dev/nixfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity
Files
docs-kimi-new
nixfiles/docs/remote/kelder-acquisition.md
T
jackos1998 d51f2d62b6 docs: Document the deployment 
Add a top-level README mapping the boxes and a full docs/ tree: topic
pages (architecture, networking, deployment), per-site box pages for
colony and home with containers nested under their hosts, remote and
mobile boxes, the installer, and the home switch fabric reference
(folded in from home-switches.md, with AGENTS.md and code comments
retargeted to its new home). Box pages carry marked assignment tables
that CI regenerates from nixos.allAssignments.

AGENTS.md points at the new docs and keeps its terse agent version of
the mechanics, referring to the topic pages for depth.
2026-07-26 19:16:43 +01:00

2.4 KiB
Raw Permalink Blame History

kelder-acquisition

The media acquisition stack for the kelder site — Transmission (forced over VPN), the *arrs and Jellyfin in one NixOS container.

Role

  • Transmission (transmission_4) — BitTorrent client bound to the VPN (bindsTo systemd-networkd-wait-online@vpn.service); peer port 26180 (forwarded in the AirVPN config), 20 MiB/s down / 1 MiB/s up limits, ratio limit 2.0. Downloads land in /mnt/media/downloads/torrents (/mnt/media is bind-mounted from the host's /mnt/storage/media).
  • Jackett, Radarr, Sonarr — indexer + media managers, in the shared media group with UMask 0002.
  • Jellyfin — streaming with Intel hardware transcoding: /dev/dri is bind-mounted from the host, intel-vaapi-driver/intel-ocl are installed and the jellyfin user is in the render group.

Network assignments

Name Assignment IPv4 IPv6 Domain Notes
acquisition-ctr internal 172.16.64.2/24 gw 172.16.64.1 — hentai.engineer

Networking

  • internal assignment (name acquisition-ctr) on the host's ctrs bridge, MTU 1460 to match the site WAN.
  • All non-site traffic goes over an AirVPN WireGuard tunnel (vpn netdev, MTU 1320, AirVPN IE endpoint) using fwmark 42 / route table 51820: policy rules keep traffic to and from the kelder prefixes on the main table and push everything else via the VPN.
  • An nftables input chain drops new TCP connections from the VPN interface except the Transmission peer port; the web UI ports (9091 Transmission, 9117 Jackett, 7878 Radarr, 8989 Sonarr, 8096 Jellyfin) are accepted from the site. When built as a dev VM, those ports are forwarded to the host.
  • Sonarr still needs the EOL .NET 6 runtime, allowed via nixpkgs.config.permittedInsecurePackages.

Notable config files

Reference in New Issue View Git Blame Copy Permalink