refactor: split server modules into smaller more manageable files

modules/nixos-modules/server/jellyfin/default.nix

@@ -0,0 +1,48 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}: let
+  jellyfinPort = 8096;
+  dlanPort = 1900;
+in {
+  imports = [
+    ./proxy.nix
+    ./fail2ban.nix
+    ./impermanence.nix
+  ];
+
+  options.services.jellyfin = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+      description = "subdomain of base domain that jellyfin will be hosted at";
+      default = "jellyfin";
+    };
+    extraSubdomains = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = "ex subdomain of base domain that jellyfin will be hosted at";
+      default = [];
+    };
+    media_directory = lib.mkOption {
+      type = lib.types.str;
+      description = "directory jellyfin media will be hosted at";
+      default = "/srv/jellyfin/media";
+    };
+  };
+
+  config = lib.mkIf config.services.jellyfin.enable {
+    environment.systemPackages = [
+      pkgs.jellyfin
+      pkgs.jellyfin-web
+      pkgs.jellyfin-ffmpeg
+    ];
+
+    networking.firewall.allowedTCPPorts = [jellyfinPort dlanPort];
+
+    systemd.tmpfiles.rules = [
+      "d ${config.services.jellyfin.media_directory} 2770 jellyfin jellyfin_media"
+      "A ${config.services.jellyfin.media_directory} -    -        -               - u:jellyfin:rwX,g:jellyfin_media:rwX,o::-"
+    ];
+  };
+}

modules/nixos-modules/server/jellyfin/fail2ban.nix

@@ -0,0 +1,32 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}: {
+  config = lib.mkIf (config.services.jellyfin.enable && config.services.fail2ban.enable) {
+    environment.etc = {
+      "fail2ban/filter.d/jellyfin.local".text = (
+        pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
+          [Definition]
+          failregex = "^.*Authentication request for .* has been denied \\\\\\(IP: \\\"<ADDR>\\\"\\\\\\)\\\\\\."
+        '')
+      );
+    };
+
+    services.fail2ban = {
+      jails = {
+        jellyfin-iptables.settings = {
+          enabled = true;
+          filter = "jellyfin";
+          action = ''iptables-multiport[name=HTTP, port="http,https"]'';
+          logpath = "${config.services.jellyfin.dataDir}/log/*.log";
+          backend = "auto";
+          findtime = 600;
+          bantime = 600;
+          maxretry = 5;
+        };
+      };
+    };
+  };
+}

modules/nixos-modules/server/jellyfin/impermanence.nix

@@ -0,0 +1,66 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  jellyfin_data_directory = "/var/lib/jellyfin";
+  jellyfin_cache_directory = "/var/cache/jellyfin";
+in {
+  config = lib.mkIf (config.services.jellyfin.enable && config.host.impermanence.enable) {
+    fileSystems."/persist/system/jellyfin".neededForBoot = true;
+
+    host.storage.pool.extraDatasets = {
+      # sops age key needs to be available to pre persist for user generation
+      "persist/system/jellyfin" = {
+        type = "zfs_fs";
+        mountpoint = "/persist/system/jellyfin";
+        options = {
+          atime = "off";
+          relatime = "off";
+          canmount = "on";
+        };
+      };
+    };
+
+    assertions = [
+      {
+        assertion = config.services.jellyfin.dataDir == jellyfin_data_directory;
+        message = "jellyfin data directory does not match persistence";
+      }
+      {
+        assertion = config.services.jellyfin.cacheDir == jellyfin_cache_directory;
+        message = "jellyfin cache directory does not match persistence";
+      }
+    ];
+
+    environment.persistence = {
+      "/persist/system/root" = {
+        directories = [
+          {
+            directory = jellyfin_data_directory;
+            user = "jellyfin";
+            group = "jellyfin";
+          }
+          {
+            directory = jellyfin_cache_directory;
+            user = "jellyfin";
+            group = "jellyfin";
+          }
+        ];
+      };
+
+      "/persist/system/jellyfin" = {
+        enable = true;
+        hideMounts = true;
+        directories = [
+          {
+            directory = config.services.jellyfin.media_directory;
+            user = "jellyfin";
+            group = "jellyfin_media";
+            mode = "1770";
+          }
+        ];
+      };
+    };
+  };
+}

modules/nixos-modules/server/jellyfin/proxy.nix

@@ -0,0 +1,25 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  jellyfinPort = 8096;
+in {
+  config = lib.mkIf (config.services.jellyfin.enable && config.host.reverse_proxy.enable) {
+    host.reverse_proxy.subdomains.jellyfin = {
+      target = "http://localhost:${toString jellyfinPort}";
+
+      subdomain = config.services.jellyfin.subdomain;
+      extraSubdomains = config.services.jellyfin.extraSubdomains;
+
+      forwardHeaders.enable = true;
+
+      extraConfig = ''
+        client_max_body_size 20M;
+        add_header X-Content-Type-Options "nosniff";
+
+        proxy_buffering off;
+      '';
+    };
+  };
+}