overseerr: init at 1.34.0 (#399266)

    name = "Jez Cope";

    keys = [ { fingerprint = "D9DA 3E47 E8BD 377D A317  B3D0 9E42 CE07 1C45 59D1"; } ];

  };

  jf-uu = {

    github = "jf-uu";

    githubId = 181011550;

    name = "jf-uu";

  };

  jfchevrette = {

    email = "jfchevrette@gmail.com";

    github = "jfchevrette";

<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

- [Overseerr](https://overseerr.dev), a request management and media discovery tool for the Plex ecosystem. Available as [services.overseerr](#opt-services.overseerr.enable).

- [gtklock](https://github.com/jovanlanik/gtklock), a GTK-based lockscreen for Wayland. Available as [programs.gtklock](#opt-programs.gtklock.enable).

- [Chrysalis](https://github.com/keyboardio/Chrysalis), a graphical configurator for Kaleidoscope-powered keyboards. Available as [programs.chrysalis](#opt-programs.chrysalis.enable).

  ./services/misc/open-webui.nix

  ./services/misc/orthanc.nix

  ./services/misc/osrm.nix

  ./services/misc/overseerr.nix

  ./services/misc/owncast.nix

  ./services/misc/packagekit.nix

  ./services/misc/paisa.nix

{

  config,

  pkgs,

  lib,

  ...

}:

let

  cfg = config.services.overseerr;

in

{

  meta.maintainers = [ lib.maintainers.jf-uu ];

  options.services.overseerr = {

    enable = lib.mkEnableOption "Overseerr, a request management and media discovery tool for the Plex ecosystem";

    package = lib.mkPackageOption pkgs "overseerr" { };

    openFirewall = lib.mkOption {

      type = lib.types.bool;

      default = false;

      description = "Open a port in the firewall for the Overseerr web interface.";

    };

    port = lib.mkOption {

      type = lib.types.port;

      default = 5055;

      description = "The port which the Overseerr web UI should listen on.";

    };

  };

  config = lib.mkIf cfg.enable {

    systemd.services.overseerr = {

      description = "Request management and media discovery tool for the Plex ecosystem";

      after = [ "network.target" ];

      wantedBy = [ "multi-user.target" ];

      environment = {

        CONFIG_DIRECTORY = "/var/lib/overseerr";

        PORT = toString cfg.port;

      };

      serviceConfig = {

        CapabilityBoundingSet = "";

        DynamicUser = true;

        ExecStart = lib.getExe cfg.package;

        LockPersonality = true;

        NoNewPrivileges = true;

        PrivateDevices = true;

        PrivateIPC = true;

        PrivateMounts = true;

        PrivateTmp = true;

        PrivateUsers = true;

        ProcSubset = "pid";

        ProtectClock = true;

        ProtectControlGroups = true;

        ProtectHome = true;

        ProtectHostname = true;

        ProtectKernelLogs = true;

        ProtectKernelModules = true;

        ProtectKernelTunables = true;

        ProtectProc = "invisible";

        ProtectSystem = "strict";

        RemoveIPC = true;

        Restart = "on-failure";

        RestrictAddressFamilies = [

          "AF_INET"

          "AF_INET6"

          "AF_UNIX"

        ];

        RestrictNamespaces = true;

        RestrictRealtime = true;

        RestrictSUIDSGID = true;

        StateDirectory = "overseerr";

        StateDirectoryMode = "0700";

        SystemCallArchitectures = "native";

        SystemCallErrorNumber = "EPERM";

        SystemCallFilter = [

          "@system-service"

          "~@privileged"

          "~@resources"

        ];

        Type = "exec";

      };

    };

    networking.firewall = lib.mkIf cfg.openFirewall {

      allowedTCPPorts = [ cfg.port ];

    };

  };

}

  };

  oku = runTest ./oku.nix;

  oncall = runTest ./web-apps/oncall.nix;

  overseerr = runTest ./overseerr.nix;

  # 9pnet_virtio used to mount /nix partition doesn't support

  # hibernation. This test happens to work on x86_64-linux but

  # not on other platforms.