From e753b241863fc9a26714b981b9a609470b976234 Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Fri, 21 Aug 2026 20:00:41 +0200
Subject: migrate navidrome

---
 hosts/sagittarius/web/default.nix   |  1 -
 hosts/sagittarius/web/navidrome.nix | 46 -------------------------------------
 hosts/tower/web/caddy.nix           | 18 +++++++++++++++
 hosts/tower/web/default.nix         |  2 +-
 hosts/tower/web/navidrome.nix       | 37 ++++-------------------------
 5 files changed, 23 insertions(+), 81 deletions(-)
 delete mode 100644 hosts/sagittarius/web/navidrome.nix

(limited to 'hosts')

diff --git a/hosts/sagittarius/web/default.nix b/hosts/sagittarius/web/default.nix
index 4a7a529..c0b9d3b 100644
--- a/hosts/sagittarius/web/default.nix
+++ b/hosts/sagittarius/web/default.nix
@@ -4,6 +4,5 @@
     # ./blog.nix
     # ./mediadb.nix
     # ./static.nix
-    # ./navidrome.nix
   ];
 }
diff --git a/hosts/sagittarius/web/navidrome.nix b/hosts/sagittarius/web/navidrome.nix
deleted file mode 100644
index 6992b28..0000000
--- a/hosts/sagittarius/web/navidrome.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{ config, ... }:
-let
-  cfg = config.services.navidrome;
-  secrets = config.sops.secrets;
-  domain = "music.sorre.internal";
-in
-{
-  services.navidrome = {
-    enable = false;
-    settings = {
-      MusicFolder = "/var/navidrome/music";
-      DataFolder = "/var/navidrome/data";
-      BaseUrl = "https://${domain}";
-      Port = 4533;
-      Address = "127.0.0.1";
-      openFirewall = false;
-    };
-  };
-
-  services.nginx = {
-    # enable = false;
-
-    virtualHosts."navidrome" = {
-      serverName = domain;
-      forceSSL = true;
-      listen = [
-        {
-          addr = "100.64.0.3";
-          port = 443;
-          ssl = true;
-        }
-      ];
-
-      sslCertificateKey = secrets."wg-ca-key".path;
-      sslCertificate = secrets."wg-ca-crt".path;
-
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:${toString cfg.settings.Port}";
-        recommendedProxySettings = true;
-        extraConfig = ''
-          proxy_buffering off;
-        '';
-      };
-    };
-  };
-}
diff --git a/hosts/tower/web/caddy.nix b/hosts/tower/web/caddy.nix
index 37b6092..0335058 100644
--- a/hosts/tower/web/caddy.nix
+++ b/hosts/tower/web/caddy.nix
@@ -6,6 +6,11 @@ let
     domain = config.services.vaultwarden.domain;
     port = config.services.vaultwarden.config.ROCKET_PORT;
   };
+
+  navidrome = {
+    domain = "music.sorre.internal";
+    port = config.services.navidrome.settings.Port;
+  };
 in
 {
   services.caddy = {
@@ -22,6 +27,19 @@ in
           }
         '';
       };
+
+      "${navidrome.domain}" = {
+        listenAddresses = [ "100.64.0.6" ];
+        extraConfig = ''
+          tls {$CREDENTIALS_DIRECTORY}/sagittarius.crt {$CREDENTIALS_DIRECTORY}/sagittarius.key
+
+          reverse_proxy :${toString navidrome.port} {
+            header_up True-Client-IP {remote_host}
+            header_up X-Real-IP {remote_host}
+            flush_interval -1
+          }
+        '';
+      };
     };
   };
 
diff --git a/hosts/tower/web/default.nix b/hosts/tower/web/default.nix
index b46bc80..2cc2e56 100644
--- a/hosts/tower/web/default.nix
+++ b/hosts/tower/web/default.nix
@@ -4,7 +4,7 @@
     # ./blog.nix
     ./git.nix
     # ./static.nix
-    # ./navidrome.nix
+    ./navidrome.nix
     ./vaultwarden.nix
     ./caddy.nix
   ];
diff --git a/hosts/tower/web/navidrome.nix b/hosts/tower/web/navidrome.nix
index 70d2779..7b99d9f 100644
--- a/hosts/tower/web/navidrome.nix
+++ b/hosts/tower/web/navidrome.nix
@@ -1,46 +1,17 @@
-{ config, ... }:
+{ ... }:
 let
-  cfg = config.services.navidrome;
-  # secrets = config.sops.secrets;
   domain = "music.sorre.internal";
 in
 {
   services.navidrome = {
-    enable = false;
+    enable = true;
     settings = {
-      MusicFolder = "/var/navidrome/music";
-      DataFolder = "/var/navidrome/data";
+      MusicFolder = "/var/lib/navidrome/music";
+      DataFolder = "/var/lib/navidrome/data";
       BaseUrl = "https://${domain}";
       Port = 4533;
       Address = "127.0.0.1";
       openFirewall = false;
     };
   };
-
-  services.nginx = {
-    enable = true;
-
-    virtualHosts."navidrome" = {
-      serverName = domain;
-      # forceSSL = true;
-      listen = [
-        {
-          addr = "100.64.0.3";
-          port = 443;
-          # ssl = true;
-        }
-      ];
-
-      # sslCertificateKey = secrets."wg-ca-key".path;
-      # sslCertificate = secrets."wg-ca-crt".path;
-
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:${toString cfg.settings.Port}";
-        recommendedProxySettings = true;
-        extraConfig = ''
-          proxy_buffering off;
-        '';
-      };
-    };
-  };
 }
-- 
cgit v1.3.1