Add navidrome host

config/hosts/navidrome/configuration.nix

@@ -0,0 +1,33 @@
+{ ... }:
+{
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/vda";
+  };
+
+  networking = {
+    hostName = "navidrome";
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ 80 443 ];
+    };
+  };
+
+  fileSystems = {
+    "/mnt/music" = {
+      device = "//10.202.40.5/music-ro";
+      fsType = "cifs";
+      options = [ 
+        "username=navidrome" 
+        "credentials=/secrets/navidrome-samba-credentials.secret"
+        "iocharset=utf8"
+        "vers=3.1.1"
+        "uid=navidrome"
+        "gid=navidrome"
+        "_netdev"
+      ];
+    };
+  };
+
+  system.stateVersion = "23.05";
+}

config/hosts/navidrome/default.nix

@@ -0,0 +1,7 @@
+{ ... }: {
+  imports = [
+    ./configuration.nix
+    ./navidrome.nix
+    ./nginx.nix
+  ];
+}

config/hosts/navidrome/navidrome.nix

@@ -0,0 +1,9 @@
+{ ... }: {
+  services.navidrome = {
+    enable = true;
+    settings = {
+      Address = "unix:/run/navidrome/navidrome.socket";
+      MusicFolder = "/mnt/music";
+    };
+  };
+}

config/hosts/navidrome/nginx.nix

@@ -0,0 +1,24 @@
+{ ... }: {
+  services.nginx = {
+    enable = true;
+    user = "navidrome";
+    virtualHosts."navidrome.grzb.de" = {
+      forceSSL = true;
+      enableACME = true;
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 80;
+        }
+        {
+          addr = "0.0.0.0";
+          port = 443;
+          ssl = true;
+        }
+      ];
+      locations."/" = {
+        proxyPass = "http://unix:/run/navidrome/navidrome.socket";
+      };
+    };
+  };
+}

config/hosts/navidrome/secrets.nix

@@ -0,0 +1,13 @@
+{ keyCommandEnv, ... }:
+{
+  deployment.keys = {
+    "navidrome-samba-credentials.secret" = {
+      keyCommand = keyCommandEnv ++ [ "pass" "navidrome/samba-credentials" ];
+      destDir = "/secrets";
+      user = "root";
+      group = "root";
+      permissions = "0640";
+      uploadAt = "pre-activation";
+    };
+  };
+}

config/hosts/web-public-1/virtualHosts/acme-challenge.nix

@@ -1,12 +1,18 @@
 { ... }:
+let
+  acmeDomainMap = {
+    "paperless.grzb.de" = "paperless.wg.grzb.de";
+    "navidrome.grzb.de" = "navidrome.wg.grzb.de";
+  };
+in
 {
-  services.nginx.virtualHosts."paperless.grzb.de" = {
+  services.nginx.virtualHosts = (builtins.mapAttrs (domain: target: {
     listen = [{ 
       addr = "0.0.0.0";
       port = 80;
     }];
     locations."^~ /.well-known/acme-challenge/" = {
-      proxyPass = "http://paperless.wg.grzb.de:80";
+      proxyPass = "http://${target}:80";
-    };
     };
+  }) acmeDomainMap);
 }

hosts.nix

@@ -69,6 +69,11 @@ in
       site = "vs";
       environment = "proxmox";
     };
+    navidrome = {
+      hostNixpkgs = nixpkgs-unstable;
+      site = "wg";
+      environment = "proxmox";
+    };
     netbox = {
       site = "vs";
       environment = "proxmox";