Merge pull request 'password/fw issue' (#160) from feature/remove-hosts into main

Reviewed-on: #160

systems/palatine-hill/docker/arr.nix

@@ -11,7 +11,7 @@ let
       ctype = lib.strings.toUpper container_type;
     in
     {
-      "${ctype}__POSTGRES__HOST" = "host.docker.internal";
+      "${ctype}__POSTGRES__HOST" = "/var/run/postgresql";
       "${ctype}__POSTGRES__PORT" = toString config.services.postgresql.settings.port;
     };
 in
@@ -54,7 +54,7 @@ in
         PUID = "600";
         PGID = "100";
         TZ = "America/New_York";
-        POSTGRES_HOST = "host.docker.internal";
+        POSTGRES_HOST = "/var/run/postgresql";
         POSTGRES_PORT = toString config.services.postgresql.settings.port;
       };
       environmentFiles = [
@@ -63,10 +63,10 @@ in
       volumes = [
         "${vars.primary_docker}/bazarr:/config"
         "${vars.primary_plex_storage}/data:/data"
+        "/var/run/postgresql:/var/run/postgresql"
       ];
       extraOptions = [
         "--network=arrnet"
-        "--add-host=host.docker.internal:host-gateway"
       ];
       autoStart = true;
     };
@@ -86,10 +86,12 @@ in
       ];
       extraOptions = [
         "--network=arrnet"
-
-        "--add-host=host.docker.internal:host-gateway"
       ];
-      volumes = [ "${vars.primary_docker}/prowlarr:/config" ];
+      volumes = [
+        "${vars.primary_docker}/prowlarr:/config"
+
+        "/var/run/postgresql:/var/run/postgresql"
+      ];
       autoStart = true;
     };
     radarr = {
@@ -109,10 +111,10 @@ in
       volumes = [
         "${vars.primary_docker}/radarr:/config"
         "${vars.primary_plex_storage}/data:/data"
+        "/var/run/postgresql:/var/run/postgresql"
       ];
       extraOptions = [
         "--network=arrnet"
-        "--add-host=host.docker.internal:host-gateway"
       ];
       autoStart = true;
     };
@@ -133,10 +135,10 @@ in
       volumes = [
         "${vars.primary_docker}/sonarr:/config"
         "${vars.primary_plex_storage}/data:/data"
+        "/var/run/postgresql:/var/run/postgresql"
       ];
       extraOptions = [
         "--network=arrnet"
-        "--add-host=host.docker.internal:host-gateway"
       ];
       autoStart = true;
     };
@@ -157,11 +159,10 @@ in
       volumes = [
         "${vars.primary_docker}/lidarr:/config"
         "${vars.primary_plex_storage}/data:/data"
+        "/var/run/postgresql:/var/run/postgresql"
       ];
       extraOptions = [
         "--network=arrnet"
-        "--add-host=host.docker.internal:host-gateway"
-
       ];
       autoStart = true;
     };
@@ -176,6 +177,7 @@ in
       volumes = [
         "${vars.primary_docker}/unpackerr:/config"
         "${vars.primary_plex_storage}:/data"
+        "/var/run/postgresql:/var/run/postgresql"
       ];
       extraOptions = [ "--network=arrnet" ];
       autoStart = true;
@@ -193,6 +195,7 @@ in
       volumes = [
         "${vars.primary_docker}/notifiarr:/config"
         "${vars.primary_plex_storage}:/data"
+        "/var/run/postgresql:/var/run/postgresql"
       ];
       extraOptions = [ "--network=arrnet" ];
       autoStart = true;
@@ -206,18 +209,20 @@ in
         PGID = "100";
         TZ = "America/New_York";
         DB_TYPE = "postgres";
-        DB_HOST = "host.docker.internal";
+        DB_HOST = "/var/run/postgresql";
         DB_PORT = toString config.services.postgresql.settings.port;
       };
       environmentFiles = [
         config.sops.secrets."docker/jellyseerr".path
       ];
-      volumes = [ "${vars.primary_docker}/overseerr:/config" ];
+      volumes = [
+        "${vars.primary_docker}/overseerr:/config"
+        "/var/run/postgresql:/var/run/postgresql"
+      ];
       # TODO: remove ports later since this is going through web
       extraOptions = [
         "--network=arrnet"
         "--network=haproxy-net"
-        "--add-host=host.docker.internal:host-gateway"
         # "--health-cmd \"wget --no-verbose --tries 1 --spider http://localhost:5055/api/v1/status || exit 1\""
         # "--health-start-period 20s"
         # "--health-timeout 3s"
@@ -235,13 +240,34 @@ in
 
