88 lines
2.4 KiB
Nix
88 lines
2.4 KiB
Nix
|
{ config, lib, pkgs, ... }:
|
||
|
|
|
||
|
|
with lib;
|
||
|
|
|
||
|
|
let
|
||
|
|
name = "roon-server";
|
||
|
|
cfg = config.services.roon-server;
|
||
|
|
in {
|
||
|
|
options = {
|
||
|
|
services.roon-server = {
|
||
|
|
enable = mkEnableOption "Roon Server";
|
||
|
|
package = lib.mkPackageOption pkgs "roon-server" { };
|
||
|
|
openFirewall = mkOption {
|
||
|
|
type = types.bool;
|
||
|
|
default = false;
|
||
|
|
description = ''
|
||
|
|
Open ports in the firewall for the server.
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
user = mkOption {
|
||
|
|
type = types.str;
|
||
|
|
default = "roon-server";
|
||
|
|
description = ''
|
||
|
|
User to run the Roon Server as.
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
group = mkOption {
|
||
|
|
type = types.str;
|
||
|
|
default = "roon-server";
|
||
|
|
description = ''
|
||
|
|
Group to run the Roon Server as.
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
config = mkIf cfg.enable {
|
||
|
|
systemd.services.roon-server = {
|
||
|
|
after = [ "network.target" ];
|
||
|
|
description = "Roon Server";
|
||
|
|
wantedBy = [ "multi-user.target" ];
|
||
|
|
|
||
|
|
environment.ROON_DATAROOT = "/var/lib/${name}";
|
||
|
|
environment.ROON_ID_DIR = "/var/lib/${name}";
|
||
|
|
|
||
|
|
serviceConfig = {
|
||
|
|
ExecStart = "${lib.getExe cfg.package}";
|
||
|
|
LimitNOFILE = 8192;
|
||
|
|
User = cfg.user;
|
||
|
|
Group = cfg.group;
|
||
|
|
StateDirectory = name;
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
networking.firewall = mkIf cfg.openFirewall {
|
||
|
|
allowedTCPPortRanges = [
|
||
|
|
{ from = 9100; to = 9200; }
|
||
|
|
{ from = 9330; to = 9339; }
|
||
|
|
{ from = 30000; to = 30010; }
|
||
|
|
];
|
||
|
|
allowedUDPPorts = [ 9003 ];
|
||
|
|
extraCommands = optionalString (!config.networking.nftables.enable) ''
|
||
|
|
## IGMP / Broadcast ##
|
||
|
|
iptables -A INPUT -s 224.0.0.0/4 -j ACCEPT
|
||
|
|
iptables -A INPUT -d 224.0.0.0/4 -j ACCEPT
|
||
|
|
iptables -A INPUT -s 240.0.0.0/5 -j ACCEPT
|
||
|
|
iptables -A INPUT -m pkttype --pkt-type multicast -j ACCEPT
|
||
|
|
iptables -A INPUT -m pkttype --pkt-type broadcast -j ACCEPT
|
||
|
|
'';
|
||
|
|
extraInputRules = optionalString config.networking.nftables.enable ''
|
||
|
|
ip saddr { 224.0.0.0/4, 240.0.0.0/5 } accept
|
||
|
|
ip daddr 224.0.0.0/4 accept
|
||
|
|
pkttype { multicast, broadcast } accept
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
|
||
|
|
|
||
|
|
users.groups.${cfg.group} = {};
|
||
|
|
users.users.${cfg.user} =
|
||
|
|
optionalAttrs (cfg.user == "roon-server") {
|
||
|
|
isSystemUser = true;
|
||
|
|
description = "Roon Server user";
|
||
|
|
group = cfg.group;
|
||
|
|
extraGroups = [ "audio" ];
|
||
|
|
};
|
||
|
|
};
|
||
|
|
}
|