Add Jellyfin and Servarr utilities

lily/config.nix

···
     ../modules/services/caddy
     ../modules/services/caddy/atproto-did.nix
     ../modules/services/caddy/cp-certs.nix
+    ../modules/services/caddy/jellyfin.nix
     ../modules/services/caddy/mumble.nix
     ../modules/services/caddy/nextcloud.nix
     ../modules/services/caddy/pds.nix
···
     ../modules/services/caddy/websites/pink-meyou.nix
     ../modules/services/caddy/websites/pink-yemou.nix
 
+    ../modules/services/arr.nix
+    ../modules/services/jellyfin.nix
     ../modules/services/murmur.nix
     ../modules/services/nextcloud.nix
     ../modules/services/openssh.nix

modules/services/arr.nix

···
+{ config, ... }:
+{
+  environment.persistence."/data/persistent".directories = [
+    # NOTE: Prowlarr isn't here since it uses /var/lib/private/prowlarr as its directory regardless and this directory
+    #       is already in nixos-impermanence
+    {
+      directory = "/var/lib/radarr";
+      mode = "0700";
+      user = config.services.radarr.user;
+      group = config.services.radarr.group;
+    }
+    {
+      directory = "/var/lib/sonarr";
+      mode = "0700";
+      user = config.services.sonarr.user;
+      group = config.services.sonarr.group;
+    }
+  ];
+
+  sops = {
+    secrets = {
+      "prowlarr-apikey" = { };
+      "radarr-apikey" = { };
+      "sonarr-apikey" = { };
+    };
+    templates = {
+      prowlarr-env.content = "PROWLARR__AUTH__APIKEY=${config.sops.placeholder."prowlarr-apikey"}";
+      radarr-env.content = "RADARR__AUTH__APIKEY=${config.sops.placeholder."radarr-apikey"}";
+      sonarr-env.content = "SONARR__AUTH__APIKEY=${config.sops.placeholder."sonarr-apikey"}";
+    };
+  };
+
+  networking.firewall.interfaces.${config.services.netbird.clients.homelab.interface}.allowedTCPPorts = [
+    config.services.prowlarr.settings.server.port
+    config.services.radarr.settings.server.port
+    config.services.sonarr.settings.server.port
+  ];
+
+  services = {
+    flaresolverr.enable = true;
+    prowlarr = {
+      enable = true;
+      environmentFiles = [ config.sops.templates.prowlarr-env.path ];
+      settings.log.level = "info";
+    };
+    radarr = {
+      enable = true;
+      environmentFiles = [ config.sops.templates.radarr-env.path ];
+      settings.log.level = "info";
+    };
+    sonarr = {
+      enable = true;
+      environmentFiles = [ config.sops.templates.sonarr-env.path ];
+      settings.log.level = "info";
+    };
+  };
+
+  systemd.services.flaresolverr.serviceConfig.RestrictAddressFamilies = [ "~AF_INET6" ];
+}

modules/services/caddy/jellyfin.nix

···
+{ ... }:
+{
+  services.caddy.virtualHosts."jellyfin.lilac.pink".extraConfig = ''
+    encode
+    reverse_proxy [::1]:8096
+  '';
+}

modules/services/jellyfin.nix

···
+{ pkgs, ... }:
+{
+  imports = [ ../unfree.nix ];
+
+  environment.persistence."/data/persistent".directories = [
+    {
+      directory = "/var/cache/jellyfin";
+      mode = "0700";
+      user = "jellyfin";
+      group = "jellyfin";
+    }
+    {
+      directory = "/var/lib/jellyfin";
+      mode = "0700";
+      user = "jellyfin";
+      group = "jellyfin";
+    }
+  ];
+
+  hardware.graphics = {
+    enable = true;
+    extraPackages = with pkgs; [
+      intel-compute-runtime
+      intel-media-driver
+      vpl-gpu-rt
+    ];
+  };
+
+  users.users.jellyfin.extraGroups = [
+    "render"
+    "video"
+  ];
+
+  services.jellyfin.enable = true;
+}

