nimmo/nixos-config

Watch

Fork 0

Deploy slskd on chaos (Soulseek daemon with share-back) #192

New issue

Closed

opened 2026-08-26 04:37:59 +01:00 by nimmo · 3 comments

nimmo commented

2026-08-26 04:37:59 +01:00

Owner

Goal

Run slskd (Soulseek daemon) as a Nix-managed OCI container on chaos, logged into the Soulseek network and sharing back from the shared NAS music library.

Decisions made

Target host: chaos (the docker workload VM).
Share-back is a requirement: many Soulseek users block leechers. Shares point at the NAS Music library (read-only usage by slskd).
Downloads stage on the NAS so synthseek/Beets can organise them into media/Music, where vega's Navidrome (read-only NFS view) picks them up automatically.
Precedent for a read-write NAS mount: sabnzbd on vega mounts 192.168.8.238:/volume1/media over NFS (no ro) at /srv/media.
slskd's own web UI stays internal (loopback / docker network only). Synthseek drives it through the API; Pangolin exposure is out of scope for this issue.

Tasks

Enable boot.supportedFilesystems = [ "nfs" ] on chaos (module or host level)
Read-write NFS mount of 192.168.8.238:/volume1/media on chaos using the sabnzbd option set plus nofail
New modules/containers/slskd.nix following the killarr pattern: pinned image version, nixosConfig.slskd.* options, imported by hosts/chaos/default.nix
Container state under /srv/stacks/slskd (already inside chaos's backup dataPaths)
New SOPS file secrets/slskd.yaml holding Soulseek username/password and an slskd API key; add its creation rule to .sops.yaml (admin keys + chaos)
slskd config YAML rendered from SOPS at runtime: credentials, download dir pointing at the NAS staging path (e.g. media/Music/_incoming), share config pointing at media/Music, listen port 50300
Add docker-slskd to chaos service failure monitor
Verify Synology NFS ACL allows chaos's IP read-write on /volume1/media

User actions needed

Register a Soulseek account and place credentials in secrets/slskd.yaml
Optional but recommended: router port-forward TCP 50300 -> chaos for better source availability (works outbound-only without it)

Completion criteria

nix flake check passes; just test on chaos brings up slskd healthy
slskd authenticates to Soulseek, a test download lands in the staging folder, and the configured shares are visible to other Soulseek users

## Goal Run slskd (Soulseek daemon) as a Nix-managed OCI container on **chaos**, logged into the Soulseek network and sharing back from the shared NAS music library. ## Decisions made - Target host: chaos (the docker workload VM). - Share-back is a requirement: many Soulseek users block leechers. Shares point at the NAS `Music` library (read-only usage by slskd). - Downloads stage on the NAS so synthseek/Beets can organise them into `media/Music`, where vega's Navidrome (read-only NFS view) picks them up automatically. - Precedent for a read-write NAS mount: sabnzbd on vega mounts `192.168.8.238:/volume1/media` over NFS (no `ro`) at `/srv/media`. - slskd's own web UI stays internal (loopback / docker network only). Synthseek drives it through the API; Pangolin exposure is out of scope for this issue. ## Tasks - [ ] Enable `boot.supportedFilesystems = [ "nfs" ]` on chaos (module or host level) - [ ] Read-write NFS mount of `192.168.8.238:/volume1/media` on chaos using the sabnzbd option set plus `nofail` - [ ] New `modules/containers/slskd.nix` following the killarr pattern: pinned image version, `nixosConfig.slskd.*` options, imported by `hosts/chaos/default.nix` - [ ] Container state under `/srv/stacks/slskd` (already inside chaos's backup dataPaths) - [ ] New SOPS file `secrets/slskd.yaml` holding Soulseek username/password and an slskd API key; add its creation rule to `.sops.yaml` (admin keys + chaos) - [ ] slskd config YAML rendered from SOPS at runtime: credentials, download dir pointing at the NAS staging path (e.g. `media/Music/_incoming`), share config pointing at `media/Music`, listen port 50300 - [ ] Add `docker-slskd` to chaos service failure monitor - [ ] Verify Synology NFS ACL allows chaos's IP read-write on `/volume1/media` ## User actions needed - [ ] Register a Soulseek account and place credentials in `secrets/slskd.yaml` - [ ] Optional but recommended: router port-forward TCP 50300 -> chaos for better source availability (works outbound-only without it) ## Completion criteria - `nix flake check` passes; `just test` on chaos brings up slskd healthy - slskd authenticates to Soulseek, a test download lands in the staging folder, and the configured shares are visible to other Soulseek users

