hosts/hetzner-arm/containers/music/data/ports.nix

@@ -0,0 +1,7 @@
+{
+  mpd = 6600;
+  mpd-opus-low = 4242;
+  mpd-opus-medium = 4243;
+  mpd-opus-high = 4244;
+  mpd-flac = 4245;
+}

hosts/hetzner-arm/containers/music/default.nix

@@ -0,0 +1,125 @@
+{
+  self,
+  hostPath,
+  tree,
+  lib,
+  inputs,
+  pkgs,
+  config,
+  ...
+}: let
+  inherit (lib.modules) mkMerge;
+  inherit (lib.lists) forEach;
+
+  containerName = "music";
+
+  containerAddresses = import "${hostPath}/data/containerAddresses.nix";
+
+  hostIP = containerAddresses.host;
+  containerIP = containerAddresses.containers.${containerName};
+
+  ports = import ./data/ports.nix;
+
+  # these secrets should probs be in host but im lazy
+  containerSecrets = config.containers.${containerName}.config.services.secrets.secrets;
+  pathInContainer = path: "/var/lib/nixos-containers/${containerName}" + path;
+in {
+  containers.music = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = hostIP;
+    localAddress = containerIP;
+
+    specialArgs = {
+      inherit inputs;
+      inherit tree;
+      inherit self;
+      inherit hostPath;
+    };
+
+    bindMounts = {
+      "/dev/fuse" = {
+        hostPath = "/dev/fuse";
+        isReadOnly = false;
+      };
+    };
+
+    allowedDevices = [
+      {
+        modifier = "rwm";
+        node = "/dev/fuse";
+      }
+      {
+        modifier = "rwm";
+        node = "/dev/mapper/control";
+      }
+    ];
+
+    config = {...}: {
+      nixpkgs.pkgs = pkgs;
+
+      imports = with tree;
+        [
+          presets.nixos.containerBase
+
+          profiles.nginx
+          profiles.firewallAllow.httpCommon
+
+          ./secrets.nix
+        ]
+        ++ (with hosts.hetzner-arm.containers.music.profiles; [
+          mpd
+        ]);
+
+      home-manager.users.root.imports = with tree; [home.apps.musicutil];
+
+      networking.firewall.allowedTCPPorts = with ports; [
+        mpd
+        mpd-opus-low
+        mpd-opus-medium
+        mpd-opus-high
+        mpd-flac
+      ];
+
+      home-manager.users.root.home.stateVersion = "24.05";
+      system.stateVersion = "24.05";
+    };
+  };
+
+  services.nginx.virtualHosts."mpd.owo.monster" = let
+    extraConfig = ''
+      auth_basic "Music Password";
+      auth_basic_user_file ${pathInContainer containerSecrets.music_stream_passwd.path};
+    '';
+  in {
+    forceSSL = true;
+    enableACME = true;
+    locations = mkMerge [
+      {
+        "/flac" = {
+          proxyPass = "http://${containerIP}:${toString ports.mpd-flac}";
+          inherit extraConfig;
+        };
+      }
+      (mkMerge (forEach ["low" "medium" "high"] (quality: {
+        "/opus-${quality}" = {
+          proxyPass = "http://${containerIP}:${toString ports."mpd-opus-${quality}"}";
+          inherit extraConfig;
+        };
+      })))
+    ];
+  };
+
+  networking = {
+    nat.forwardPorts = [
+      {
+        sourcePort = ports.mpd;
+        destination = "${containerIP}\:${toString ports.mpd}";
+      }
+    ];
+
+    firewall.allowedTCPPorts = with ports; [
+      mpd
+    ];
+  };
+}

hosts/hetzner-arm/containers/music/profiles/mpd.nix

@@ -7,14 +7,7 @@
   inherit (lib.strings) concatStringsSep;
   inherit (lib.lists) forEach;
 
