fix: navidrome

hosts/architect/default.nix

@@ -269,6 +269,15 @@ in
           log.level = "debug";
         };
       };
+
+      navidrome = {
+        enable = true;
+        domain = "music.giugl.io";
+        package = pkgs.unstablePkgs.navidrome;
+
+        enableBeets = true;
+        beetsPackage = pkgs.unstablePkgs.beets;
+      };
     };
   };
 }

hosts/architect/navidrome.nix

@@ -1,83 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  domain = "music.giugl.io";
-  library_path = "/media/Music";
-  beets_config = "/media/beets.conf";
-in
-{
-  services.navidrome = {
-    enable = true;
-
-    settings = {
-      MusicFolder = library_path;
-      LastFM.enable = true;
-      LastFM.ApiKey = "5cef5cb5f9d31326b97d0f929ca9cf20";
-      LastFM.Secret = "d1296896126f4caae47407aecf080b25";
-      Spotify.ID = "3900c029b4f34f3fb61d554dda64794d";
-      Spotify.Secret = "d931ce5575a9401aa5ff8d37558cca0a";
-      EnableGravatar = true;
-      LogLevel = "WARN";
-    };
-  };
-
-  architect.vhost.${domain} = {
-    dnsInterfaces = [ "lan" "tailscale" ];
-    locations."/" = {
-      port = 4533;
-      allowLan = true;
-      allowWAN = true;
-      # allow = [ config.architect.networks."tailscale".net ];
-    };
-  };
-
-  systemd.services = {
-    "beets-update" = {
-      enable = true;
-      #      requires = [ "remove-badmp3.service" "remove-badflac.service" ];
-      before = [ "beets-import.service" ];
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart = "${pkgs.beets}/bin/beet -c ${beets_config} update";
-      };
-    };
-
-    "beets-import" = {
-      enable = true;
-      path = [ pkgs.imagemagick ];
-      requires = [ "beets-update.service" ];
-      after = [ "beets-update.service" ];
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart =
-          "${pkgs.beets}/bin/beet -c ${beets_config} import --flat -q ${library_path}";
-      };
-      startAt = "weekly";
-    };
-    };
-
-  #   "remove-badmp3" = {
-  #     enable = true;
-  #     before = [ "beets-import.service" "beets-update.service" ];
-  #     serviceConfig = {
-  #       Type = "oneshot";
-  #       ExecStart = ''
-  #         ${pkgs.findutils}/bin/find ${library_path} -name "*.mp3" -type f -exec ${pkgs.bash}/bin/sh -c '${pkgs.mp3val}/bin/mp3val "{}" | grep -Pi error 1>/dev/null && ${pkgs.busybox}/bin/rm "{}"' \;
-  #       '';
-  #     };
-  #   };
-
-  #   "remove-badflac" = {
-  #     enable = true;
-  #     before = [ "beets-import.service" "beets-update.service" ];
-  #     serviceConfig = {
-  #       Type = "oneshot";
-  #       ExecStart = ''
-  #         ${pkgs.findutils}/bin/find ${library_path} -name "*.flac" -type f -exec ${pkgs.bash}/bin/sh -c '${pkgs.flac}/bin/flac -st "{}" || ${pkgs.busybox}/bin/rm "{}"' \;
-  #       '';
-  #     };
-  #   };
-  # };
-
-  users.groups.media.members = [ "navidrome" ];
-}

modules/services/navidrome/default.nix

@@ -4,11 +4,82 @@ let
   inherit (lib) mkIf;
 
