commit 18f7029c607f443d9e2776ca887e8461da4b7da3
parent 1e27f748eaec6a51225376e4c267e0dd07dd035d
Author: mtmn <miro@haravara.org>
Date: Mon, 15 Jun 2026 15:24:26 +0200
nix: install mstream and tailscale, add mounts
Diffstat:
5 files changed, 108 insertions(+), 15 deletions(-)
diff --git a/flake.lock b/flake.lock
@@ -30,11 +30,11 @@
"nixpkgs": "nixpkgs_2"
},
"locked": {
- "lastModified": 1780956307,
- "narHash": "sha256-HVVt811sIXdh9EXGoexYGiN5U4OnFU7wBHog1mOgw3c=",
+ "lastModified": 1781514792,
+ "narHash": "sha256-iUj6N/n4cLgtU39lprmR+tLMydcBfx6hk1uV/XwDfTM=",
"owner": "~mtmn",
"repo": "corpus",
- "rev": "bd34fb0f2b3f4a38641d10832d87356025c4cb58",
+ "rev": "c4b7ce378af0cfffac7da1830a9a4f093e9e449c",
"type": "sourcehut"
},
"original": {
@@ -162,11 +162,11 @@
]
},
"locked": {
- "lastModified": 1781365335,
- "narHash": "sha256-zqDBhXMzfbdlO7F2bGHe7MOtB3xngd/+4ieMHDC+ZXo=",
+ "lastModified": 1781497404,
+ "narHash": "sha256-9GAF8sSsnkyCVCWkomXR0T+zdSxyUlfPt6neQidimdg=",
"owner": "nix-community",
"repo": "home-manager",
- "rev": "5b6f5733726a1b2ccafb5dec6ac4ca7299fad66c",
+ "rev": "1285cd3d6882a9847f2d56ed5541b3350c8a6162",
"type": "github"
},
"original": {
@@ -204,11 +204,11 @@
]
},
"locked": {
- "lastModified": 1780816331,
- "narHash": "sha256-0BYqs8yKWkOz2Q7+SP18N5E5gmDKSo6LSxIVIa0wWes=",
+ "lastModified": 1781422160,
+ "narHash": "sha256-W7S8O86bVrw2gaomEwkHStOzmPpnFIHQ6lS4Q2HffJ0=",
"owner": "nix-community",
"repo": "nix-index-database",
- "rev": "1a2ea89c917781e88508d9fd2b507f2d2a0e173c",
+ "rev": "854d04e2368fb2e9c328a36b3c0a04cd713bfae1",
"type": "github"
},
"original": {
@@ -248,11 +248,11 @@
},
"nixpkgs_3": {
"locked": {
- "lastModified": 1781268102,
- "narHash": "sha256-Zn5KTggEmUB3lXn/ccERNcBdddE6IaOFber9dWViWDg=",
+ "lastModified": 1781359544,
+ "narHash": "sha256-iUuzKQcyXvopYDDzFpMK5eQKP3WIJExYny2kJtbgUcE=",
"owner": "NixOS",
"repo": "nixpkgs",
- "rev": "49a4bd0573c376468dd7996ddb6f9fa31d8c4d97",
+ "rev": "9f11f828c213641c2369a9f1fa31fe31557e3156",
"type": "github"
},
"original": {
@@ -339,11 +339,11 @@
"nixpkgs": "nixpkgs_4"
},
"locked": {
- "lastModified": 1780842058,
- "narHash": "sha256-TjFF6u2oLNVquIfULWSe7GGM3ykAi81E2ZcQqO0lrM8=",
+ "lastModified": 1781464860,
+ "narHash": "sha256-kTMFjOkRPLasH94jftbhAoA7b2oWJZ4vTNQ4nXriM3g=",
"owner": "~mtmn",
"repo": "shirts",
- "rev": "5ac9ddab9fd230787fd4d822e778aefda3d129c8",
+ "rev": "b9b5c7125ee3123cf18cd1234b3366df7e8b5164",
"type": "sourcehut"
},
"original": {
diff --git a/hosts/nixaran/configuration.nix b/hosts/nixaran/configuration.nix
Binary files differ.
diff --git a/modules/services/mstream.nix b/modules/services/mstream.nix
@@ -0,0 +1,92 @@
+{
+ config,
+ lib,
+ haravara,
+ ...
+}: let
+ cfg = config.services.haravara.mstream;
+in {
+ options.services.haravara.mstream = {
+ enable = lib.mkEnableOption "mStream music streaming server";
+
+ port = lib.mkOption {
+ type = lib.types.port;
+ default = 3000;
+ description = "Host port to expose mStream on (container listens on 3000)";
+ };
+
+ domain = lib.mkOption {
+ type = lib.types.str;
+ description = "Domain for the mStream instance";
+ };
+
+ musicDir = lib.mkOption {
+ type = lib.types.str;
+ default = "/srv/mstream";
+ description = ''
+ Shared music library on the host. Mounted read-write because mStream
+ writes uploaded tracks here. Created and owned by the mstream user.
+ '';
+ };
+
+ dataDir = lib.mkOption {
+ type = lib.types.str;
+ default = "/var/lib/haravara/mstream";
+ description = "Directory for mStream state";
+ };
+
+ uid = lib.mkOption {
+ type = lib.types.int;
+ default = 992;
+ description = "uid for the mstream user";
+ };
+
+ gid = lib.mkOption {
+ type = lib.types.int;
+ default = 992;
+ description = "gid for the mstream group";
+ };
+
+ authLabel = haravara.authLabelOption;
+ };
+
+ config = lib.mkIf cfg.enable {
+ virtualisation.oci-containers = {
+ backend = "podman";
+
+ containers.mstream = {
+ image = "lscr.io/linuxserver/mstream@sha256:bede502eb4717fc2f25a7ec917d9f4bf63fce5bf18cbaca46aced1ddf8e8d2c3";
+ ports = ["127.0.0.1:${toString cfg.port}:3000"];
+ volumes = [
+ "${cfg.dataDir}:/config"
+ # rshared so the geesefs FUSE mount is visible inside the container
+ "${cfg.musicDir}:/music:rshared"
+ ];
+ environment = {
+ PUID = toString cfg.uid;
+ PGID = toString cfg.gid;
+ TZ = config.time.timeZone;
+ };
+ };
+ };
+
+ # musicDir is a geesefs mount managed elsewhere; only create the state dir.
+ systemd.tmpfiles.rules = [
+ "d ${cfg.dataDir} 0750 mstream mstream -"
+ ];
+
+ users = {
+ users.mstream = {
+ isSystemUser = true;
+ group = "mstream";
+ inherit (cfg) uid;
+ };
+ groups.mstream = {inherit (cfg) gid;};
+ };
+
+ services.caddy.virtualHosts."${cfg.domain}".extraConfig = ''
+ ${haravara.mkAuthImport cfg.authLabel}
+ reverse_proxy 127.0.0.1:${toString cfg.port}
+ '';
+ };
+}
diff --git a/secrets.nix b/secrets.nix
@@ -17,4 +17,5 @@ in {
"secrets/corpus.age".publicKeys = allKeys;
"secrets/smtp-alerts-password.age".publicKeys = allKeys;
"secrets/shirts-auth-token.age".publicKeys = allKeys;
+ "secrets/rclone-garage.age".publicKeys = allKeys;
}
diff --git a/secrets/rclone-garage.age b/secrets/rclone-garage.age
Binary files differ.