secrets/lily.yaml

···
     private-key: ENC[AES256_GCM,data:TH+OewaIzba5Ysyu0tHiS8LnftPB1dJt+BDvkgA7l0PnbBjPt4HCwib+Vjo=,iv:AGQ2S7Sjl6SD/SzsX8bv9yavlPOlgwxuR56VBovt5vE=,tag:pT/C5u81Ws0+DbO+ffW4SQ==,type:str]
     public-key: ENC[AES256_GCM,data:RIh3I7STHUx+N8sBSW9z1b1CTPIflDBNY4TqWRpNPAn9SJIB76UrVXVYzC4=,iv:QT4a+JHK6TN6BWQlv/d26Yx/fH+S3T9G8RnYgWCHlkY=,tag:YRqXSXCuDyfy71bczyfMjg==,type:str]
 radarr-apikey: ENC[AES256_GCM,data:7FLygsV20gXqnT/T7fxW8kajcDN6OiA/LIIrYUYx8y8=,iv:YreEg2rnm+ghAH3FiabqdRx7lYfZLO6uEhKqDAA4gA4=,tag:n/xCQAHF1b5a0lIfkfI3CQ==,type:str]
+sonarr-apikey: ENC[AES256_GCM,data:CTmGQN0k2iQknPOSxfyckBemY1Bp1SPLeHTuUBwxH6E=,iv:gtQ0hZQ+YKEYDEDOyQUG58xAxyjSHZU9CVanyh/1bL8=,tag:cRPIb9nUZYxvtFnoqAxwRQ==,type:str]
+prowlarr-apikey: ENC[AES256_GCM,data:w5pQjQed4qbqLWI4STNvqCi6p0VMy8LvzenPsKZRMmk=,iv:BbZGwTUjFh3XI47mUi3ctZhvQsqhD65HNiXJlrcTL0o=,tag:UWCn3Zy49AC0/O0nsAOLnw==,type:str]
 sops:
     age:
         - recipient: age1amaa55e7nusv904a9ucfvtnjlw4srtet42suehey6u3yc4t2xc5sdldepj
···
             cHlWQjF3ZkU5NUs0Y1hodUlabkxpdzAK91EV34EhJMrxxdVrRCwZlGKuRs7AU7v3
             dU8XRhjAzJs2Vu5UnCVOGB5Zl6w7FkXICYY0IP2dA0b477dI5rXNBg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-06T18:29:46Z"
-    mac: ENC[AES256_GCM,data:p5JjCTx4iqsXO/5bAKixr1sgxFoXodt7uoFDXMAKB3Yxq49xENZVL5S9ZbpwMmUB6Cl8LbMHMoAtrB6ab5LMYEKnGOSPVNilzJmSs18itHloel25wck++sO2589JkO55Ic781H5wDD7L7EifuRbDx3i4U3DgxOP1soTcQTpflzo=,iv:ukTDYeOuogWzbuXo9z+ClcwSfLRoVoJ2lvOmO2gjPyw=,tag:piR0FhjJqAzMkaZgiBFbDQ==,type:str]
+    lastmodified: "2025-12-07T06:49:15Z"
+    mac: ENC[AES256_GCM,data:ptj1uTNOu6g1VykpoeoltS0L6di8dVvVzXeIY7LEvCvqo+u74DlGQXJPvpVZPif3t9tHg65aqJShQeu461AMZBbCDOzImTMY23KABpBCaXvN8C+krTynPMan3C1fHrJmHFOXXFBT4V5ecdowopIdybUsoJ3H18jPZ629VngPgjE=,iv:q9+6Aa6LYg3TeRZZf0kRr3ssNB2igMhLg6MweDbQv3A=,tag:Lb7E/RT/tPJE1TyQf6dnyA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0