nHvDPZYssnPQkxCx/SwMfCgbO/5ZThMKSt1Vtk11mfR/nGBnukF5GqQ==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1dtf3ahstj5mhzcqf4d2zc54d5dds69ka32dqpmpsskyaz04dtshq9ryxat" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4TGVPY05jTGdxMkpSTDBO\nM0ZCTGpaWEdsUTRqYURrRDdtbXgwZjl6SnkwCkNpcVo2cXNOU2dHS2EyTVZZQzJv\naXZScW9zWldGVWpiamhoWHFGTUUrWDQKLS0tIDA1YytBSUdZTXl1V2JHd3pySEti\nZ01BV3Z0MGxidElHc213cU0xK1NqWHMKFagowa1z8Hnm1ajv7NlKmf5iGQa+NBWT\nQc4Vl7OAuR3I+0hsaRO1k7HsTpnfmSj01LOFBaxpbSid1JZJAgjRyw==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1px3aq87zcjgts5guc59fqn64zjkqzukdwce4a0ggza83n3atkcws4h5aww" + } + ], + "lastmodified": "2026-09-14T01:46:42Z", + "mac": "ENC[AES256_GCM,data:Ft3XAWe+wua8XMaMN3zSzOJ8oZfOrI+1zoIebNE3ZAGJ7RupXvpsQNIEbccAz70tp9s6cApuZ+9rNk8+LDnJywaEox9azMsPCVpjQQH0IDiXUrsM5//+Kn04gUSG2E1vsrWbMMHA9kdE5HxLq/+7uwNHAX5BFZMTm1NWaeYedTE=,iv:c9XhaV3+SrQfULFg9wKE2UK6h0Szypcek9weTP1MrKI=,tag:TqZriNenW2mpI/zlpHMchQ==,type:str]", + "unencrypted_suffix": "_unencrypted", + "version": "3.13.3" + } +} diff --git a/modules/profiles/telemetry/prometheus-bazarr-exporter.nix b/modules/profiles/telemetry/prometheus-bazarr-exporter.nix new file mode 100644 index 0000000..4351ccc --- /dev/null +++ b/modules/profiles/telemetry/prometheus-bazarr-exporter.nix @@ -0,0 +1,9 @@ +{ config, ... }: { + services.prometheus.exporters.exportarr-bazarr = { + enable = true; + url = "https://bazarr.e10.camp"; + openFirewall = true; + apiKeyFile = config.sops.secrets.bazarr_api_key.path; + port = 9710; + }; +} diff --git a/modules/profiles/telemetry/prometheus-prowlarr-exporter.nix b/modules/profiles/telemetry/prometheus-prowlarr-exporter.nix new file mode 100644 index 0000000..38a0ce5 --- /dev/null +++ b/modules/profiles/telemetry/prometheus-prowlarr-exporter.nix @@ -0,0 +1,14 @@ +{ config, profiles, ... }: { + imports = [ profiles.secrets.prowlarr.default ]; + + services.prometheus.exporters.exportarr-prowlarr = { + enable = true; + url = "https://prowlarr.e10.camp"; + openFirewall = true; + apiKeyFile = config.sops.secrets.prowlarr_api_key.path; + environment = { + PROWLARR__BACKFILL = "true"; + }; + port = 9711; + }; +} diff --git a/modules/profiles/telemetry/prometheus-radarr-exporter.nix b/modules/profiles/telemetry/prometheus-radarr-exporter.nix index e6bc310..f2b3dff 100644 --- a/modules/profiles/telemetry/prometheus-radarr-exporter.nix +++ b/modules/profiles/telemetry/prometheus-radarr-exporter.nix @@ -1,4 +1,6 @@ -{ config, ... }: { +{ config, profiles, ... }: { + imports = [ profiles.secrets.radarr.default ]; + services.prometheus.exporters.exportarr-radarr = { enable = true; url = "https://radarr.e10.camp"; diff --git a/modules/profiles/telemetry/prometheus-sonarr-exporter.nix b/modules/profiles/telemetry/prometheus-sonarr-exporter.nix index 3d5c970..84d1d1a 100644 --- a/modules/profiles/telemetry/prometheus-sonarr-exporter.nix +++ b/modules/profiles/telemetry/prometheus-sonarr-exporter.nix @@ -1,4 +1,6 @@ -{ config, ... }: { +{ config, profiles, ... }: { + imports = [ profiles.secrets.sonarr.default ]; + services.prometheus.exporters.exportarr-sonarr = { enable = true; url = "https://sonarr.e10.camp"; From cddfd1175c856fc4878bae03e8cd67c3e6102f41 Mon Sep 17 00:00:00 2001 From: Ethan Turkeltaub Date: Sun, 13 Sep 2026 22:17:00 -0400 Subject: [PATCH 6/6] Remove dead code --- lib/src/generators.nix | 133 ------------------ .../media-management/prowlarr/secrets.json | 63 --------- 2 files changed, 196 deletions(-) delete mode 100644 lib/src/generators.nix delete mode 100644 modules/profiles/media-management/prowlarr/secrets.json diff --git a/lib/src/generators.nix b/lib/src/generators.nix deleted file mode 100644 index 2120241..0000000 --- a/lib/src/generators.nix +++ /dev/null @@ -1,133 +0,0 @@ -# This is largely stolen from here: -# https://github.com/omares/nix-homelab/blob/12cb1c1b034be91a2b1e6e987930eccc7dfb0bb1/lib/generators.nix - -{ lib, ... }: -let - inherit (lib) fixedWidthString mapAttrsToList concatStringsSep; - inherit (lib.generators) toINIWithGlobalSection mkKeyValueDefault; - inherit (builtins) isAttrs isString; - - toXML = - { - spacing ? 2, - rootName ? "Root", - xmlns ? { - xsi = "http://www.w3.org/2001/XMLSchema-instance"; - xsd = "http://www.w3.org/2001/XMLSchema"; - }, - }: - let - indent = level: fixedWidthString (level * spacing) " " ""; - - makeXmlns = - if xmlns != { } then - concatStringsSep " " (mapAttrsToList (name: value: ''xmlns:${name}="${value}"'') xmlns) - else - ""; - - escapeValue = - value: - if (builtins.match ".*.*" value) != null then - value - else - builtins.replaceStrings - [ "&" "<" ">" "'" ''"'' ] - [ - "&" - "<" - ">" - "'" - """ - ] - value; - - makeValue = - level: value: - if builtins.isBool value then - (if value then "true" else "false") - else if builtins.isInt value then - toString value - else if builtins.isFloat value then - value - else if builtins.isString value then - escapeValue value - else if builtins.isNull value then - "" - else if builtins.isPath value then - toString value - else if builtins.isList value then - if value == [ ] then - "" - else - '' - - ${concatStringsSep "\n" ( - map ( - value: - if builtins.isAttrs value then - attrsToXML (level + 1) "" value - else - throw "List elements must be attribute sets" - ) value - )} - ${indent