   cfg = config.pepe.services.navidrome;
+
+  beetsConfigTemplate = pkgs.writeText "beets.conf.template" ''
+    directory: ${cfg.musicFolder}
+    plugins: embedart fetchart scrub lastgenre chroma
+
+    import:
+      write: yes
+      move: yes
+      incremental: yes
+      from_scratch: yes
+      group_albums: yes
+      log: ${cfg.musicFolder}/beets.log
+    original_date: yes
+    discogs:
+      user_token: "__DISCOGS_TOKEN__"
+    paths:
+        default: $albumartist/$album ($original_year)/$track - $title
+        singleton: $artist/singles/$title
+    match:
+      strong_rec_thresh: 0.20
+    musicbrainz:
+      extra_tags: [year]
+    lastfm:
+      user: peperunas
+      api_key: "__LASTFM_KEY__"
+    embedart:
+      auto: yes
+    fetchart:
+      auto: yes
+      lastfmkey: "__LASTFM_KEY__"
+      enforce_ratio: 0.5%
+    scrub:
+      auto: yes
+    lastgenre:
+      auto: yes
+      count: 5
+      min_weight: 10
+      prefer_specific: yes
+      force: yes
+    chroma:
+      auto: yes
+  '';
+
+  preStartBeetsDecrypt = ''
+    set -eu
+    sed \
+      -e "s|__DISCOGS_TOKEN__|$(cat ${config.age.secrets.discogs.path})|g" \
+      -e "s|__LASTFM_KEY__|$(cat ${config.age.secrets.lastfmKey.path})|g" \
+      ${beetsConfigTemplate} > /run/beets.conf
+  '';
+
+  navidromeWrapped = pkgs.writeShellScriptBin "navidrome-wrapped" ''
+    set -eu
+
+    ${preStartNavidromeDecrypt}
+
+    exec ${cfg.package}/bin/navidrome "$@"
+  '';
+
+  preStartNavidromeDecrypt = ''
+    set -eu
+
+    # export ND_LASTFM_APIKEY=$(cat ${config.age.secrets.lastfmKey.path})
+    # export ND_LASTFM_SECRET=$(cat ${config.age.secrets.lastfmSecret.path})
+    # export ND_SPOTIFY_ID=$(cat ${config.age.secrets.spotifyID.path})
+    # export ND_SPOTIFY_SECRET=$(cat ${config.age.secrets.spotifySecret.path})
+  '';
 in
 {
   options.pepe.services.navidrome = with lib; {
     enable = mkEnableOption "Enable navidrome";
+    enableBeets = mkEnableOption "Enable beets";
+
     package = mkPackageOption pkgs "navidrome" { };
+    beetsPackage = mkPackageOption pkgs "beets" { };
+
     domain = mkOption {
       type = types.str;
       default = null;
@@ -18,14 +89,9 @@ in
       default = "/media/Music";
       description = "Path to the music library";
     };
-    beetsConfig = mkOption {
-      type = types.str;
-      default = "/media/beets.conf";
-      description = "Path to the beets configuration file";
-    };
     settings = mkOption {
       type = types.attrs;
-      default = {};
+      default = { };
       description = "Additional settings for Navidrome";
     };
   };
@@ -33,36 +99,56 @@ in
   config = mkIf cfg.enable {
     services.navidrome = {
       enable = true;
-      package = cfg.package;
+      package = navidromeWrapped;
       settings = {
         MusicFolder = cfg.musicFolder;
         LastFM.enable = true;
-        LastFM.ApiKey = "5cef5cb5f9d31326b97d0f929ca9cf20";
-        LastFM.Secret = "d1296896126f4caae47407aecf080b25";
-        Spotify.ID = "3900c029b4f34f3fb61d554dda64794d";
-        Spotify.Secret = "d931ce5575a9401aa5ff8d37558cca0a";
         EnableGravatar = true;
         LogLevel = "WARN";
       } // cfg.settings;
     };
 
-    pepe.core.vhost.hosts.${cfg.domain} = with config.pepe.core.network; {
-      dnsInterfaces = [ interfaceTypes.lan interfaceTypes.vpn ];
+    pepe.core.vhost.hosts.${cfg.domain} = {
       locations."/" = {
-        port = 4533;
+        port = config.services.navidrome.settings.Port;
         allowLAN = true;
         allowVPN = true;
         allowWAN = true;
       };
     };
 
