From 319d292fa0f5b3699f07780092b87ebe115e432f Mon Sep 17 00:00:00 2001
From: Lucien Cartier-Tilet <lucien@phundrak.com>
Date: Mon, 4 Aug 2025 21:39:49 +0200
Subject: [PATCH] feat(tilo): add Plex configuration for Tilo

---
 hosts/tilo/configuration.nix |  4 ++++
 system/services/default.nix  |  1 +
 system/services/plex.nix     | 35 +++++++++++++++++++++++++++++++++++
 3 files changed, 40 insertions(+)
 create mode 100644 system/services/plex.nix

diff --git a/hosts/tilo/configuration.nix b/hosts/tilo/configuration.nix
index 1d350b6..86059bb 100644
--- a/hosts/tilo/configuration.nix
+++ b/hosts/tilo/configuration.nix
@@ -39,6 +39,10 @@
     };
     services = {
       endlessh.enable = true;
+      plex = {
+        enable = true;
+        dataDir = "/tank/web/stacks/plex/plex-config";
+      };
       ssh = {
         enable = true;
         allowedUsers = ["phundrak"];
diff --git a/system/services/default.nix b/system/services/default.nix
index 1b7c892..772d7bc 100644
--- a/system/services/default.nix
+++ b/system/services/default.nix
@@ -2,6 +2,7 @@
   imports = [
     ./endlessh.nix
     ./fwupd.nix
+    ./plex.nix
     ./printing.nix
     ./ssh.nix
     ./sunshine.nix
diff --git a/system/services/plex.nix b/system/services/plex.nix
new file mode 100644
index 0000000..70912b0
--- /dev/null
+++ b/system/services/plex.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  config,
+  ...
+}:
+with lib; let
+  cfg = config.system.services.plex;
+in {
+  options.system.services.plex = {
+    enable = mkEnableOption "Enable Plex";
+    group = mkOption {
+      type = types.string;
+      default = "users";
+      example = "users";
+      description = "Group under which Plex runs";
+    };
+    dataDir = mkOption {
+      type = types.string;
+      example = "/tank/plex-config";
+    };
+    user = mkOption {
+      type = types.string;
+      default = "phundrak";
+    };
+  };
+  config = {
+    services.plex = mkIf cfg.enable {
+      inherit (cfg) enable user group dataDir;
+      openFirewall = cfg.enable;
+    };
+    boot.kernel.sysctl = {
+      "kernel.unprivileged_userns_clone" = 1;
+    };
+  };
+}