tiny1: add calibre server

.sops.yaml

@@ -35,6 +35,12 @@ creation_rules:
           - *tiny1
         pgp:
           - *hyshka
+  - path_regex: hosts/tiny1/services/[^/]+\.(sqlite)$
+    key_groups:
+      - age:
+          - *tiny1
+        pgp:
+          - *hyshka
   - path_regex: hosts/common/secrets.ya?ml$
     key_groups:
       - age:

hosts/tiny1/services/caddy.nix

@@ -130,6 +130,16 @@
                         reverse_proxy http://127.0.0.1:8085
                }
 
+               @library host library.home.hyshka.com
+               handle @library {
+                        reverse_proxy http://127.0.0.1:8083
+               }
+
+               @books host books.home.hyshka.com
+               handle @books {
+                        reverse_proxy http://127.0.0.1:8084
+               }
+
                # Fallback for otherwise unhandled domains
                handle {
                  abort

hosts/tiny1/services/calibre.nix

@@ -0,0 +1,47 @@
+{config, ...}: {
+  # First, run calibre-server with auth disabled
+  # Then, generate a users database
+  # calibre-server --userdb ./calibre-users.sqlite --manage-users
+  # Finally, encrypt the binary as a secret
+  # to encrypt a binary: sops -e ./calibre-users.sqlite > hosts/tiny1/services/calibre-users.sqlite
+
+  sops.secrets.calibre-userdb = {
+    owner = config.services.calibre-server.user;
+    group = "mediacenter";
+    format = "binary";
+    sopsFile = ./calibre-users.sqlite;
+  };
+
+  services.calibre-server = {
+    enable = true;
+    group = "mediacenter";
+    port = 8083;
+    # Need to listen on local and docker interfaces for Readarr
+    #host = "127.0.0.1";
+    auth = {
+      mode = "basic";
+      enable = true;
+      userDb = config.sops.secrets.calibre-userdb.path;
+    };
+    libraries = [
+      "/mnt/storage/mediacenter/media/books"
+    ];
+  };
+
+  # Open port to sync with koreader
+  networking.firewall.allowedTCPPorts = [8083 8084];
+  services.calibre-web = {
+    enable = true;
+    group = "mediacenter";
+    listen = {
+      ip = "0.0.0.0";
+      port = 8084;
+    };
+    options = {
+      enableBookConversion = true;
+      enableBookUploading = true;
+      calibreLibrary = "/mnt/storage/mediacenter/media/books";
+      reverseProxyAuth.enable = true;
+    };
+  };
+}

hosts/tiny1/services/default.nix

@@ -1,5 +1,6 @@
 {
   imports = [
+    ./calibre.nix
     #./ddclient.nix
     ./docker.nix
     ./glances.nix

hosts/tiny1/services/media/default.nix

@@ -1,11 +1,14 @@
-{
+{config, ...}: {
   imports = [
     ./docker-compose.nix
   ];
 
   # docker interface for mediacenter network, allows docker to access ntfy
   # TODO: avoid hard-coding the interface
-  networking.firewall.interfaces."br-65ee147cd7f3".allowedTCPPorts = [8010];
+  # TODO: 8010 for ntfy
+  networking.firewall.interfaces."br-0a93fdcc1a12".allowedTCPPorts = [
+    config.services.calibre-server.port
+  ];
 
   users = {
     groups = {

hosts/tiny1/services/media/docker-compose.nix

@@ -248,6 +248,7 @@
     ];
     log-driver = "journald";
     extraOptions = [
+      "--add-host=host.docker.internal:host-gateway"
       "--network-alias=readarr"
       "--network=media_default"
     ];