+    age.secrets = {
+      discogs = mkIf cfg.enableBeets {
+        file = ../../../secrets/discogs.age;
+      };
+
+      lastfmKey = {
+        file = ../../../secrets/lastfm-key.age;
+      };
+
+      lastfmSecret = {
+        file = ../../../secrets/lastfm-key.age;
+      };
+
+      spotifyID = {
+        file = ../../../secrets/spotify-id.age;
+      };
+
+      spotifySecret = {
+        file = ../../../secrets/spotify-secret.age;
+      };
+    };
+
     systemd.services = {
+      "navidrome".preStart = preStartNavidromeDecrypt;
+    } // mkIf cfg.enableBeets {
       "beets-update" = {
         enable = true;
+        preStart = preStartBeetsDecrypt;
         before = [ "beets-import.service" ];
         serviceConfig = {
           Type = "oneshot";
-          ExecStart = "${pkgs.beets}/bin/beet -c ${cfg.beetsConfig} update";
+          ExecStart = "${cfg.beetsPackage}/bin/beet -c /run/beets.conf update";
         };
       };
 
@@ -73,7 +159,7 @@ in
         after = [ "beets-update.service" ];
         serviceConfig = {
           Type = "oneshot";
-          ExecStart = "${pkgs.beets}/bin/beet -c ${cfg.beetsConfig} import --flat -q ${cfg.musicFolder}";
+          ExecStart = "${cfg.beetsPackage}/bin/beet -c /run/beets.conf import --flat -q ${cfg.musicFolder}";
         };
         startAt = "weekly";
       };

secrets/lastfm-key.age

@@ -0,0 +1,28 @@
+age-encryption.org/v1
+-> ssh-rsa QXZdow
+egfNMkr5s1byfetcNOZJtCjdsr6gGT2yostUlnWmzINU6iwymI1lvmZEYAC3jRHL
+nlp1qS99HZb2hrIxS/RfWxWm8TBDwSw14755GIrUi6u2zZTdAGx90oiTolMx/Jfp
+Lwk0HNohXfU7rLuUOAO4GpT1WhX1u2yKlxyS+DUtF/ayZN5cWTbQnAFrCJhH+lrY
+5V1oytbel1zHOV7QpzT+sR09Z4VUqptmlIFtyleIO7ksEnZtFqYhhF+tMx/Bfxjg
+BzLX8IyUOvvyMMUDeIOq5f0+QsqhTNk8BTNlRWznrNKKdS8P60a9J0flGz+dtczq
+s3i8Xncx+6PliasnAkzOhxDUwU+CQUcRoFsQX+03yS2c0X/3V0OgOk74SCkrInCP
+gCZfgVVm19gAQWHvRfjkw2qSVo2V1y6BsXb2RskZCF3+1ZfPv1kl9YCb0WUbEzZC
+OGooxrJFa1Yub+zNG0RFAQKUA0yaWZSZBjmzQI7jjcYbGlBC8HgTir44vHWmJuz2
+lp14bEPVacJcvb7aBpIuaEk0Q++DuVzVtu4U3TzEXE/ViJQjkPdzQXfhM9v6TslV
++T0ebVVm5UL745G3BGhWaAOgwSuABvufVHXVvbHfUDcpW+sDCStUyD3JOyH2VJuN
+gpsuz1kFsM4eMCs9CVXFxJGDQxiLAcnRX4rngYnj+4M
+-> ssh-ed25519 7eGqHw Prblc9FRLxhXxffw1D061xTl7aBVLN1qbIC6wU2lLQ8
+rlifmY4sxITF3TKW6GXtGKCgyL2PZbza71mlf+pEZXo
+-> ssh-rsa tO3rGg
+KWwIfzOQf8ngvfmwMQzZQ7DfzMc+y7w35hZb4zmQ3YBr+Uzj9WE3MD91G63/kDjH
+w9qlYrdd5FGLlPJzx3S5j9S2BAnCTQ0lgaHb3m2ta8QAnfZVNTc31uY91raZdvJ5
+wEH43UsWqU7f+haakJ3PiXDrLvyDM3ZPpE3Z3JJU+ZntXrZOVBWuOYe1FcExvHyb
+rIUudxeQqlIG6Jph5m8crRP+GsNL7ApJAXwMVKCuvnsDv0XYqWVN085EnLBle7ar
+OIKI/Q9t5SK1Mvh9ktuojdzzRjg+HpoCpuh3AfxvmcDBmvERH96KVrB6Mi96uHxJ
+ML1O2GrjT2rpIuoqskO5ofrUMjUSqEOB6+QNU9mMiDbPzabn16DsIck3iohqDWd1
+HfaWeezEG/LdIsuBug9KTz+VcFLVugbdB0rpOO7CZ+EIdQb4tT2UCAjvnNaFJjQ0
+j/Nnry4ocThgLNn51HTPtLtPt3yh/6e7oRMrwLFB+Al8PDHZRuTWHPBqI/EpUs2A
+
+--- mFtuMJrCJ513/pq0hrc1f2pIoktElxa26jddGgXcje0
+E|W?r¤‘öm3ó_<C3B3>µ^íí¬lÐpÏœ.-ȈŽ7¾#™ôÝ”ã¿ïžþ
+£–ÇÎÄE 3û¥¯Œ

