unpackerr: init

agenix/hosts/mediaserver/config.nix

@@ -31,5 +31,11 @@
       owner = "media_user";
       group = "media_group";
     };
+
+    unpackerr-config = {
+      file = ./unpackerr/config.age;
+      owner = "media_user";
+      group = "media_group";
+    };
   };
 }

secrets.nix

@@ -69,4 +69,6 @@ in
   "agenix/hosts/mediaserver/tubearchivist/environmentES.age".publicKeys = mediaserver;
 
   "agenix/hosts/mediaserver/aria2/config.age".publicKeys = mediaserver;
+
+  "agenix/hosts/mediaserver/unpackerr/config.age".publicKeys = mediaserver;
 }

system/hosts/mediaserver.nix

@@ -26,6 +26,7 @@ in
     (import ../nixos/wireguard-netns.nix (args // { inherit secret; }))
     (import ../nixos/wireguard-firewall-mediaserver.nix (args // { inherit secret; }))
     ../nixos/prowlarr.nix
+    ../nixos/unpackerr.nix
     ../nixos/sonarr.nix
     ../nixos/radarr.nix
     ../nixos/sabnzbd.nix

system/nixos/unpackerr.nix

@@ -0,0 +1,27 @@
+{ pkgs, config, ... }:
+
+{
+  systemd.services.unpackerr =
+    let
+      mounts = [ "mnt-downloads.mount" ];
+    in
+    {
+      description = "unpackerr service";
+      requires = mounts;
+      bindsTo = [ "wg.service" ];
+      after = [ "wg.service" ] ++ mounts;
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        User = "media_user";
+        Group = "media_group";
+        NetworkNamespacePath = "/var/run/netns/wg";
+        BindReadOnlyPaths = [
+          "/etc/netns/wg/resolv.conf:/etc/resolv.conf:norbind"
+          "/etc/netns/wg/nsswitch.conf:/etc/nsswitch.conf:norbind"
+        ];
+        ExecStart = "${pkgs.unpackerr}/bin/unpackerr --config ${config.age.secrets.unpackerr-config.path}";
+      };
+    };
+}