nixos-hypervisor/services/docker/default.nix

{
  config,
  pkgs,
  lib,
  ...
}: let
  cfg = config.services.vm_docker;
in {
  options.services.vm_docker = {
    enable = lib.mkEnableOption "Enable minimal config";
    pgsql_ip = lib.mkOption {
      type = lib.types.str;
      description = "docker database IP address";
    };
  };
  config = lib.mkIf cfg.enable {
    age.secrets = {
      docker-lapi-key = {
        file = ../../secrets/docker-lapi-key.age;
        owner = "crowdsec";
      };
      docker-gluetun-env = {
        file = ./secrets/docker-gluetun-env.age;
        owner = "tbarnouin";
      };
      docker-qbittorrent-env = {
        file = ./secrets/docker-qbittorrent-env.age;
        owner = "tbarnouin";
      };
    };
    users.users.tbarnouin.extraGroups = ["docker"];
    fileSystems = {
      "/mnt/docker-data" = {
        device = "/dev/disk/by-uuid/39fb44a4-5c01-4337-894f-a6a6f4212b10";
        fsType = "ext4";
      };
      "/mnt/media" = {
        device = "192.168.1.125:/BIGDATA";
        fsType = "nfs";
        options = [
          "x-systemd.automount"
          "noauto"
        ];
      };
    };
    services.crowdsec = {
      settings.lapi.credentialsFile = "${config.age.secrets.docker-lapi-key.path}";
      localConfig = {
        acquisitions = [
          {
            source = "journalctl";
            journalctl_filter = ["_SYSTEMD_UNIT=docker.service"];
            labels = {
              type = "syslog";
            };
          }
        ];
      };
    };
    virtualisation = {
      docker = {
        enable = true;
        autoPrune.enable = true;
        daemon.settings = {
          userland-proxy = false;
          metrics-addr = "0.0.0.0:9323";
          data-root = "/mnt/docker-data";
          ipv6 = false;
        };
      };
      oci-containers = {
        backend = "docker";
        containers = {
          "gluetun" = {
            autoStart = true;
            hostname = "gluetun";
            image = "ghcr.io/qdm12/gluetun:latest";
            environmentFiles = ["${config.age.secrets.docker-gluetun-env.path}"];
            environment = {
              "QBT_WEBUI_ENABLED" = "true";
              "TZ" = "Europe/Paris";
              "VPN_PORT_FORWARDING" = "on";
              "VPN_SERVICE_PROVIDER" = "protonvpn";
              "VPN_TYPE" = "wireguard";
            };
            volumes = [
              "gluetun_gluetun-config:/gluetun:rw"
            ];
            ports = [
              "8080:8080"
            ];
            log-driver = "journald";
            extraOptions = [
              "--cap-add=NET_ADMIN"
              "--device=/dev/net/tun:/dev/net/tun:rwm"
              "--health-cmd=[\"wget\", \"--spider\", \"-q\", \"http://google.com\"]"
              "--health-interval=30s"
              "--health-retries=3"
              "--health-timeout=10s"
              "--network-alias=gluetun"
              "--network=gluetun_default"
              "--sysctl=net.ipv6.conf.all.disable_ipv6=1"
            ];
          };
          "qbittorrent" = {
            autoStart = true;
            image = "lscr.io/linuxserver/qbittorrent:latest";
            environmentFiles = ["${config.age.secrets.docker-qbittorrent-env.path}"];
            environment = {
              "DOCKER_MODS" = "ghcr.io/t-anc/gsp-qbittorent-gluetun-sync-port-mod:main";
              "GSP_MINIMAL_LOGS" = "false";
              "PGID" = "1000";
              "PUID" = "1000";
              "QBITTORRENT_INTERFACE" = "tun0";
              "TZ" = "Europe/Paris";
              "WEBUI_PORT" = "8080";
            };
            volumes = [
              "/mnt/media/:/downloads:rw"
              "/home/tbarnouin/gluetun/qbittorrent/webui:/webui:rw"
              "gluetun_qbittorrent-config:/config:rw"
            ];
            dependsOn = [
              "gluetun"
            ];
            log-driver = "journald";
            extraOptions = ["--network=container:gluetun"];
          };
          "bazarr" = {
            image = "linuxserver/bazarr";
            environment = {
              "PGID" = "1000";
              "PUID" = "1000";
              "TZ" = "\"Europe/Paris\"";
            };
            volumes = [
              "/home/tbarnouin/bazarr:/config:rw"
              "/mnt/media:/downloads:rw"
            ];
            ports = [
              "6767:6767/tcp"
            ];
            log-driver = "journald";
          };
          "jellyseerr" = {
            image = "fallenbagel/jellyseerr:latest";
            environment = {
              "LOG_LEVEL" = "debug";
              "TZ" = "\"Europe/Paris\"";
            };
            volumes = [
              "/home/tbarnouin/jellyseerr:/app/config:rw"
            ];
            ports = [
              "5055:5055/tcp"
            ];
            log-driver = "journald";
          };
          "prowlarr" = {
            image = "lscr.io/linuxserver/prowlarr:latest";
            environment = {
              "PGID" = "1000";
              "PUID" = "1000";
              "TZ" = "\"Europe/Paris\"";
            };
            volumes = [
              "/home/tbarnouin/prowlarr:/config:rw"
              "/mnt/media:/downloads:rw"
            ];
            ports = [
              "9696:9696/tcp"
            ];
            log-driver = "journald";
            extraOptions = ["--dns=192.168.1.90"];
          };
          "radarr" = {
            image = "lscr.io/linuxserver/radarr:latest";
            environment = {
              "PGID" = "1000";
              "PUID" = "1000";
              "TZ" = "\"Europe/Paris\"";
            };
            volumes = [
              "/home/tbarnouin/radarr:/config:rw"
              "/mnt/media:/downloads:rw"
            ];
            ports = [
              "7878:7878/tcp"
            ];
            log-driver = "journald";
          };
          "sonarr" = {
            image = "lscr.io/linuxserver/sonarr:latest";
            environment = {
              "PGID" = "1000";
              "PUID" = "1000";
              "TZ" = "\"Europe/Paris\"";
            };
            volumes = [
              "/home/tbarnouin/sonarr:/config:rw"
              "/mnt/media:/downloads:rw"
            ];
            ports = [
              "8989:8989/tcp"
            ];
            log-driver = "journald";
          };
        };
      };
    };
  };
}