secrets/lastfm-secret.age

@@ -0,0 +1,27 @@
+age-encryption.org/v1
+-> ssh-rsa QXZdow
+k4xDfb04a7A3UTCe6a+rXCQuGv59nMqER6g8aAuObleC5cXI2ChH0LJO9cVCmvox
+UVh7jPhqKm9b2yGRzwdvtLHwIzJwoSXiwGXgJ66qTdWyoEKHBGYncMw1khPbY2p1
+TyBvd54b2fBEToGZfsrzKncDk/f75/50OAHXdWu7pOWTMnw7Q6zo7xCkkSQQ1oqQ
+s3IZf82bT1fsr48OApsvAnFgjJngwXd5sCd+1n5WJXRpxlLXUp95vpKp2Wn8/0Tr
+E76qBpkbxNWblqzz3ozo/WSinlUTSAKt9y3RjLHD49wXK2qAI3vyP8Eq22sqnXV9
+b8n+kTNVR3+d8ojjtd2cr6krOsCagqCPm890Jqx6+H8pNuzYS+DO5r7b8nUnknPz
+0HRx1h7Zc2CK85hT0NtllLqlAsp3eJSj6p3FV/mlefFw7YdFHsKLAf0rVQvcPvIa
+L3EPUs0cIGt58FHz0Cyj+9vGSMtqpN9RQAaL6FKl6T4CW2lpRevyrj4Kdpb1a3mU
+0HSnkoqjh39Wb34GCpq2Gcdw3m/nOTGIZkGfUuoC5rXVL5cRl8JDEm0+D2DZIsVB
+eGGUogvfuuZQLCbwX5dILsC7gRDfTHgSmM7LrVj0TimVKETogz3a2vyATK7MmHCy
+uhn9gp5HKYXjpjxgsRrUWl7JqZBqujyduBLu+VN/vL0
+-> ssh-ed25519 7eGqHw 8FRoz15ouOkUpDc8mVoNRHVdz/jZMkiKU8JaVizTTRg
+iGqUpOfnHxYMpThSf87yqqtKLyLbbANKlRxQ4DGwrjc
+-> ssh-rsa tO3rGg
+i9o0tQQnn4puU9d1yA9Vfy/8a2AC9MRhNZ08pd+q+YQuMLijyqD8fUuacpcoiXQj
+afZgBn/x0sD6N3zx9oOrTtL+H/utsp1N6SIlx7y/3Z/65qwgPu+AiC/zAjnV+5vS
++Ny8e7VPnY0/+Jho4hTtYPFCauMFHaV1or9ShX/wTM57893oRQzuhtufsh4TwfcU
+WRQKN7szRAcKnN7wB2wfcVzbGzucx+Q37Dro8qn6ZT7LIXP4qkoEmYnukkctlXDT
+yxDmSE8RNr8HUZEvNdJsYTIlwjG9Vpp/EULkNfIR5oJFYr6OWjco48IWW3EaqjeV
+XONL7OATIB1NUldH0C6EYNu6bHit5oe9WRUhkXpNFfsAKtLze71Rjb1ejzB1Jv5P
+xRXLbzcsuisgpo/R2pIAEyG2sRozF0fQS7JipiosACWAE3ZepKIZfT2G0IfPLUkI
+Z5+a7qRLw6OxUXfoLfhsFeb/tW7pFEm+oFzdGLcR06EhV0FzkkESyuTTxr8gOLKQ
+
+--- bDIHhN9Oo1GmQR/LwfzDuCfiWi/xE40rrupqfJZfv5k
+LØé­{<7B>ÄÖ—f€+”^` Ä¢w°ßñ‘þ©]þVáÝ~f-{žh2ºLO]ßü}êºÞkÔ"PÂ!—z†—