   sops = {
     secrets = {
-      "docker/notifiarr".owner = "docker-service";
+      "docker/notifiarr" = {
-      "docker/bazarr".owner = "docker-service";
+        owner = "docker-service";
-      "docker/prowlarr".owner = "docker-service";
+        restartUnits = [ "docker-notifiarr.service" ];
-      "docker/radarr".owner = "docker-service";
+      };
-      "docker/sonarr".owner = "docker-service";
+      "docker/bazarr" = {
-      "docker/lidarr".owner = "docker-service";
+        owner = "docker-service";
-      "docker/jellyseerr".owner = "docker-service";
+        restartUnits = [ "docker-bazarr.service" ];
+      };
+      "docker/prowlarr" = {
+        owner = "docker-service";
+        restartUnits = [ "docker-prowlarr.service" ];
+      };
+      "docker/radarr" = {
+        owner = "docker-service";
+        restartUnits = [ "docker-radarr.service" ];
+      };
+      "docker/sonarr" = {
+        owner = "docker-service";
+        restartUnits = [ "docker-sonarr.service" ];
+      };
+      "docker/lidarr" = {
+        owner = "docker-service";
+        restartUnits = [ "docker-lidarr.service" ];
+      };
+      "docker/jellyseerr" = {
+        owner = "docker-service";
+        restartUnits = [ "docker-jellyseerr.service" ];
+      };
     };
   };
 }

systems/palatine-hill/firewall.nix

@@ -1,7 +1,19 @@
 { ... }:
 
 {
-  networking.firewall.allowedTCPPorts = [
+  networking.firewall = {
+
+    extraCommands = "
+      iptables -I nixos-fw 1 -i br+ -j ACCEPT
+    ";
+
+    extraStopCommands = "
+      iptables -D nixos-fw -i br+ -j ACCEPT
+    ";
+
+    trustedInterfaces = [ "br+" ];
+
+    allowedTCPPorts = [
       # qbit
       8081
       8082
@@ -33,9 +45,7 @@
       8686
       8787
       5055
-
-    # temp postgres
-    5432
     ];
 
+  };
 }

systems/palatine-hill/postgresql.nix

@@ -29,6 +29,12 @@ in
            # Let other names login as themselves
            superuser_map      /^(.*)$   \1
       '';
+      authentication = ''
+        local  bazarr  bazarr  scram-sha-256
+        local  /.*arr-main  /.*arr  scram-sha-256
+        local  /.*arr-log  /.*arr  scram-sha-256
+        local  jellyseerr  jellyseerr  scram-sha-256
+      '';
 