level}'' - else - throw "Unsupported type for value: ${builtins.typeOf value}"; - - makeTag = - level: tagName: value: - let - val = makeValue level value; - ind = indent level; - in - if val == "" then "${ind}<${tagName} />" else "${ind}<${tagName}>${val}"; - - makeElements = - level: attrs: - concatStringsSep "\n" ( - mapAttrsToList ( - tagName: value: - if builtins.isAttrs value then attrsToXML level tagName value else makeTag level tagName value - ) attrs - ); - - attrsToXML = - level: tagName: value: - let - ind = indent level; - in - if tagName == "" then - makeElements level value - else if builtins.isAttrs value then - '' - ${ind}<${tagName}> - ${makeElements (level + 1) value} - ${ind}'' - else - makeTag level tagName value; - in - attrs: '' - - <${rootName} ${makeXmlns}> - ${attrsToXML 1 "" attrs} - ''; - - toINI = - { globalSection, sections }: - toINIWithGlobalSection { - mkKeyValue = - k: v: - if isAttrs v then - '' - [[${k}]] - '' - + toINIWithGlobalSection { } { globalSection = v; } - else - mkKeyValueDefault { - mkValueString = v: if isString v then "${v}" else toString v; - } "=" k v; - } { inherit globalSection sections; }; -in -{ - inherit toXML toINI; -} diff --git a/modules/profiles/media-management/prowlarr/secrets.json b/modules/profiles/media-management/prowlarr/secrets.json deleted file mode 100644 index 1cc4567..0000000 --- a/modules/profiles/media-management/prowlarr/secrets.json +++ /dev/null @@ -1,63 +0,0 @@ -{ - "prowlarr_api_key": "ENC[AES256_GCM,data:RLZuB5dzoBMQzak6yVPpysfW8OBi06iTxxQseTilHow=,iv:MZ4dhwOiooT7uNEbsOvPN+RmNBpiVn2dm3qlu+hIVk0=,tag:ef3fcJlvkA4K20w9Zwo/lw==,type:str]", - "sops": { - "age": [ - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjRXh3TlpSWTc0a21CSURL\nWHAxd2cxdmFZZno5RzlxcGYybHVNOUQwcVhBCmJsdTUzSVIrZ05qTzhZVElTZnVS\naVhJOXdQL01vU200cWlXQjliT3N3UmsKLS0tIGp5elVGVENQNTFyOFk0S0lqeCto\nVXJ3aHR1WWRHaVVZclQ2TGJ0RnRYQ1UKRtnMNrWdCI2nrAh4HYERPEJmS9XGHs2e\nHHxs5KSmc4mPhxXmvMRvFBkqy/leLURqCUruUJ6dxOouTYF08tVbeA==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age10539mc6shf02hpa8huyjktdw3nfyavxdg8pt247wwvq4xrv8h5zs8nc0k0" - }, - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNNVUzNVVkRThjeFVWOCtL\naGoyczREcVU2U2JUTVFXcDZUeCtuYTRFNG5BCndlWXpQNEoyNGRVRE9Wc2tlSU8x\nekFjZXVtVEtxOG9KUGZuSzZGQkVXb2cKLS0tIC93MnFSSWJLMDZsdnVzTHZzMFl1\nQmsxR1gvUTdMeHhWRjQzZWxvbmY5Q3cKtOAvn9CJV44d+Kqkb+nUay9cHwLToEVV\nMjaEND0ySDU/I6SvG2czgEpi8769cOTK6vmgq7w4K73PS0diNzKf2A==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1g22ghnrdg858yv6w2ux8hgntj8gkdyjn28axdkmzyx38d4vx6geqj4px9a" - }, - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSaXBkbmYvd0NvajZscFlE\nS1ZuWFJubldKN2VoZy9hbnpyTHlkalFLckNNCjVUNVBFOEg5b2ttTDVBYjkrT0VC\nK0J4cytQNzJtRGtncDVsRFIvSmZKTEkKLS0tIDhBYUxra2gzT0JSeEJRMmo4Z1hi\nOFB0dDQyaUlxYVVULzRQakJmRkFvb0kKvsOXKW/MI3xP7raZPeNOjW4XlJJNwULY\nGXQYIu+oC9eB4+bQsvbhA2J/CoNtAC0+WQxUKJfYp5Z+VE3NwPBQxw==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1k5nzxq4ej2u9ls97c2dhlz96j2vghv0assz5g0p4npzyc8c8fqlqld72hg" - }, - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTcXNhN0NmRjZGS2F1REUv\nZVEvR1pGdVo1cGlnRUxoQ0ZYNXJKeE96bndzCjJncjJaT25ydFhMRjBxRVNtdkxl\nQ1RXbGp4Q0hOVk9NMzVBa1pydzV0aGMKLS0tIFh5T2syR1c3Vk9pcHUwVk1KRm85\nQWF5Ykl2cFZaeVI0emIxRk9MMUhVdGMKbePdH7bgn+gQjZOGT1x76T6X/erOQFHf\nC6cxtL9+EF3VV0RiULkDvIIvotAIzvMMss07ZuI3rpTov3hMXbWxTw==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1gkzp905yqkla54l52m4xkqtxpn0sndkx0vh6qqa8d2tu29x8f35q354gpe" - }, - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMUmxNeW1LU2hTOWVvZGxV\ncExDVXA0dWVZYzA2WVlKZ0plZ3ZIUWgwWWlVCi90Mklva3AyZDNZVSt3NE0zWms2\nZXQ1eGRmQlUva0RTOU1yd3RoSVROT1UKLS0tIGVhdDIxazM3REdoR1NXekZneXMx\nZXFZMUhmY3p0em8wRnhxK1I3am13Q0UKc25cKjQh1aARiLC8zibZWMlYcbQwX4rF\nx3EGJVWqG2aRdc8d1VSDmuZqBpSKLWn0jZNKEZ3Dn98KrGJqZR1JaA==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1c4d93hmawmx8nt8g2sjrxcngfl7qx7y6vwxpqqg7grrkhjen6fvstljgg9" - }, - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQTFdNQ2xsU3NGT2c5Ri94\nVndqMGY4RmJUbVdON3NMb1NwdFNHQ04yMno0CkxwWlFtcVJtckczWElOYjNRY0dG\nVWdtWGZGcmllZkdHK0JNUEtzQyt2cE0KLS0tIGxXRlVvd2V4b3BLMDIwcjVjZ0N5\nVkU2dEdvNXE1SVczOGF0dG16ZERCTjQKEveT4jwH6B9zfV36HCzN8FVRrphFGBFp\nab4xtqd34gRaqWwM3xuAfNWqd9RFTnhoXW0u8xopNfLr0ktMgwNTeA==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age15jjykch8km3l8atssu0n9us6d2xg58z0ds9s0djtdh9l954sud5szqxv29" - }, - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaSUgvODRPaGIrZ0xPamtN\nNVJxMXJsZ1F1WVB3ZTE0TVFmV093ZjN0UlhRCjNxaGZhZDMwS0g2OWJaN09oNE1k\nNXRDZWxaYTVQVWpPTmhNMFJoUXdpRnMKLS0tIGIxMC9sZFJkVTJGNWJLTVhoUUxp\ndXBvZUNIaEFqQzcyZEF1bXIwbkxTcmsKIYMOuB5Oa7gYWZkrKaFK0qNm6hHF2GnE\nJhHPm2PDIrNervttag59D/vLH14tTcOsTNhVn55zoiWHEN/jwImV+g==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age10jhawn266e3wr6rx0lndkl9a47ewtk6jgh35d2582uu2l7dtn4tqdqc29c" - }, - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0MTlSbmpvbFNuSHpzOGQ3\nSVZsMU9SNklab3FBazM1MDRJb0JRa0FqMmlrCnVDaUhYdERqcGJMeUhGaWpPSmZ0\nRE1waG1xMzg5V1VDOStCOGZhbjlpUzgKLS0tIG5aTlVvTlpvSFBKZ3BHbkZlZXN3\nbk9OTS9JM0MwRWY1U2VzWlJJdjNzbG8KAKwnqOR/MafbBmDcUffUUYxD9llysuna\n5U7vUcq4YGh2rMRV5L4jXWmCF+tR8AZxMdhJ9zFHEM7ZcJAG0yjgJA==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age12yvljlgg94z8qfwyezz6mtmrpldxvfcqwzsuyfekszu296fg6upseeyc0t" - }, - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjTWZLc1hMbHZQRHJxeHFw\nOHVKU3JJZFlOQm9YdTlaWm5qY2tkUEdsbjIwCjB6WkZXOGF1M3Z1QnRFalFOdTR5\nWDNuTUpCV2VwOVRGYXZlcmhKdjAzbjQKLS0tIDF2YUlIaWg1MGJ2YlpuZWtPM0pW\nOXc0UzlpdUM4d2dnT096U3BUTjdxVkUKtE2/Sjd2cG/cwIPViiZ3pdVDiAIPjmvq\ni5FssrJEGG8vtAd4datgXwNOXQ/n+7ejizrtcdvGvNY458BeKrCZeA==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age10zakwy8z5448vj7ur2h7vn8wfzvt2nxwq4pk4wx6cs34mlg58yasdjhc7l" - }, - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlbEdkZmpwOEZvVmNFeUFS\nSjFMS3RTQ0Y3aG5RcWg4eE9ma294ZEZIWjNzCit0NElVU2lHclhEM2NFeW9jeEpl\ndTJ5QUhjc0RrSW50cWhVTWpqbnNTVW8KLS0tIHVyQUZTOWQxbUhRZDJNZVJOd1Q3\nb0k5SHhCZVZrSURyMVc0eGEwdUpVWHMKSvvmovC/MQrjIDZsYhdNEFTo9LXx9I6g\no4I2eBhM54WWxaIPVrimVZcIAKXwcEv7aeVplo9P/8OCKaGWxudGTA==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age10q5gqw4gwts228ayanvalq7c93peqjdsfqcgevd7qr43u5rhnczs9u2ysj" - }, - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjR3pKcTU2VFNrMVZkeXVm\ncWt2VHg3RS9ENGlLWWxzMGlSbnc2cW9GcTAwCjRBeFFZcHBrRk1Hb0IySCtxNUV2\nK2N4TGFxMWdvZnl2WDFvcTBCdTNXVUEKLS0tIHlYeCtFZ2hleWlWclZZUDJ1L2dZ\nYXFVNXp5NkFRazJKdnV1emFlamgveVUKT55I2grw4lkzAHPjWiLr5AEKn/qM0AfQ\nNPooGPBF4mATCOuFLlYiNXrplm+FxBYNDoWZJ46sLVJOve3tG3MgAg==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1hxynjkmtgcu9lwejchkjfqjp484at589sznqkxk6weucp37p4p7qaj440h" - }, - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYSzgvQkhPU3VEWUNjanpX\nYW9nSWlHb1BQQnE2aGxGaXZnRUxOQ0psdTFVCnNEbEdnRkxqbTg1cW5JSHpBWXYz\nN0tuRTNnaU94Njd3MTZNRG9KcHZva1kKLS0tIEM3ZmlDM0FlVlc2WWt6cWJQZGp3\nNkFndk1IVENJdXhXTjk1RTVKV0xrcjQK5cc7PDphnw6EqlkepenR2FDcUWVMhXCy\n5/wWMvlJ4ecV7y7ZfHgqw7b8Qw9zEHsjBceH+K/Pf0QgUQWFPhcPLw==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1dtf3ahstj5mhzcqf4d2zc54d5dds69ka32dqpmpsskyaz04dtshq9ryxat" - }, - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvajhveENraGdzRS9uSko1\nZ0tTU0J6K291bXhQbGxFcS9Bc0Zjc2pOeUdvCm5vTXh0S1ZrMzBZTzh4SU1mcTJM\nT1ptcWlDTy8yeW9qK2R2V1VUM2FxUmsKLS0tIHlZdmkzVzF0amM4cW1MWFllY1d0\nYnFOcGUzOXczd3h0a2RWWXZhN0FYZ3cKtNexEX/7drFdP59qdE76vbGuVQjvdi7C\nKkhx6pORbfHJtskMUQ3PS9upDacAmay/Orv/E7Becswk24yIAwyYjA==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1px3aq87zcjgts5guc59fqn64zjkqzukdwce4a0ggza83n3atkcws4h5aww" - } - ], - "lastmodified": "2025-10-09T03:06:23Z", - "mac": "ENC[AES256_GCM,data:OhuukdOgILzgqFb0vdDbkgD8MVXiSqMUqXSykRM0ATWgN7Z8wjXfR/arMFJhA+APv7ZEWS3U58gtZCbmv1do5aJnxiffIx6IBOG2HjWjAkt34sWTsF84g1zWjYuzV587v28XxpqhGmToG7qUnVP8tvAFh0T22v4RuxeeFww9lsY=,iv:fcwznmmww5YeRNq/5cQbqgASu5fWjoOblmrwx2Vyoug=,tag:OnrVWvh725ARqeA6qkWPtg==,type:str]", - "unencrypted_suffix": "_unencrypted", - "version": "3.10.2" - } -}