jackos1998
a2f3410e42
Add per-site and per-box inventories, consolidate shared network design, and relocate the switch and access-point references under the home site.
2.1 KiB
2.1 KiB
kelder-acquisition
The media acquisition stack for the kelder site — Transmission (forced over VPN), the *arrs and Jellyfin in one NixOS container.
- Source:
nixos/boxes/kelder/containers/acquisition/ - Host: NixOS container on
kelder - nixpkgs:
mine
Role
Transmission
transmission_4 is bound to the VPN wait-online unit and uses AirVPN's forwarded peer port. Upload,
download and seed-ratio limits are configured in the service source. Downloads use
/mnt/media/downloads/torrents, backed by the host's /mnt/storage/media.
Media services
Jackett, Radarr and Sonarr share the media group with a group-writable umask. Jellyfin uses the
host's bind-mounted /dev/dri with intel-vaapi-driver / intel-ocl; its user belongs to
render.
Network assignments
See the consolidated network assignments table (this box: kelder-acquisition).
Networking
internalassignment (nameacquisition-ctr) on the host'sctrsbridge, MTU 1460 to match the site WAN.- All non-site traffic goes over an AirVPN WireGuard tunnel (
vpnnetdev, AirVPN IE endpoint). Policy rules keep traffic to and from the kelder prefixes on the main table and push everything else through the VPN's dedicated table. - An nftables input chain drops new TCP connections from the VPN interface except the Transmission peer port; the web UI ports (9091 Transmission, 9117 Jackett, 7878 Radarr, 8989 Sonarr, 8096 Jellyfin) are accepted from the site. When built as a dev VM, those ports are forwarded to the host.
- Sonarr still needs the EOL .NET 6 runtime, allowed via
nixpkgs.config.permittedInsecurePackages.
Notable config files
nixos/boxes/kelder/containers/acquisition/default.nix— services and users.nixos/boxes/kelder/containers/acquisition/networking.nix— AirVPN tunnel + firewall.