docs/boxes: Document deployed boxes

Add per-site and per-box inventories, consolidate shared network design, and relocate the switch and access-point references under the home site.
2026-08-01 23:52:57 +01:00
parent 43cf35d54e
commit a2f3410e42
40 changed files with 2285 additions and 66 deletions
@@ -0,0 +1,45 @@
+# kelder-acquisition
+
+The media acquisition stack for the kelder site — Transmission (forced over VPN), the *arrs
+and Jellyfin in one NixOS container.
+
+- **Source:** [`nixos/boxes/kelder/containers/acquisition/`](../../../../nixos/boxes/kelder/containers/acquisition)
+- **Host:** NixOS container on [`kelder`](../README.md)
+- **nixpkgs:** `mine`
+
+## Role
+
+### Transmission
+
+`transmission_4` is bound to the VPN wait-online unit and uses AirVPN's forwarded peer port. Upload,
+download and seed-ratio limits are configured in the service source. Downloads use
+`/mnt/media/downloads/torrents`, backed by the host's `/mnt/storage/media`.
+
+### Media services
+
+Jackett, Radarr and Sonarr share the `media` group with a group-writable umask. Jellyfin uses the
+host's bind-mounted `/dev/dri` with `intel-vaapi-driver` / `intel-ocl`; its user belongs to
+`render`.
+
+## Network assignments
+
+See the consolidated [network assignments](../../../networking.md#box-assignments) table (this box: `kelder-acquisition`).
+
+## Networking
+
+- `internal` assignment (name `acquisition-ctr`) on the host's `ctrs` bridge, MTU 1460 to
+  match the site WAN.
+- All non-site traffic goes over an AirVPN WireGuard tunnel (`vpn` netdev, AirVPN IE endpoint).
+  Policy rules keep traffic to and from the kelder prefixes on the main table and push everything
+  else through the VPN's dedicated table.
+- An nftables input chain drops new TCP connections from the VPN interface except the
+  Transmission peer port; the web UI ports (9091 Transmission, 9117 Jackett, 7878 Radarr,
+  8989 Sonarr, 8096 Jellyfin) are accepted from the site. When built as a dev VM, those ports
+  are forwarded to the host.
+- Sonarr still needs the EOL .NET 6 runtime, allowed via
+  `nixpkgs.config.permittedInsecurePackages`.
+
+## Notable config files
+
+- [`nixos/boxes/kelder/containers/acquisition/default.nix`](../../../../nixos/boxes/kelder/containers/acquisition/default.nix) — services and users.
+- [`nixos/boxes/kelder/containers/acquisition/networking.nix`](../../../../nixos/boxes/kelder/containers/acquisition/networking.nix) — AirVPN tunnel + firewall.