migrate media services to pocketid

fili/services/media/jackett.nix

@@ -11,6 +11,10 @@ _: {
     };
   };
 
+  services.oauth2-proxy.nginx.virtualHosts."jackett.donsz.nl" = {
+    allowed_groups = [ "torrent" ];
+  };
+
   services.jackett = {
     enable = true;
     group = "jellyfin";

fili/services/media/overseerr.nix

@@ -3,15 +3,20 @@ let
   port = 11002;
 in
 {
-  config.networking.firewall.allowedTCPPorts = [ port ];
+  services.nginx.virtualHosts."req.donsz.nl" = {
+    forceSSL = true;
+    http2 = true;
+    enableACME = true;
 
-  config.virtualisation.oci-containers.containers = {
+    locations."/" = {
+      proxyPass = "http://[::1]:${toString port}";
+    };
+  };
+
+  virtualisation.oci-containers.containers = {
     overseerr = {
-      image = "mirror.gcr.io/fallenbagel/jellyseerr:develop";
+      image = "ghcr.io/fallenbagel/jellyseerr:preview-seerr";
       environment = {
-        PORT = "5555";
-        TZ = "Europe/Amsterdam";
-        LOG_LEVEL = "debug";
       };
       extraOptions = [ "--network=host" ];
       volumes = [

fili/services/media/radarr.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ pkgs, ... }:
 {
   services.nginx = {
     virtualHosts."radarr.donsz.nl" = {
@@ -11,10 +11,19 @@
       };
     };
   };
+  services.oauth2-proxy.nginx.virtualHosts."radarr.donsz.nl" = {
+    allowed_groups = [ "torrent" ];
+  };
 
   services.radarr = {
     enable = true;
     group = "jellyfin";
     user = "jellyfin";
+
+    environmentFiles = [
+      (pkgs.writeText "env" ''
+        RADARR__AUTH__METHOD="External"
+      '')
+    ];
   };
 }

fili/services/media/sonarr.nix

@@ -1,4 +1,5 @@
-_: {
+{ pkgs, ... }:
+{
   services.nginx = {
     virtualHosts."sonarr.donsz.nl" = {
       forceSSL = true;
@@ -10,10 +11,19 @@ _: {
       };
     };
   };
+  services.oauth2-proxy.nginx.virtualHosts."sonarr.donsz.nl" = {
+    allowed_groups = [ "torrent" ];
+  };
 
   services.sonarr = {
     enable = true;
     group = "jellyfin";
     user = "jellyfin";
+
+    environmentFiles = [
+      (pkgs.writeText "env" ''
+        SONARR__AUTH__METHOD="External"
+      '')
+    ];
   };
 }

fili/services/media/torrent.nix

@@ -78,7 +78,9 @@
       };
     };
   };
-  services.oauth2-proxy.nginx.virtualHosts."dl.donsz.nl" = { };
+  services.oauth2-proxy.nginx.virtualHosts."dl.donsz.nl" = {
+    allowed_groups = [ "torrent" ];
+  };
 
   systemd.services.transmission.vpnConfinement = {
     enable = true;