### Jellyfin Admin User Client Setup

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Advanced setup for Jellyfin admin user management, including ensuring password files, device UUID, admin user creation, API key generation, and waiting for service readiness. This is typically run as part of a NixOS activation script.

```python
# Advanced: Jellyfin admin-user client (for startup wizard / user management)
from nixarr_py.jellyfin_helpers import (
    ensure_admin_password_file,
    ensure_device_uuid_file,
    ensure_admin_user_created_and_wizard_completed,
    ensure_api_key_and_file,
    wait_until_ready,
    api_key_client,
)
import jellyfin

# One-time setup sequence (run as part of a NixOS activation script)
ensure_admin_password_file()
ensure_device_uuid_file()
ensure_admin_user_created_and_wizard_completed()
ensure_api_key_and_file()

# Subsequent use — API key client is safe for concurrent use
with api_key_client() as client:
    libraries = jellyfin.LibraryApi(client).get_media_folders()
    for folder in libraries.items:
        print(f"Library: {folder.name} ({folder.collection_type})")
```

--------------------------------

### Full Nixarr Declarative Configuration

Source: https://context7.com/nix-media-server/nixarr/llms.txt

A comprehensive Nix configuration for Nixarr, enabling Jellyfin with HTTPS, VPN-confined Transmission, all Arrs with settings synchronization, and Prometheus monitoring. This example showcases a production-ready setup.

```nix
nixarr = {
  enable = true;
  mediaDir = "/data/media";
  stateDir = "/data/media/.state/nixarr";

  vpn = {
    enable = true;
    wgConf = "/data/.secret/wg.conf";
  };

  jellyfin = {
    enable = true;
    expose.https = {
      enable = true;
      domainName = "jellyfin.example.com";
      acmeMail = "you@example.com";
    };
  };

  transmission = {
    enable = true;
    vpn.enable = true;
    peerPort = 50000;
  };

  bazarr.enable = true;
  lidarr.enable = true;
  radarr.enable = true;
  sonarr.enable = true;
  jellyseerr.enable = true;

  prowlarr = {
    enable = true;
    settings-sync = {
      enable-nixarr-apps = true;
      tags = [ "usenet" "torrent" ];
      indexers = [
        {
          sort_name = "nzbgeek";
          tags = [ "usenet" ];
          fields.apiKey.secret = "/data/.secret/nzbgeek-api-key";
        }
      ];
    };
  };

  sonarr.settings-sync.transmission.enable = true;
  radarr.settings-sync.transmission.enable = true;

  bazarr.settings-sync = {
    sonarr.enable = true;
    sonarr.config.sync_only_monitored_series = true;
    radarr.enable = true;
    radarr.config.sync_only_monitored_movies = true;
  };

  exporters.enable = true;

  ddns.njalla = {
    enable = true;
    keysFile = "/data/.secret/njalla/keys-file.json";
  };
};

```

--------------------------------

### Example Njalla DDNS Service Output

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/ddns/njalla/index.md

This is an example of the expected output when checking the `ddnsNjalla.service` status, indicating a successful record update.

```text
Mar 03 21:05:00 pi systemd[1]: Starting Sets the Njalla DDNS records...
Mar 03 21:05:02 pi ddns-njalla[26842]: {"status": 200, "message": "record updated", "value": {"A": "93.184.216.34"}}
Mar 03 21:05:02 pi ddns-njalla[26845]: {"status": 200, "message": "record updated", "value": {"A": "93.184.216.34"}}
Mar 03 21:05:02 pi systemd[1]: ddnsNjalla.service: Deactivated successfully.
Mar 03 21:05:02 pi systemd[1]: Finished Sets the Njalla DDNS records.
Mar 03 21:05:02 pi systemd[1]: ddnsNjalla.service: Consumed 560ms CPU time, received 11.7K IP traffic, sent 3.0K IP traffic.
```

--------------------------------

### Configure Nixarr Prowlarr with Settings-Sync

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Enable Prowlarr for indexer management and declaratively configure indexers, tags, and application registrations using settings-sync. This avoids manual UI setup.

```nix
nixarr.prowlarr = {
  enable = true;
  settings-sync = {
    # Auto-register all enabled Nixarr *Arrs (Sonarr, Radarr, Lidarr, etc.)
    # with correct URLs and API keys — no manual setup needed
    enable-nixarr-apps = true;

    tags = [ "usenet" "torrent" "private" ];

    indexers = [
      {
        sort_name = "nzbgeek";
        tags = [ "usenet" ];
        fields = {
          apiKey.secret = "/data/.secret/nzbgeek-api-key"; # Never stored in Nix store
        };
      }
      {
        sort_name = "torznab";
        name = "Jackett";
        tags = [ "torrent" ];
        fields = {
          baseUrl = "http://localhost:9117/api/v2.0/indexers/all/results/torznab/";
          apiKey.secret = "/data/.secret/jackett-api-key";
        };
      }
    ];

    # Add non-Nixarr-managed applications
    apps = [
      {
        name = "External Sonarr";
        implementation = "Sonarr";
        fields = {
          baseUrl = "http://192.168.1.100:8989";
          apiKey.secret = "/data/.secret/external-sonarr-api-key";
          prowlarrUrl = "http://localhost:9696";
        };
      }
    ];
  };
};
# Required: services.prowlarr.settings.auth.required = "DisabledForLocalAddresses";
# Prowlarr at :9696
# sudo nixarr show-prowlarr-schemas indexer | jq '.[].sort_name'

