From a0eda06da1f24cd10ee99435af6618d0c8195066 Mon Sep 17 00:00:00 2001 From: Haak Saxberg Date: Sun, 10 Jul 2022 23:19:48 -0700 Subject: [PATCH] plex and torrent and nginx forwarding i know it's not "the best" to have plex set up as my own user but i don't intend to expose this machine outisde of the home network anyway. the ROI on figuring out how to get files downloaded somwhere that a separate plex user can scan is not worth it. --- nix/system/nas-configuration.nix | 129 ++++++++++++++++++++++--------- 1 file changed, 92 insertions(+), 37 deletions(-) diff --git a/nix/system/nas-configuration.nix b/nix/system/nas-configuration.nix index db254b5..9fa64af 100644 --- a/nix/system/nas-configuration.nix +++ b/nix/system/nas-configuration.nix @@ -48,41 +48,108 @@ # $ nix search wget environment.systemPackages = with pkgs; [ cachix - calibre firefox - inkscape + # configure local network sharing, launch app on startup, and auto-connect + # in the preferences menu + mullvad-vpn p7zip - plasma-browser-integration - slack - vim - vlc + # Do NOT use qbittorrent unless you have set up interface binding with your + # VPN: https://web.archive.org/web/20210426203101/https://mullvad.net/en/help/bittorrent/ + qbittorrent wget - xclip - zathura zsh ]; nixpkgs.config.allowUnfree = true; - nixpkgs.config.firefox.enablePlasmaBrowserIntegration = true; fonts.fonts = with pkgs; [ fira-code ]; # Open ports in the firewall. networking.firewall = { allowedTCPPorts = [ - 631 # CUPs port for printing - 6881 # port for torrenting - 8010 # port for VLC to chromecast - ]; - allowedUDPPorts = [ - 631 - 6881 - 8010 + 22 # for ssh access + 80 + 8080 # port for qbittorrent webui ]; }; # Or disable the firewall altogether. # networking.firewall.enable = false; + # Nginx Reverse SSL Proxy + services.nginx = { + enable = true; + # give a name to the virtual host. It also becomes the server name. + virtualHosts."sub.domain.tld" = { + # http2 can more performant for streaming: https://blog.cloudflare.com/introducing-http2/ + http2 = true; + + # Provide the ssl cert and key for the vhost + extraConfig = '' + + #Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause + send_timeout 100m; + + # Why this is important: https://blog.cloudflare.com/ocsp-stapling-how-cloudflare-just-made-ssl-30/ + # ssl_stapling on; + # ssl_stapling_verify on; + + # ssl_protocols TLSv1 TLSv1.1 TLSv1.2; + # ssl_prefer_server_ciphers on; + #Intentionally not hardened for security for player support and encryption video streams has a lot of overhead with something like AES-256-GCM-SHA384. + # ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'; + + # Forward real ip and host to Plex + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Host $server_addr; + proxy_set_header Referer $server_addr; + proxy_set_header Origin $server_addr; + + # Plex has A LOT of javascript, xml and html. This helps a lot, but if it causes playback issues with devices turn it off. + gzip on; + gzip_vary on; + gzip_min_length 1000; + gzip_proxied any; + gzip_types text/plain text/css text/xml application/xml text/javascript application/x-javascript image/svg+xml; + gzip_disable "MSIE [1-6]\."; + + # Nginx default client_max_body_size is 1MB, which breaks Camera Upload feature from the phones. + # Increasing the limit fixes the issue. Anyhow, if 4K videos are expected to be uploaded, the size might need to be increased even more + client_max_body_size 100M; + + # Plex headers + proxy_set_header X-Plex-Client-Identifier $http_x_plex_client_identifier; + proxy_set_header X-Plex-Device $http_x_plex_device; + proxy_set_header X-Plex-Device-Name $http_x_plex_device_name; + proxy_set_header X-Plex-Platform $http_x_plex_platform; + proxy_set_header X-Plex-Platform-Version $http_x_plex_platform_version; + proxy_set_header X-Plex-Product $http_x_plex_product; + proxy_set_header X-Plex-Token $http_x_plex_token; + proxy_set_header X-Plex-Version $http_x_plex_version; + proxy_set_header X-Plex-Nocache $http_x_plex_nocache; + proxy_set_header X-Plex-Provides $http_x_plex_provides; + proxy_set_header X-Plex-Device-Vendor $http_x_plex_device_vendor; + proxy_set_header X-Plex-Model $http_x_plex_model; + + # Websockets + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + + # Buffering off send to the client as soon as the data is received from Plex. + proxy_redirect off; + proxy_buffering off; + ''; + locations."/" = { + proxyPass = "http://localhost:32400/"; + }; + }; + }; + + # VPN setup + services.mullvad-vpn.enable = true; + networking.wireguard.enable = true; # Some programs need SUID wrappers, can be configured further or are # started in user sessions. @@ -92,32 +159,20 @@ # List services that you want to enable: # Enable the OpenSSH daemon. - # services.openssh.enable = true; - - # Enable CUPS to print documents. - services.printing = { - enable = true; - drivers = [ pkgs.hplip ]; - }; - # enable avahi for printer discovery - services.avahi = { - enable = true; - nssmdns = true; - }; - - # Enable sound. - sound.enable = true; - hardware.pulseaudio = { - enable = true; - # The full package is necessary to allow bluetooth audio devices. - package = pkgs.pulseaudioFull; - }; + services.openssh.enable = true; # Enable the X11 windowing system. services.xserver.enable = true; services.xserver.layout = "us"; services.xserver.xkbOptions = "caps:swapescape"; + services.plex = { + enable = true; + openFirewall = true; + user = "haak"; + group = "users"; + }; + # Enable touchpad support. services.xserver.libinput.enable = true;