nimmo added this to the Music Library Automation milestone

2026-08-26 04:37:59 +01:00

nimmo added the

phase:prep

host:chaos

service:slskd

labels

2026-08-26 04:37:59 +01:00

nimmo referenced this issue from a commit

2026-08-26 06:31:37 +01:00

feat(chaos): add dormant slskd Soulseek client module

nimmo commented

2026-08-26 06:34:17 +01:00

Author

Owner

Implementation pushed on branch feat/slskd-chaos (68159fc):

modules/containers/slskd.nix — OCI container pinned to slskd 0.26.0, dormant until the secrets file exists (BookStack/Karakeep precedent)
Credentials injected as SLSKD_* env vars via a sops template; no secrets in rendered YAML
Read-write NFS mount of /volume1/media at /srv/media; downloads stage in music-incoming, deliberately outside Music so Navidrome's read-only view never sees partial files
Music shared back to the network; listen port 50300 published and opened for optional router forwarding
nix flake check green; dormancy verified (no container/secrets in chaos evaluation while the file is absent)

Next step (human): check out this branch and run sops secrets/slskd.yaml, filling in:

slskd:
    soulseek-username: <chosen nick>
    soulseek-password: <password>
    web-username: <web UI login>
    web-password: <openssl rand -base64 24>
    api-key: <openssl rand -hex 24>

The Soulseek account self-registers on first server connect. Remaining user actions: Synology NFS rw rule for chaos's IP, optional router forward of TCP 50300.

Implementation pushed on branch `feat/slskd-chaos` (68159fc): - `modules/containers/slskd.nix` — OCI container pinned to slskd **0.26.0**, dormant until the secrets file exists (BookStack/Karakeep precedent) - Credentials injected as `SLSKD_*` env vars via a sops template; no secrets in rendered YAML - Read-write NFS mount of `/volume1/media` at `/srv/media`; downloads stage in `music-incoming`, deliberately **outside** `Music` so Navidrome's read-only view never sees partial files - `Music` shared back to the network; listen port 50300 published and opened for optional router forwarding - `nix flake check` green; dormancy verified (no container/secrets in chaos evaluation while the file is absent) **Next step (human):** check out this branch and run `sops secrets/slskd.yaml`, filling in: ```yaml slskd: soulseek-username: <chosen nick> soulseek-password: <password> web-username: <web UI login> web-password: <openssl rand -base64 24> api-key: <openssl rand -hex 24> ``` The Soulseek account self-registers on first server connect. Remaining user actions: Synology NFS rw rule for chaos's IP, optional router forward of TCP 50300.

nimmo referenced this issue from a commit

2026-08-26 07:12:08 +01:00

fix(chaos): pre-create slskd directories before container start

nimmo referenced this issue from a commit

2026-08-26 07:21:47 +01:00

fix(chaos): move slskd share config to top-level shares key

nimmo commented

2026-08-26 07:58:21 +01:00

Author

Owner

Deployment evidence (test activation on chaos, 2026-08-26):

docker-slskd active; web UI 200 on 127.0.0.1:5030; listening on 50300
Connected to the Soulseek server / Logged in to the Soulseek server as photophobic-nucleus — account self-registered
Shares live immediately: three distinct peers browsed folder contents within minutes (deepcutarchive99, Blenpai, others)
/srv/media NFS rw verified (touch/rm in music-incoming)

Fixes landed during bring-up: pre-created directories (docker chown fails on root-squashed NFS; slskd requires custom incomplete dir to exist) and share config moved to top-level shares: for slskd 0.26 (upstream PR #1672).

Merged to main as 5e27442; chaos's pull-only updater will make it permanent. Remaining follow-ups: Synology NFS rw ACL was confirmed working for chaos's IP; CGNAT noted — slskd runs passive (inbound blocked), downloads unaffected for most sources; revisit via VPS tunnel if source availability suffers.

Deployment evidence (test activation on chaos, 2026-08-26): - `docker-slskd` active; web UI 200 on 127.0.0.1:5030; listening on 50300 - `Connected to the Soulseek server` / `Logged in to the Soulseek server as photophobic-nucleus` — account self-registered - Shares live immediately: three distinct peers browsed folder contents within minutes (deepcutarchive99, Blenpai, others) - `/srv/media` NFS rw verified (touch/rm in `music-incoming`) Fixes landed during bring-up: pre-created directories (docker chown fails on root-squashed NFS; slskd requires custom incomplete dir to exist) and share config moved to top-level `shares:` for slskd 0.26 (upstream PR #1672). Merged to main as 5e27442; chaos's pull-only updater will make it permanent. Remaining follow-ups: Synology NFS rw ACL was confirmed working for chaos's IP; CGNAT noted — slskd runs passive (inbound blocked), downloads unaffected for most sources; revisit via VPS tunnel if source availability suffers.

nimmo commented

2026-08-26 20:57:38 +01:00

Author

Owner

Working well, closing issue

nimmo closed this issue

2026-08-26 20:57:38 +01:00