secrets/secrets.nix

@@ -12,4 +12,9 @@ in
   "restic-environment.age".publicKeys = pubkeys;
   "restic-passwords.age".publicKeys = pubkeys;
   "cloudflare.age".publicKeys = pubkeys;
+  "lastfm-key.age".publicKeys = pubkeys;
+  "lastfm-secret.age".publicKeys = pubkeys;
+  "spotify-id.age".publicKeys = pubkeys;
+  "spotify-secret.age".publicKeys = pubkeys;
+  "discogs.age".publicKeys = pubkeys;
 }

secrets/spotify-id.age

@@ -0,0 +1,27 @@
+age-encryption.org/v1
+-> ssh-rsa QXZdow
+lBdNlqhlpJ93wZGsRug3AC0etQa13DACtAbM+xbe/weSH26kQ/ByBcx1FSdAN4A4
+6yaVrpG+T1JLwUZQTGKkTAGWHOuKZ7EoN0EfYPVFjVIQfb/FUuB7ZDw9Mn+VFsgm
+gO7XdEi9PYGA0eMdc1a0Pg8fXNMSo7XuXYhC3tygS25Um8hwSn/LfCCfSOKs8gL7
+oXWNuemamidYrQLcDNcRKQuSkwVlUNN7C2+u7+55gYl3cCQocgxmYjF97UIwKjYp
+iSjJTB9WfeFWwFq/JLcf1DmPcaFs5w1qipHCe2LfT43EMsp89cHOE7Cs2++NWZLw
+iqu+IhlONAYa7dse5JbixQnD+tdfMRJFWuLZuGXvXShtYBnqTBI3d5CFuWFrdH0M
+cwTXnXv47Ehai8ybI/izeqrpsceX1QR92GmsdTVbINWUewppvR9WRXCZkb5FzWNZ
+jtfjxmnG/FpTqqD52+PepFsQQKULEj+iPw+XsiihnWnIw8XyclIkm7EbMSfB1jAg
+3mhZYWSY92kwqPr23xg4mvQjJDEiqFbWHmhXTdMOQebRV+L8BJzdeybInm/kTn8v
+avoCb7LEzji41zJW3Mc/hy5LaBslDfzk7kiXl5xn5VTYgAJbeL6ClasuQG+U7pk2
+HhO1b5RvryyGpCoYWaG6Psb4pQnyXv3kneCIGX+ES8E
+-> ssh-ed25519 7eGqHw PXDvB/Z6KRfKLejzDTg4W9KxbIrfPPfUJCxmRi8CuC8
+zPQb2zSLvV+vWvPnI7dNjYVmT6uOfxupcVwtVdEwasE
+-> ssh-rsa tO3rGg
+s6NIc6yEvYKMYLXtEgMUW4DJIOmEIvytwWwrYjSZ0nf0UX3FJ/E2ClL520MIBERq
+ALQWm8L0YTjPyCB1kAAHFaN7wdUyrGIjCPt5PuvNmZKvYc9MlTRLBz0dpQTBmjLY
+YwFbZwNjv7kT3STAYtoZUKzMI+LH9Nkj+pX2R2U1pItKuwZdC7y6/kyLO4t3mtwl
+IC6AeiVs8rEB6eUCPHqVAZbzLVUpTQiCVQYDXvaWn991lp5AsPr/wUc4pBkE6OUv
+L0yT2NpodeZKj6gCgaVoq0hzVDA5YeuW2uvMTTuNar/sfpW3ffYrxSw2D/g0o2So
+Z/OCzCohtQqyTzFO3vCbW2MqdtaSUkAimUZMydnua2wk0xOmMg15+1NxbIDbBKxO
+lkwLgy8ip2ptFmNklKoHOTjddo3kMZFESrLn7wgJYXgjV/bxYnxvDAF8xCxEb/ut
+KWgR17S0Fwtl3xsBEVQdhPH02AXQQQiDdourKKFhyJQgyKyPAjrFDglKeynwiJcg
+
+--- m22wYScxjP5MjYujDOF+ae/4Oi06BSfF4T42kYksMCg
+Xｴ@|ﾛ臓冦籖%qｻCﾔ汯ｱ:EKｻﾅﾚ既ﾅ9nｯﾄ斃ｿ鈞1ｻ8ﾉ[悪YU^ﾚ釶｡Ls(ｸ貲<EFBDB8>H<EFBFBD>