       # initialScript = config.sops.secrets."postgres/init".path;
       ensureDatabases = [

systems/palatine-hill/secrets.yaml

@@ -27,11 +27,11 @@ docker:
     protonvpn-start-script: ENC[AES256_GCM,data:ZnlDpCLdILHXSUCI6itWkqO4y75Lwjj7qT1DBkfueLneQOaQ0JhuE2FbOOajkmI046nP9fMrJbu3g4QZHsq1g8yqGU1wb0OOT+eS9+M92Md29B4NnUdwnVAO6/RzvRKXP2tsQ4iprx9An+BEFwZYD6WG6DQc6NjJVSgRcYvfH9rQey2VdwLysNsgFCs8eC6QgikqBpeg4eOIvDDNbdXPKkW+ZPph9xpzGkcFIMwlX5esg0n7qyUoMvWwBn4avC46U5erOw0fNajY60ri9sm5Afht6LZrFal71Hx/K9/5EXBp9dD4teLO2Ew0CQX0i94pKCuR207l9868s7Ao3udLp4wbiLnXoRKq+w==,iv:qR0kNYpb50NXEqSksvHBPAaRG51RKCsSwTq32nosxzo=,tag:+xRQyuWi4Ja/N9lcd11oJA==,type:str]
     notifiarr: ENC[AES256_GCM,data:XxVEhp4Rei6mRcdSSooRnofuVNZDalVhDYiVUmvQUr8QihrVRMKRE9Kpl5PGWUBw,iv:urMLaUf3XUjMks2vk0E7iRUU3mLHBiMAiwtQgmWQq20=,tag:dHdTOyC/ukd71UlYEI5fWw==,type:str]
     bazarr: ENC[AES256_GCM,data:x+JdRCl3x3OM3lWmgcWikJSEnh5c5He5HmuLzCGAQ8zUXMi2Z3Kf6LzL+aoqtCBu3rabYZmQSLBoDm9CPkk=,iv:7e+3w46RUD2/OSlwrEe7BRxUqPPdt5+obIjQA8pr3xY=,tag:rHSijp/tcf/SGp5y4kJ0cw==,type:str]
-    prowlarr: ENC[AES256_GCM,data:AyOaj1nYCxeycBgp5sfNKz3A158FuXVg0DCoLrOE9YnUIAjo+5PW9HMdpCEiK0OfgoMPcUZNZowLYYY0goxwC+4+tB87TnBz2YpXTX8L7YO2JA+g7hA=,iv:IaZxKl5ypdIQ4f4SAHQtaUC20lbYL1b7mptu/FVB6k4=,tag:A9eQI9gG7wkSEPt6Mdg3Zw==,type:str]
+    prowlarr: ENC[AES256_GCM,data:hr3hYwRw0+/UD8anqZQjGy7rPkV2pad4Xi5FdXSf3Ftd1/jwlYfMqhqgEngFX30LLMWvJvjeu1TkTNzSEwI6ZCPdefNVYYwWavtm+XcBVxffGvFZ,iv:EXW48288IcCeGs/vP4tkAI4dxQAOh92Na43q/9cyuSc=,tag:pnYR26MDd82DjeUPdwCoUw==,type:str]
-    radarr: ENC[AES256_GCM,data:vqjqRsDjFm30yMrzWsWC6prYSEUQ+4v0hlDqJ6FS39hNFaGtGAsulUWv9MAJ11xI9CLsjjQUtpQ5KlRkYlHo5FnzeXCpK05ewkhYyqa7NKE=,iv:sKdxA5AtxpFpuiUYpz3NW2Fjc+ZKFmiJqibdQ3P6pVg=,tag:tDlJpApk4g6SYFzyn8Z/HA==,type:str]
+    radarr: ENC[AES256_GCM,data:qCfoeEHb0ng5GhaY3QZiFvLVb25ZHNmgT0bRqEjBcelyP2819zCL7LxUPr08FxivEYZiAMFVleRozL8NMg6O5fh+2BatcYOfyh99zxIC,iv:HV3gTTnrjtab7x4Be+7hSe+nrD6BnPAmZBsHzi9Fujg=,tag:O6x0FDlasuJSRrGL/9SwpQ==,type:str]
-    sonarr: ENC[AES256_GCM,data:IooG9LDXpdbQcknriSdowPwNv++yfj54mko49rtm4B8IVEV30B5o8iZhGXmSgpLsH9QtP/PmkuczjiiwlPI2QM5iRxpjUz2456a1hi61/uY=,iv:/PagjmFtJgkYKFPmZD5qI8DzdiuUIX8m0lapdZBXUus=,tag:Ppew0fepqgnhvTorwalhEw==,type:str]
+    sonarr: ENC[AES256_GCM,data:X/hM31ZyHybvy2eQzVnmq8CH1AqBgz1pxq7tKC4lZB3ryAbnEIJksffem8+35tWt/0r5cEH4aaIKD1kS7Q+Ma+8JrRLcWkt6CZq/wspz,iv:44FfdVpQCposXshzNe5DXAxExeQzjVKhkZaVbgKo8KU=,tag:WIWWUt1XBngUTwwqhCrcNw==,type:str]
