feat(etna): replace subsonic with navidrome

secrets/etna/navidromeEnv.age

@@ -0,0 +1,13 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyRHJ4MktEY3JFbWFRY25M
+VXlhY05oR3RDNDVuMG83bDhwbm5EcWdUT3p3ClpkeHc1cnpmcUZiMFlDYzR6UFV2
+K285THhwd3BzUUI3UE9pR05wUGlzSTAKLT4gWDI1NTE5IGhqanhuVEtXdXEzRnJI
+MTdER1A3c0hYVXAvY2h0Vlp6QW1JS3pyalIzbVEKbmxHQXVGN3FDdnhtT2k4STdx
+bngrVllxcUhPWERIOVhqSU9qNzJBazdRNAotPiBYMjU1MTkgQ3IzdDk0aEFCSXh2
+bW9rY3NUL2U4K1M1cmhqdklleDN4a1pSSHppU0RGNAozZmZwb05QSzVXU1podnNV
+TUlNN2JURkMvQlZ2VEQwSHU0aHZtWUE5UjFJCi0tLSBtaGM0Rk4wdzFIaGl1RGxG
+Tks1b3JjUHBvQmErMklVYzhOSm0wQ3ozMGgwCjE7EZVRSDqNB9M5eD9gBtcqP3cX
+HYyt8BiTtTQmk4+lyqbdA4vQPt2hLyRykX0NcoMvkBOME5bxdho1NKB03jR7kpZb
+2EJS2GxGyG57wIFfVOa5gcQHWaYbF69jYrO87Y06Nh5ujrL28FOWA9qUi3a5J7XF
+gAXsmWpOrPSq8qZlHeA6rg==
+-----END AGE ENCRYPTED FILE-----

secrets/secrets.nix

@@ -25,4 +25,5 @@ in {
   "etna/dendriteKey.age".publicKeys = main ++ [etna];
   "etna/nextcloudAdminPass.age".publicKeys = main ++ [etna];
   "etna/turnstileSecret.age".publicKeys = main ++ [etna];
+  "etna/navidromeEnv.age".publicKeys = main ++ [etna];
 }

systems/etna/default.nix

@@ -28,7 +28,7 @@ in {
     ./forgejo.nix
     ./shlink.nix
     ./metrics.nix
-    ./subsonic.nix
+    ./navidrome.nix
   ];
 
   boot = {

systems/etna/navidrome.nix

@@ -0,0 +1,35 @@
+{
+  config,
+  _utils,
+  ...
+}: let
+  cfg = config.services.navidrome;
+
+  env = _utils.setupSingleSecret config "navidromeEnv" {
+    inherit (cfg) group;
+    owner = cfg.user;
+  };
+in {
+  imports = [env.generate];
+
+  cfTunnels."navidrome.uku3lig.net" = "http://localhost:4533";
+
+  services.navidrome = {
+    enable = true;
+    settings = {
+      Address = "127.0.0.1";
+      Port = 4533;
+      MusicFolder = "/data/subsonic/music";
+      BaseUrl = "https://navidrome.uku3lig.net";
+    };
+  };
+
+  systemd.services.navidrome.serviceConfig = {
+    EnvironmentFile = env.path;
+    # https://github.com/NixOS/nixpkgs/pull/290901
+    BindReadOnlyPaths = [
+      "/run/systemd/resolve/stub-resolv.conf"
+      "/run/systemd/resolve/resolv.conf"
+    ];
+  };
+}

systems/etna/subsonic.nix

@@ -1,13 +0,0 @@
-{
-  cfTunnels."subsonic.uku3lig.net" = "http://localhost:4040";
-
-  services.subsonic = {
-    enable = true;
-    port = 4040;
-    maxMemory = 200;
-
-    defaultMusicFolder = "/data/subsonic/music";
-    defaultPlaylistFolder = "/data/subsonic/playlist";
-    defaultPodcastFolder = "/data/subsonic/podcast";
-  };
-}