feat: deploy prowlarr in remote machine

but reverse proxy it from the local machine over tailscale

nixos/mirai/services/default.nix

@@ -11,6 +11,7 @@
     ./nextcloud.nix
     ./tailscale.nix
     ./zerotier.nix
+    ./prowlarr.nix
 
     # ./home-assistant.nix
     # ./jellyfin.nix

nixos/mirai/services/prowlarr.nix

@@ -0,0 +1,10 @@
+{...}: {
+  services = {
+    prowlarr = {
+      enable = true;
+    };
+    flaresolverr = {
+      enable = true;
+    };
+  };
+}

nixos/ryu/configuration.nix

@@ -118,13 +118,6 @@
   users.groups.media = {};
 
   services = {
-    resolved = {
-      enable = true;
-      dnssec = "true";
-      domains = ["~."];
-      fallbackDns = ["1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one"];
-      dnsovertls = "true";
-    };
     devmon.enable = true;
     gvfs.enable = true;
     udisks2.enable = true;

nixos/ryu/services/default.nix

@@ -9,6 +9,8 @@
     ./mullvad.nix
     ./openrgb.nix
     ./command-runner.nix
+    ./resolved.nix
+    # ./dnscrypt.nix
   ];
   services = {
     # hardware.openrgb.enable = true;

nixos/ryu/services/dnscrypt.nix

@@ -0,0 +1,30 @@
+{config, ...}: {
+  networking = {
+    search = ["lemur-newton.ts.net"];
+    dhcpcd.extraConfig = "nohook resolv.conf";
+    networkmanager.dns = "none";
+  };
+  services.resolved.enable = false;
+  services.dnscrypt-proxy2 = {
+    enable = true;
+    # Settings reference:
+    # https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml
+    settings = {
+      ipv6_servers = true;
+      require_dnssec = true;
+      # Add this to test if dnscrypt-proxy is actually used to resolve DNS requests
+      # query_log.file = "/var/log/dnscrypt-proxy/query.log";
+      sources.public-resolvers = {
+        urls = [
+          "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md"
+          "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md"
+        ];
+        cache_file = "/var/cache/dnscrypt-proxy/public-resolvers.md";
+        minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
+      };
+
+      # You can choose a specific set of servers from https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v3/public-resolvers.md
+      server_names = ["cloudflare-security"];
+    };
+  };
+}

nixos/ryu/services/resolved.nix

@@ -0,0 +1,9 @@
+{...}: {
+  services.resolved = {
+    enable = true;
+    dnssec = "true";
+    domains = ["~." "lemur-newton.ts.net"];
+    fallbackDns = ["1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one"];
+    dnsovertls = "true";
+  };
+}

nixos/tsuba/services/default.nix

@@ -5,10 +5,9 @@
     ./jellyfin.nix
     ./caddy.nix
     ./servarr.nix
-    # ./sonarr.nix
-    # ./radarr.nix
-    # ./prowlarr.nix
     ./deluge.nix
     ./homeassistant.nix
+    # ./dnscrypt.nix
+    ./resolved.nix
   ];
 }

nixos/tsuba/services/deluge.nix

@@ -3,6 +3,7 @@
     deluge = {
       enable = true;
       web.enable = true;
+      group = "media";
     };
     caddy = {
       virtualHosts."deluge.tsuba.darksailor.dev".extraConfig = ''

nixos/tsuba/services/dnscrypt.nix

@@ -0,0 +1,25 @@
+{config, ...}: {
+  networking = {
+    dhcpcd.extraConfig = "nohook resolv.conf";
+    networkmanager.dns = "none";
+  };
+  services.resolved.enable = false;
+  services.dnscrypt-proxy2 = {
+    enable = true;
+    settings = {
+      ipv6_servers = true;
+      require_dnssec = true;
+      sources.public-resolvers = {
+        urls = [
+          "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md"
+          "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md"
+        ];
+        cache_file = "/var/cache/dnscrypt-proxy/public-resolvers.md";
+        minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
+      };
+
+      # You can choose a specific set of servers from https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v3/public-resolvers.md
+      server_names = ["cloudflare-security"];
+    };
+  };
+}

nixos/tsuba/services/resolved.nix

@@ -0,0 +1,9 @@
+{...}: {
+  services.resolved = {
+    enable = true;
+    dnssec = "true";
+    domains = ["~." "lemur-newton.ts.net"];
+    fallbackDns = ["1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one"];
+    dnsovertls = "true";
+  };
+}

nixos/tsuba/services/servarr.nix

@@ -22,10 +22,10 @@ in {
       package = unstablePkgs.radarr;
       group = "media";
     };
-    prowlarr = {
-      enable = true;
-      package = unstablePkgs.prowlarr;
-    };
+    # prowlarr = {
+    #   enable = true;
+    #   package = unstablePkgs.prowlarr;
+    # };
     caddy.virtualHosts = {
       "sonarr.tsuba.darksailor.dev".extraConfig = ''
         import hetzner
@@ -37,7 +37,7 @@ in {
       '';
       "prowlarr.tsuba.darksailor.dev".extraConfig = ''
         import hetzner
-        reverse_proxy localhost:${builtins.toString config.services.prowlarr.settings.server.port}
+        reverse_proxy mirai.darksailor.dev:9696
       '';
     };
   };