nixos-dogma/hosts/common/server.nix

# Server stack shared by dogma-nixos and dogma-nixos-rtx (not WSL)
{
  config,
  lib,
  pkgs,
  inputs,
  options,
  ...
}: {
  boot.kernel.sysctl = {
    "net.ipv4.ip_forward" = 1;
    "net.bridge.bridge-nf-call-iptables" = 1;
    "net.ipv4.conf.all.forwarding" = 1;
    "net.ipv6.conf.all.forwarding" = 1;
    "net.ipv4.conf.all.proxy_arp" = 1;
    "net.ipv4.conf.ens2.proxy_arp" = 1;
  };

  networking.firewall.trustedInterfaces = ["br0"];

  # Bridge networking - host-specific NIC may be overridden per-host
  networking.interfaces.enp6s0.useDHCP = false;
  networking.interfaces.br0.useDHCP = true;
  networking.bridges.br0.interfaces = ["enp6s0"];

  services.caddy = {
    enable = true;
    environmentFile = config.sops.templates."caddy.env".path;
    
    virtualHosts."centraldogma.site:".extraConfig = ''

      root /srv/root/

      file_server
      encode zstd gzip

      redir /radarr /radarr/
      reverse_proxy /radarr/* 127.0.0.1:7878

    '';
    virtualHosts."http://dogma.lan:".extraConfig = ''
      root * /srv/root/
      file_server browse
      encode zstd gzip
    '';
    virtualHosts."jellyfin.centraldogma.site:".extraConfig = ''
      reverse_proxy /* 127.0.0.1:8096
    '';

    virtualHosts."sonarr.centraldogma.site:".extraConfig = ''
      redir /sonarr /sonarr/
      reverse_proxy /sonarr/* 127.0.0.1:8989
    '';

    virtualHosts."radarr.centraldogma.site:".extraConfig = ''
      redir /radarr /radarr/
      reverse_proxy /radarr/* 127.0.0.1:7878
    '';
    virtualHosts."git.centraldogma.site:".extraConfig = ''
      reverse_proxy /* 127.0.0.1:3000
    '';
  };

  services.flaresolverr.enable = true;

  sops.templates.configarr-ev = {
    content = ''
      LOG_LEVEL=debug
      LOG_STACKTRACE=true
      CONFIGARR_ENABLE_MERGE=true
      RADARR_API_KEY=${config.sops.placeholder."radarr/apikey"}
      SONARR_API_KEY=${config.sops.placeholder."sonarr/apikey"}
    '';
    inherit (config.services.configarr) group;
    owner = config.services.configarr.user;
  };

  services.configarr = {
    package =
      options.services.configarr.package.default.overrideAttrs
      (old: {
        pnpmDeps = old.pnpmDeps.overrideAttrs (_: {
          outputHash = "sha256-auz4JyfHJAOF+baLfV391HgBTua4AJFfX4CtTPh+0Sw=";
        });
      });
    enable = true;
    config =
      #yaml
      ''
        x-download-clients:
          # Define an anchor for shared instance
          qb_base: &qb_base
            name: "qBit"
            type: qbittorrent
            enable: true
            priority: 1
            remove_completed_downloads: true
            remove_failed_downloads: true
            # YAML does a shallow merge, thus we must declare another anchor for the nested dictionary if we plan to override values in it
            fields: &qb_fields
              host: qbittorrent
              port: 8080
              use_ssl: false
              username: admin
              password: changeme

          radarr:
            radarr_instance:
              api_key: !env RADARR_API_KEY
              base_url: http://localhost:${toString config.services.radarr.settings.server.port}

          sonarr:
            sonarr_instance:
              api_key: !env SONARR_API_KEY
              base_url: http://localhost:${toString config.services.sonarr.settings.server.port}
              download_clients:
            data:
              - <<: *qb_base
                fields:
                  <<: *qb_fields
                  tv_category: series
                tags: ["sonarr"]
              # Reuse same base, override name and fields
              - <<: *qb_base
                name: "qBit 4K"
                fields:
                  <<: *qb_fields
                  tv_category: series-4k
                tags: ["4K"]
            update_password: false
            delete_unmanaged:
              enabled: true
              ignore: ["Manual Test Client"]
            config:
              enable_completed_download_handling: true
              auto_redownload_failed: false


      '';
    environmentFile = config.sops.templates."configarr-ev".path;
  };

  services.mongodb = {
    enable = true;
    package = pkgs.mongodb-ce;
    initialRootPasswordFile = config.sops.secrets."mongodb/initial_password".path;
  };
  services.jackett.enable = true;
  services.prowlarr.enable = true;

  services.factorio = {
    enable = true;
    public = true;
    requireUserVerification = true;
    username = "TheMaskedMan95";
    admins = ["TheMaskedMan95"];
    extraSettingsFile = config.sops.templates."factorio.json".path;
    game-name = "Realm of the Masked Men";
    description = "No Dogs allowed";
    saveName = "SPACExxxx";
    openFirewall = true;
  };

  services.radarr.enable = true;

  services.ddclient = {
    enable = true;
    protocol = "namecheap";
    server = "dynamicdns.park-your-domain.com";
    ssl = true;
    username = "centraldogma.site";
    domains = [
      "@"
      "www"
      "*"
    ];
    usev4 = "webv4, webv4=ipify-ipv4";
    passwordFile = config.sops.secrets."namecheap/ddyn_password".path;
    interval = "5mins";
  };

  services.sonarr.enable = true;

  services.transmission = {
    enable = true;
    openRPCPort = true;
    settings = {
      rpc-bind-address = "0.0.0.0";
      rpc-whitelist = "127.0.0.1,192.168.0.91";
      download-dir = "/mnt/media/Downloads";
    };
  };

  # services.adguardhome = {
  #   enable = true;
  #   host = "0.0.0.0";
  #   port = 3003;
  #   settings = {
  #     allowDHCP = true;
  #     dns = {
  #       upstream_dns = [
  #         "9.9.9.9#dns.quad9.net"
  #         "149.112.112.112#dns.quad9.net"
  #       ];
  #     };
  #     filtering = {
  #       protection_enabled = true;
  #       filtering_enabled = true;
  #       parental_enabled = true;
  #       safe_search.enabled = false;
  #     };
  #     filters =
  #       map (url: {
  #         enabled = true;
  #         url = url;
  #       }) [
  #         "https://adguardteam.github.io/HostlistsRegistry/assets/filter_9.txt"
  #         "https://adguardteam.github.io/HostlistsRegistry/assets/filter_11.txt"
  #       ];
  #   };
  # };
}