-    lidarr: ENC[AES256_GCM,data:9YtVafa4/SQ78+DJ52emGyLHCWpJpnhc+2DwGBQ0uhFiee7ZRFy+O0kHPPyNly8sgP9UOZt+53D4sAv9S8hOCnJTAbHiNnzTbjQmZtnvgnc=,iv:dlF5wtcphEhg5jxb8YSIF9/2Vj1KY10Vza/OGK1jXRM=,tag:8qmdQjRv30VqRReOzr6UEA==,type:str]
+    lidarr: ENC[AES256_GCM,data:xERBECneutNUMZRrHukp8CaNrpI7SXUB16zUkauNP2+wto3eIc/K+2nMCkbwSC9AKlSjnUGSiORmAWn/jofTAuEzQljkCR1XCSkJRMmL,iv:iKf4fZtCfdjT/KuMFK5VFoLAV+Lll8uJowe9Q4cHyYw=,tag:xzmATTkrYRYm9Mw23zEO5g==,type:str]
-    jellyseerr: ENC[AES256_GCM,data:eKZo7Yw6j0qeyHidHu3R+2yZrHOMlM/O2VTY0CF/AUzm21LNO5UDItORoBCJfPvpnbA=,iv:jVJ77jXNwCEPRWKgKP8E7SrxdS0RFa486nq6cMkqvMc=,tag:Bndao3nx18nmJ1yaXLmWIg==,type:str]
+    jellyseerr: ENC[AES256_GCM,data:7dDfHFp8+WbJqrf7Ms/gmfroBePwegXh5CXn5FcOz8IEK7rTvr9KZfz9x/1BwdD8,iv:ZPi3OcMfH76A08piKY4P7hFbeMyouwBoeN5oL3ExzKU=,tag:oOZ37dy/y+DFqNRfAHexvQ==,type:str]
 acme:
     bunny: ENC[AES256_GCM,data:P2yROVUga9mORcq8VR/l0i4/2Vod1zvlYq+ZJLLNKow0SpblkwQX/i1ucQYAOkTTRddN+3C+t0zj1rMWkdLoaLjEUJJi3VsSxi+chV2FFiVKFQGEcg24,iv:aQvGgGLsgRGoEmwTgZHR8Jm/MYxmGtVTT/fZKaTLeMs=,tag:m3ssF4O8qs4yxvMu6yUcjw==,type:str]
     dnsimple: ENC[AES256_GCM,data:37FKyBibFtXZgI4EduJQ0z8F+shBc5Q6YlLa3YkVPh9XuJVS20eybi75bfJxiozcZ9d+YRaqcbkBQCSdFOCotDU=,iv:oq3JjqbfAm2C4jcL1lvUb2EOmnwlR07vPoO8H0BmydQ=,tag:E3NO/jMElL6Q817666gIyg==,type:str]
@@ -50,8 +50,8 @@ sops:
             cXNZWmZqd0R0SmhINExscHBKWmxvblUKEFEQvt/zQFARba4S8vHz/1SoKdKg69At
             LZ58XQGOmlGbBhPr7EzYQ2XSY4flWbnnD174cmCR8DNFm15DsNA5fw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-24T03:17:22Z"
+    lastmodified: "2025-12-25T17:45:31Z"
-    mac: ENC[AES256_GCM,data:TreH0Z2S91ZyMreMSv0AIFJs1lrOCqTrsKHY2MrU0O+wdJlCdn4ggVGlS9L+oGpZ8fXoUcLdMvc0M3wCFZauM86SVMW+BDiPp93P6JLX8mDlLJPE1tfsw6ueaeKZJIhlbnlLSWHjNBrkybuT11HxXAjJIHav1Jf0S42lIMhq1Tc=,iv:ajcZxYvsMGmauj37MIJjWvzqlLAeqBiPbuqof2suTPU=,tag:7vQ4LnoHTrdUxnmhRgUANA==,type:str]
+    mac: ENC[AES256_GCM,data:lVRqQWnO1RvmoW13/xCpP2SvibccRWwmr1Gyj6EgrE+V+Iu1bfnZRkTkHiFIQqQLQgCy2qBiSHeZF/dNERe83eEwpXgRQAduarpE/qL8K1mxcwf5HMMYACjlNfsL/I1/TCJrJ7DZBxI4neRLetc5OpScVXqHj1neOodD/g8n+ls=,iv:+gZpo0I2NVYz24o42mUW/OkfONqNSjgaJeKeFdKx7dg=,tag:EJnpiotQuBKth21mdhvjZQ==,type:str]
     pgp:
         - created_at: "2024-11-28T18:56:39Z"
           enc: |-