backwards: Enable jellyseerr for jellyfin

hosts/backwards/modules/default.nix

@@ -12,6 +12,7 @@ in
 
       ssh.enable = true;
       git.enable = true;
+      nginx.enable = true;
       syncthing.enable = true;
       restic.enable = true;
       transmission.enable = true;

hosts/backwards/modules/jellyfin/default.nix

@@ -1,4 +1,12 @@
-{ pkgs, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  nginxEnabled = config.mod.nginx.enable;
+in
 {
   fileSystems."/home/alex/media" = {
     device = "/dev/disk/by-uuid/ad4acc0f-172c-40f8-8473-777c957e8764";
@@ -26,14 +34,49 @@
     };
   };
 
-  services.jellyfin = {
-    enable = true;
-    openFirewall = true;
+  services = {
+    jellyfin = {
+      enable = true;
+      openFirewall = true;
 
-    user = "alex";
-    group = "users";
+      user = "alex";
+      group = "users";
 
-    dataDir = "/home/alex/media/jellyfin";
+      dataDir = "/home/alex/media/jellyfin";
+    };
+
+    prowlarr.enable = true;
+
+    sonarr = {
+      enable = true;
+
+      user = "alex";
+      group = "users";
+    };
+
+    radarr = {
+      enable = true;
+
+      user = "alex";
+      group = "users";
+    };
+
+    jellyseerr.enable = true;
+
+    nginx = lib.mkIf nginxEnabled {
+      virtualHosts."jelly.ppp.pm" = {
+        locations = {
+          "/" = {
+            proxyPass = "http://127.0.0.1:8096";
+          };
+
+          "/socket" = {
+            proxyPass = "http://127.0.0.1:8096";
+            proxyWebsockets = true;
+          };
+        };
+      };
+    };
   };
 
   environment.systemPackages = [

hosts/backwards/modules/nginx/default.nix

@@ -0,0 +1,22 @@
+{ lib, config, ... }:
+let
+  enabled = config.mod.nginx.enable;
+in
+{
+  options = {
+    mod.nginx = {
+      enable = lib.mkEnableOption "Enable nginx module";
+    };
+  };
+
+  config = lib.mkIf enabled {
+    services = {
+      nginx = {
+        enable = true;
+
+        recommendedProxySettings = true;
+        recommendedTlsSettings = true;
+      };
+    };
+  };
+}

hosts/backwards/modules/transmission/default.nix

@@ -6,6 +6,8 @@
 }:
 let
   enabled = config.mod.transmission.enable;
+
+  nginxEnabled = config.mod.nginx.enable;
 in
 {
   options = {
@@ -42,6 +44,14 @@ in
           rpc-password = "{55d884e4042db67313da49e05d7089a368eb64b3Br.3X.Xi";
         };
       };
+
+      nginx = lib.mkIf nginxEnabled {
+        virtualHosts."ts.ppp.pm" = {
+          locations."/" = {
+            proxyPass = "http://localhost:9191";
+          };
+        };
+      };
     };
   };
 }

hosts/tadpole/modules/certs/default.nix

@@ -1,16 +1,20 @@
 { ... }:
 {
   security.acme = {
+    acceptTerms = true;
+
+    defaults = {
+      email = "acme@ppp.pm";
+    };
+
     certs = {
       "ppp.pm" = {
         webroot = "/var/lib/acme/acme-challenge/";
-        email = "p@ppp.pm";
         group = "nginx";
       };
 
       "git.ppp.pm" = {
         webroot = "/var/lib/acme/acme-challenge/";
-        email = "p@ppp.pm";
         group = "nginx";
       };
     };

hosts/tadpole/modules/gitea/default.nix

@@ -43,14 +43,6 @@ in
         assertion = conf.baseDomain != "";
         message = "Option 'mod.gitea.baseDomain' cannot be empty";
       }
-      {
-        assertion = builtins.hasAttr gitDomain config.security.acme.certs;
-        message = "There is no cert configured for ${gitDomain} used by gitea";
-      }
-      {
-        assertion = conf.webfingerEnable && builtins.hasAttr conf.baseDomain config.security.acme.certs;
-        message = "There is no cert configured for ${conf.baseDomain} used by webfinger";
-      }
       {
         assertion = conf.webfingerEnable && conf.webfingerAccounts != [ ];
         message = "Option 'mod.gitea.webfingerAccounts' cannot be empty";

hosts/tadpole/modules/nginx/default.nix

@@ -10,16 +10,6 @@ in
   };
 
   config = lib.mkIf enabled {
-    security = {
-      acme = {
-        acceptTerms = true;
-
-        defaults = {
-          email = "p@ppp.pm";
-        };
-      };
-    };
-
     services = {
       nginx = {
         enable = true;