modules/nixos/services/arr/jellyfin/default.nix

@@ -38,12 +38,12 @@
       hardware.graphics = {
         enable = true;
         extraPackages = with pkgs; [
-          intel-compute-runtime
           intel-media-driver
-          intel-vaapi-driver
+          intel-compute-runtime
-          libvdpau-va-gl
-          vaapiVdpau
           vpl-gpu-rt
+          vaapiIntel
+          vaapiVdpau
+          libvdpau-va-gl
         ];
       };
 

modules/nixos/services/fail2ban/default.nix

@@ -28,7 +28,7 @@
           factor = "4";
         };
 
-        ignoreIP =
+        ignoreIPs =
           [
             "192.168.69.0/16"
             "172.16.0.0/12"
@@ -38,11 +38,9 @@
 
         jails = {
           DEFAULT = {
-            settings = {
+            blocktype = "DROP";
-              blocktype = "DROP";
+            bantime = "6h";
-              bantime = lib.mkDefault "6h";
+            findtime = "6h";
-              findtime = "6h";
-            };
           };
 
           sshd = {
@@ -58,12 +56,10 @@
           };
 
           port-scan = {
-            settings = {
+            filter = "port-scan";
-              filter = "port-scan";
+            action = "iptables-allports[name=port-scan]";
-              action = "iptables-allports[name=port-scan]";
+            bantime = 86400;
-              bantime = 86400;
+            maxretry = 2;
-              maxretry = 2;
-            };
           };
         };
       };

modules/nixos/services/nginx/default.nix

@@ -55,18 +55,12 @@
               return 444;
             }
           ''
-          + lib.optionalString cfg.enableCloudflareRealIP ''
+          ++ lib.optionalString cfg.enableCloudflareRealIP ''
             ${lib.concatMapStrings (ip: "set_real_ip_from ${ip};\n")
               (lib.filter (line: line != "")
                 (lib.splitString "\n" ''
-                  ${lib.readFile (builtins.fetchurl {
+                  ${lib.readFile (lib.fetchurl "https://www.cloudflare.com/ips-v4/")}
-                    url = "https://www.cloudflare.com/ips-v4/";
+                  ${lib.readFile (lib.fetchurl "https://www.cloudflare.com/ips-v6/")}
-                    sha256 = "sha256-8Cxtg7wBqwroV3Fg4DbXAMdFU1m84FTfiE5dfZ5Onns=";
-                  })}
-                  ${lib.readFile (builtins.fetchurl {
-                    url = "https://www.cloudflare.com/ips-v6/";
-                    sha256 = "sha256-np054+g7rQDE3sr9U8Y/piAp89ldto3pN9K+KCNMoKk=";
-                  })}
                 ''))}
             real_ip_header CF-Connecting-IP;
           '';

modules/nixos/services/postgresql/default.nix

@@ -9,11 +9,12 @@
 
     package = lib.mkOption {
       type = lib.types.package;
-      default = pkgs.postgresql_16;
+      default = pkgs.postgresql_14;
-      description = "Package to use for the PostgreSQL service";
+      description = "Package to use as a root directory for the static site";
     };
 
     backup.enable = lib.mkEnableOption "Enable backup service for postgresql databases";
+    upgrade.enable = lib.mkEnableOption "Enable upgrade-pg-cluster script for postgresql";
   };
 
   config = let
@@ -59,5 +60,38 @@
             echo ${curFile}
           '';
         };
+
+      # NOTE: login with `sudo su -` and run `upgrade-pg-cluster` to perform
+      # the upgrade. Ensure that you run `VACUUMDB` commands after the upgrade,
+      # and then update the postgres package version in the service config.
+      environment.systemPackages = lib.mkIf cfg.upgrade.enable [
+        (let
+          newPostgres = pkgs.postgresql_16.withPackages (ps: [
+            # Immich requires pgvecto-rs
+            ps.pgvecto-rs
+          ]);
+        in
+          pkgs.writeScriptBin "upgrade-pg-cluster" ''
+            set -eux
+            # It's perhaps advisable to stop all services that depend on postgresql
+            systemctl stop postgresql
+
+            export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}"
+
+            export NEWBIN="${newPostgres}/bin"
+
+            export OLDDATA="${config.services.postgresql.dataDir}"
+            export OLDBIN="${config.services.postgresql.package}/bin"
+
+            install -d -m 0700 -o postgres -g postgres "$NEWDATA"
+            cd "$NEWDATA"
+            sudo -u postgres $NEWBIN/initdb -D "$NEWDATA"
+
+            sudo -u postgres $NEWBIN/pg_upgrade \
+              --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \
+              --old-bindir $OLDBIN --new-bindir $NEWBIN \
+              "$@"
+          '')
+      ];
     };
 }

packages/vuetorrent/default.nix

@@ -6,11 +6,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "vuetorrent";
-  version = "2.13.3";
+  version = "2.10.2";
 
   src = pkgs.fetchurl {
     url = "https://github.com/WDaan/VueTorrent/releases/download/v${version}/vuetorrent.zip";
-    sha256 = "sha256-MmzJhzRqlYhcHbvz4ycCobclZ9Idpranyh+doDEdoh8=";
+    sha256 = "sha256-pJzj3jHXmpKca1zyOTlzUQvp7/LtjjMGNt9SMDo89yo=";
   };
 
   buildInputs = with pkgs; [unzip];

systems/x86_64-linux/bicboye/default.nix

@@ -143,6 +143,7 @@
       postgresql = {
         enable = true;
         backup.enable = true;
+        upgrade.enable = true;
       };
 
       vaultwarden = {

systems/x86_64-linux/bicboye/hardware.nix

@@ -96,7 +96,7 @@ _: {
     };
 
     "/storage/media" = {
-      device = "/dev/disk/by-uuid/8cf1e73e-39fe-4e5d-a2ec-652e51931f27";
+      device = "/dev/disk/by-uuid/f8aadf58-d561-476b-a2c5-64b266dc5755";
       fsType = "btrfs";
       options = [
         "defaults"