-  ports = {
+  ports = import ../data/ports.nix;
-    mpd = 6600;
-    mpd-opus-low = 4242;
-    mpd-opus-medium = 4243;
-    mpd-opus-high = 4244;
-    mpd-flac = 4245;
-  };
-
   inherit (config.services.secrets) secrets;
 in {
   environment.systemPackages = with pkgs; [
@@ -92,32 +85,4 @@ in {
         }
       '';
   };
-
-  services.nginx.virtualHosts."mpd.owo.monster" = let
-    extraConfig = ''
-      auth_basic "Music Password";
-      auth_basic_user_file ${secrets.music_stream_passwd.path};
-    '';
-  in {
-    forceSSL = true;
-    enableACME = true;
-    locations = mkMerge [
-      {
-        "/flac" = {
-          proxyPass = "http://127.0.0.1:${toString ports.mpd-flac}";
-          inherit extraConfig;
-        };
-      }
-      (mkMerge (forEach ["low" "medium" "high"] (quality: {
-        "/opus-${quality}" = {
-          proxyPass = "http://127.0.0.1:${toString ports."mpd-opus-${quality}"}";
-          inherit extraConfig;
-        };
-      })))
-    ];
-  };
-
-  networking.firewall.allowedTCPPorts = with ports; [
-    mpd
-  ];
 }

hosts/hetzner-arm/containers/music/secrets.nix

@@ -0,0 +1,42 @@
+{pkgs, ...}: {
+  services.secrets = {
+    enable = true;
+
+    vaultLogin = {
+      enable = true;
+      loginUsername = "hetzner-arm-container-music";
+    };
+
+    requiredVaultPaths = [
+      "api-keys/data/mpd"
+      "api-keys/data/music-stream"
+    ];
+
+    packages = with pkgs; [
+      apacheHttpd
+    ];
+
+    secrets = {
+      vault_password = {
+        manual = true;
+      };
+
+      mpd_control_password = {
+        user = "mpd";
+        group = "mpd";
+        fetchScript = ''
+          simple_get "/api-keys/mpd" .password > "$secretFile"
+        '';
+      };
+      music_stream_passwd = {
+        user = "nginx";
+        group = "nginx";
+        fetchScript = ''
+          username=$(simple_get "/api-keys/music-stream" .username)
+          password=$(simple_get "/api-keys/music-stream" .password)
+          htpasswd -bc "$secretFile" "$username" "$password" 2>/dev/null
+        '';
+      };
+    };
+  };
+}

hosts/hetzner-arm/hetzner-arm.nix

@@ -26,12 +26,12 @@ in {
       "jellyfin"
       #"grocy"
       "vault"
+      "music"
     ] (name: ./containers + "/${name}"))
     ++ (with hosts.hetzner-arm.profiles; [
       staticSites
       gotosocial
       forgejo
-      mpd
       restic
     ]);
 

hosts/hetzner-arm/profiles/forgejo.nix

@@ -81,8 +81,4 @@
       locations."/".proxyPass = "http://unix:/var/sockets/forgejo/forgejo.sock";
     };
   };
-
-  networking.firewall.allowedTCPPorts = [
-    2222
-  ];
 }

hosts/hetzner-arm/secrets.nix

@@ -1,4 +1,4 @@
-{pkgs, ...}: {
+{...}: {
   services.secrets = {
     enable = true;
 
@@ -7,10 +7,6 @@
       loginUsername = "hetzner-arm";
     };
 
-    packages = with pkgs; [
-      apacheHttpd
-    ];
-
     requiredVaultPaths = [
       "private-public-keys/data/ssh/root@hetzner-arm"
       "private-public-keys/data/ssh/root@hetzner-arm-decrypt"
@@ -21,9 +17,6 @@
       "api-keys/data/chaos_mail/gotosocial"
 
       "private-public-keys/data/restic/Forgejo"
-
-      "api-keys/data/mpd"
-      "api-keys/data/music-stream"
     ];
 
     secrets = {
@@ -87,24 +80,6 @@
           simple_get "/private-public-keys/restic/Forgejo" .password > "$secretFile"
         '';
       };
-
-      mpd_control_password = {
-        user = "mpd";
-        group = "mpd";
-        fetchScript = ''
-          simple_get "/api-keys/mpd" .password > "$secretFile"
-        '';
-      };
-
-      music_stream_passwd = {
-        user = "nginx";
-        group = "nginx";
-        fetchScript = ''
-          username=$(simple_get "/api-keys/music-stream" .username)
-          password=$(simple_get "/api-keys/music-stream" .password)
-          htpasswd -bc "$secretFile" "$username" "$password" 2>/dev/null
-        '';
-      };
     };
   };
 }