nixos/overseerr: init

Co-authored-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -16,6 +16,8 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- [Overseerr](https://overseerr.dev), a request management and media discovery tool for the Plex ecosystem. Available as [services.overseerr](#opt-services.overseerr.enable).
+
 - [gtklock](https://github.com/jovanlanik/gtklock), a GTK-based lockscreen for Wayland. Available as [programs.gtklock](#opt-programs.gtklock.enable).
 - [Chrysalis](https://github.com/keyboardio/Chrysalis), a graphical configurator for Kaleidoscope-powered keyboards. Available as [programs.chrysalis](#opt-programs.chrysalis.enable).
 

nixos/modules/module-list.nix

@@ -878,6 +878,7 @@
   ./services/misc/open-webui.nix
   ./services/misc/orthanc.nix
   ./services/misc/osrm.nix
+  ./services/misc/overseerr.nix
   ./services/misc/owncast.nix
   ./services/misc/packagekit.nix
   ./services/misc/paperless.nix

nixos/modules/services/misc/overseerr.nix

@@ -0,0 +1,89 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.overseerr;
+in
+{
+  meta.maintainers = [ lib.maintainers.jf-uu ];
+
+  options.services.overseerr = {
+    enable = lib.mkEnableOption "Overseerr, a request management and media discovery tool for the Plex ecosystem";
+
+    package = lib.mkPackageOption pkgs "overseerr" { };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Open a port in the firewall for the Overseerr web interface.";
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 5055;
+      description = "The port which the Overseerr web UI should listen on.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.overseerr = {
+      description = "Request management and media discovery tool for the Plex ecosystem";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        CONFIG_DIRECTORY = "/var/lib/overseerr";
+        PORT = toString cfg.port;
+      };
+      serviceConfig = {
+        CapabilityBoundingSet = "";
+        DynamicUser = true;
+        ExecStart = lib.getExe cfg.package;
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateIPC = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        Restart = "on-failure";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        StateDirectory = "overseerr";
+        StateDirectoryMode = "0700";
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        Type = "exec";
+      };
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
+  };
+}

nixos/tests/all-tests.nix

@@ -688,6 +688,7 @@ in
     _module.args.package = pkgs.odoo16;
   };
   oncall = runTest ./web-apps/oncall.nix;
+  overseerr = runTest ./overseerr.nix;
   # 9pnet_virtio used to mount /nix partition doesn't support
   # hibernation. This test happens to work on x86_64-linux but
   # not on other platforms.

nixos/tests/overseerr.nix

@@ -0,0 +1,20 @@
+{ lib, pkgs, ... }:
+{
+  name = "overseerr";
+  meta.maintainers = with lib.maintainers; [ jf-uu ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.jq ];
+      services.overseerr.enable = true;
+    };
+
+  testScript = ''
+    machine.wait_for_unit("overseerr.service")
+    machine.wait_for_open_port(5055)
+
+    version = machine.succeed("curl --fail http://localhost:5055/api/v1/status | jq --raw-output .version").rstrip("\n")
+    assert version == "${pkgs.overseerr.version}", f"expected version to be ${pkgs.overseerr.version}, got {version}"
+  '';
+}