ookflix: segment modules

modules/nixos/server/services/ookflix/networking/gluetun.nix

@@ -0,0 +1,36 @@
+{
+  config,
+  lib,
+  ook,
+  self,
+  ...
+}: let
+  ookflixLib = import ../lib.nix {inherit self lib config;};
+  inherit (ookflixLib) mkServiceUser mkServiceSecret;
+  inherit (lib) mkIf;
+  inherit (ook.lib.container) mkContainerEnvironment;
+  inherit (config.ooknet.server.ookflix.services) qbittorrent gluetun;
+in {
+  config = mkIf gluetun.enable {
+    users = mkServiceUser gluetun.user.name;
+    age.secrets = mkServiceSecret "vpn_env" "gluetun";
+    virtualisation.oci-containers.containers = {
+      # vpn container
+      gluetun = mkIf gluetun.enable {
+        image = "qmcgaw/gluetun:latest";
+        # should make this an option.
+        environmentFiles = [config.age.secrets.vpn_env.path];
+        ports = [
+          "${toString qbittorrent.exposedPort}:${toString qbittorrent.port}"
+        ];
+        environment = mkContainerEnvironment gluetun.user.id gluetun.group.id;
+        extraOptions = [
+          # give network admin permissions
+          "--cap-add=NET_ADMIN"
+          # pass the network tunnel device
+          "--device=/dev/net/tun"
+        ];
+      };
+    };
+  };
+}