Commit 50b7400d authored by jf-uu's avatar jf-uu
Browse files

nixos/overseerr: init 



Co-authored-by: default avatarCarlos Alexandro Becker <caarlos0@users.noreply.github.com>
parent 4b81ba62

nixos/doc/manual/release-notes/rl-2511.section.md

+2 −0
Original line number Diff line number Diff line
@@ -16,6 +16,8 @@ 


<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->



- [Overseerr](https://overseerr.dev), a request management and media discovery tool for the Plex ecosystem. Available as [services.overseerr](#opt-services.overseerr.enable).



- [gtklock](https://github.com/jovanlanik/gtklock), a GTK-based lockscreen for Wayland. Available as [programs.gtklock](#opt-programs.gtklock.enable).

- [Chrysalis](https://github.com/keyboardio/Chrysalis), a graphical configurator for Kaleidoscope-powered keyboards. Available as [programs.chrysalis](#opt-programs.chrysalis.enable).

nixos/modules/module-list.nix

+1 −0
Original line number Diff line number Diff line
@@ -878,6 +878,7 @@ 
  ./services/misc/open-webui.nix

  ./services/misc/orthanc.nix

  ./services/misc/osrm.nix

  ./services/misc/overseerr.nix

  ./services/misc/owncast.nix

  ./services/misc/packagekit.nix

  ./services/misc/paperless.nix

nixos/modules/services/misc/overseerr.nix

0 → 100644
+89 −0
Original line number Diff line number Diff line 
{

  config,

  pkgs,

  lib,

  ...

}:



let

  cfg = config.services.overseerr;

in

{

  meta.maintainers = [ lib.maintainers.jf-uu ];



  options.services.overseerr = {

    enable = lib.mkEnableOption "Overseerr, a request management and media discovery tool for the Plex ecosystem";



    package = lib.mkPackageOption pkgs "overseerr" { };



    openFirewall = lib.mkOption {

      type = lib.types.bool;

      default = false;

      description = "Open a port in the firewall for the Overseerr web interface.";

    };



    port = lib.mkOption {

      type = lib.types.port;

      default = 5055;

      description = "The port which the Overseerr web UI should listen on.";

    };

  };



  config = lib.mkIf cfg.enable {

    systemd.services.overseerr = {

      description = "Request management and media discovery tool for the Plex ecosystem";

      after = [ "network.target" ];

      wantedBy = [ "multi-user.target" ];

      environment = {

        CONFIG_DIRECTORY = "/var/lib/overseerr";

        PORT = toString cfg.port;

      };

      serviceConfig = {

        CapabilityBoundingSet = "";

        DynamicUser = true;

        ExecStart = lib.getExe cfg.package;

        LockPersonality = true;

        NoNewPrivileges = true;

        PrivateDevices = true;

        PrivateIPC = true;

        PrivateMounts = true;

        PrivateTmp = true;

        PrivateUsers = true;

        ProcSubset = "pid";

        ProtectClock = true;

        ProtectControlGroups = true;

        ProtectHome = true;

        ProtectHostname = true;

        ProtectKernelLogs = true;

        ProtectKernelModules = true;

        ProtectKernelTunables = true;

        ProtectProc = "invisible";

        ProtectSystem = "strict";

        RemoveIPC = true;

        Restart = "on-failure";

        RestrictAddressFamilies = [

          "AF_INET"

          "AF_INET6"

          "AF_UNIX"

        ];

        RestrictNamespaces = true;

        RestrictRealtime = true;

        RestrictSUIDSGID = true;

        StateDirectory = "overseerr";

        StateDirectoryMode = "0700";

        SystemCallArchitectures = "native";

        SystemCallErrorNumber = "EPERM";

        SystemCallFilter = [

          "@system-service"

          "~@privileged"

          "~@resources"

        ];

        Type = "exec";

      };

    };



    networking.firewall = lib.mkIf cfg.openFirewall {

      allowedTCPPorts = [ cfg.port ];

    };

  };

}

nixos/tests/all-tests.nix

+1 −0
Original line number Diff line number Diff line
@@ -688,6 +688,7 @@ in 
    _module.args.package = pkgs.odoo16;

  };

  oncall = runTest ./web-apps/oncall.nix;

  overseerr = runTest ./overseerr.nix;

  # 9pnet_virtio used to mount /nix partition doesn't support

  # hibernation. This test happens to work on x86_64-linux but

  # not on other platforms.

nixos/tests/overseerr.nix

0 → 100644
+20 −0
Original line number Diff line number Diff line 
{ lib, pkgs, ... }:

{

  name = "overseerr";

  meta.maintainers = with lib.maintainers; [ jf-uu ];



  nodes.machine =

    { pkgs, ... }:

    {

      environment.systemPackages = [ pkgs.jq ];

      services.overseerr.enable = true;

    };



  testScript = ''

    machine.wait_for_unit("overseerr.service")

    machine.wait_for_open_port(5055)



    version = machine.succeed("curl --fail http://localhost:5055/api/v1/status | jq --raw-output .version").rstrip("\n")

    assert version == "${pkgs.overseerr.version}", f"expected version to be ${pkgs.overseerr.version}, got {version}"

  '';

}