secrets/spotify-secret.age

@@ -0,0 +1,27 @@
+age-encryption.org/v1
+-> ssh-rsa QXZdow
+BfRVGeK/PkpDZLZ+t2pdV9npzaSmDNtOZ1HaKspFEi7yZi02+a4A9GHWeLU5RTmC
+RYsCgsEPMvkqpPLWp1nKB6S+5B2ZrZOpq7PkRPymJ9oD+UxhmvyOB4yVihXeO34Q
+d3yB6jxAN2w5lcZpgIDhwMyCl60wbcB9UfzFl9Z7qFXck07rGeigpb2SuTCz5J59
+l++BRpyG8XmPc3kLTU41nKZjF9L2l5zkRyraW3GAkQc4M5MFD7Lxkfdprd/2lAiy
+nQuWmp8uKRYn33oTMXSAYmtdkQ5G731OVLy8F6czKsOlg88gm2IrH642ogT1OihL
+goay4V6pbcu9DlZSHZKFVrClSN1/6kYgELcbLjHimq8NU8U5rqdC+xcVRvmQATf+
+tWcm9etKQ4pzfhMKaZDD+E8EVd5HF7C97TEZvkM2p7EHnz9vqXmkyZVVM2LQ3luJ
+v/kz7maWcWbifKOMKIg8VsdOCt14Puvmn9H5J1YZd/vjNgZZB9hOeSXgUIfLqQ1P
+HvVZiyGClgGhtNBbE0vazIXklSP2BxaorotmIlXB+KQRKjF+VLXj8svo2i1WclRe
+lnoQq+bsvV+TAnFDYSj3DZ3yXZ4VN6yHkz+vBHBvWZWUi20yhR791z+QZpEX95uf
+S33X+zuyyE0nyZHEOdOAy8HsNPiR1gta4f2aSU9smQk
+-> ssh-ed25519 7eGqHw XeIa/7XPhmXc7iY3N3vM4DTpUycnIULk8lKebmGPVFk
+hAhEikEFAMOCIT0py3Dv1Gx8LlavjvoyH7fOMVI4AwE
+-> ssh-rsa tO3rGg
+swqr1l/Z1zV3Z8c9hmpAAN4rOeL+HfWLqC6Y+lecg8cDgMDVxnspFChJxAcB2nVg
+NRTNSiDFpohBpbg8N24FGq974bMMcdgmNZ4frL7BbFhbZvJoU2xKTuf/LZN6if60
++zSZpeRZSVB43LyicjvhxgtIJ9gxI/jHrjuEN4H1yYC/QuVMfallTvuXapC2M82h
+om5k49VS0tU2rMRVAQtOoYya8DNLmvulDsr9Uj3uQvhtXawTmzQryAd+pD3KZ21L
++ugNiBD2jVSMdAHM5T7bR4/fqq0Kg2b9qh1IX0euTmaFTa4uwObgwmCNjdPN51+a
+IBfSKaVD+xMNsGItZnFahhcDUntZvfsM1UPPmj4ZdvpD+WxxnDLhbwL+l/dvqEin
+cfwlVQfVNkpm84ggvesQMwrHMGdfj/cROFKI6iK3xY+5sfK85lwYoEKdbRnS5WKU
+o1CxOCX4Pf0kMYXsuKmOkWnydKNeN56fPIyNWHWUwgE2XxjooartoJH4fQBsJLOu
+
+--- /+TRk43KDpHb4FrGQfhT6S1SDAoK54W770E181F+Q6M
+{gZEØåZÖò/­Ž¥wœØGøìî
""cÆP<7F>Ö<> øŸ
YØÄMÀ8¯a›½êÆÑ)‡M+‚YѾ‡|##