```

--------------------------------

### Get Jellyfin System Info

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Retrieve system information from Jellyfin using the jellyfin_client. This requires valid connection details and API keys.

```python
import jellyfin
from nixarr_py.clients import jellyfin_client

with jellyfin_client() as client:
    info = jellyfin.SystemApi(client).get_system_info()
    print(f"Jellyfin {info.version} — OS: {info.operating_system}")
```

--------------------------------

### Enable Nixarr Prometheus Exporters

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Enable Prometheus exporters for active *Arr services, qBittorrent, WireGuard, and system metrics. VPN-confined services get nginx proxy passthrough for host accessibility.

```nix
# Enable all exporters at once
nixarr.exporters.enable = true;

# Per-service overrides (all optional)
nixarr.lidarr.exporter.enable = false;       # Disable specific exporter
nixarr.sonarr.exporter.port = 9800;          # Change port
nixarr.radarr.exporter.listenAddr = "127.0.0.1"; # Restrict listen address

```

--------------------------------

### Prometheus Scrape Configuration

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/examples/example-4/index.md

Example Prometheus scrape configurations for various Nixarr services. Ensure 'your-server' is replaced with the actual server address.

```yaml
scrape_configs:
  - job_name: 'sonarr'
    static_configs:
      - targets: ['your-server:9707']
  - job_name: 'radarr'
    static_configs:
      - targets: ['your-server:9708']
  - job_name: 'qbittorrent'
    static_configs:
      - targets: ['your-server:9713']
  - job_name: 'wireguard'
    static_configs:
      - targets: ['your-server:9586']
```

--------------------------------

### Sample VPN Test Service Output

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/vpn/ports/index.md

Example output from the VPN test service, including IP address, DNS leak test results, and conclusions. Note that DNS leak conclusions should be interpreted with caution.

```default
; <<>> DiG 9.18.27 <<>> google.com

...

Getting IP:
{
  "ip": "12.34.56.78",
  "hostname": "---.--.---.--.-------.----",
  "city": "---------",
  "region": "---------",
  "country": "--",
  "loc": "00.0000,00.0000",
  "org": "----------------------",
  "postal": "------",
  "timezone": "----------------",
  "readme": "-----------------------------"
}
DNS leak test:
Your IP:
12.34.56.78 [------, ----------------------]
You use 3 DNS servers:
---.---.---.-- [------, -----------------------]
---.---.---.- [------, -----------------------]
---.---.---.- [------, -----------------------]
Conclusion:
DNS may be leaking.

```

--------------------------------

### Nixarr Dynamic DNS Setup

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Configure Nixarr's dynamic DNS feature to automatically update DNS records for Njalla or 1984 hosting. Secrets are stored securely outside the Nix store.

```nix
# Step 1: Create the secrets file

```

--------------------------------

### Change Nixarr Exporter Port

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/examples/example-4/index.md

Example of how to change the default port for a specific Nixarr service's exporter, like Sonarr.

```nix
nixarr.sonarr.exporter.port = 9800;
```

--------------------------------

### Change Nixarr Exporter Listen Address

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/examples/example-4/index.md

Example of how to change the listen address for a specific Nixarr service's exporter, such as Radarr.

```nix
nixarr.radarr.exporter.listenAddr = "127.0.0.1";
```

--------------------------------

### Disable Nixarr Exporter

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/examples/example-4/index.md

Example of how to disable the exporter for a specific Nixarr service, such as Lidarr.

```nix
nixarr.lidarr.exporter.enable = false;
```

--------------------------------

### Get Public IP Address

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/ddns/njalla/index.md

This command retrieves your current public IPv4 address. This is useful for verifying that your DDNS record is pointing to the correct IP.

```sh
curl https://ipv4.icanhazip.com/
```

--------------------------------

### Configure qBittorrent Declaratively

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/setup/index.md

Enable and configure qBittorrent with Nix, including VPN support and peer port settings. Allows for custom configurations via `extraConfig`.

```nix
nixarr.qbittorrent = {
    enable = true;
    vpn.enable = true;
    peerPort = 50000;

    # Disable DHT/PeX for private trackers (optional)
    # privateTrackers.disableDhtPex = true;

    # Extra configuration merged into qBittorrent.conf
    extraConfig = {
      BitTorrent = {
        "Session\MaxActiveDownloads" = 3;
      };
    };
  };
```

--------------------------------

### Configure qBittorrent Torrent Client

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Enables qBittorrent with VPN confinement, the `qui` WebUI proxy, private tracker mode, and declarative `extraConfig` for qBittorrent.conf settings. WebUI at http://{SERVER_IP}:5252.

```nix
nixarr.qbittorrent = {
  enable = true;
  vpn.enable = true;
  peerPort = 50000;
  webuiPort = 5252; # Port for the qui WebUI

  # Optional: disable DHT/PeX for private tracker use
  # privateTrackers.disableDhtPex = true;

  extraConfig = {
    BitTorrent = {
      "Session\MaxActiveDownloads" = 3;
      "Session\MaxActiveTorrents" = 5;
    };
  };
};
# WebUI at http://{SERVER_IP}:5252

```

--------------------------------

### Configure Nixarr with Jellyfin, qBittorrent, Arrs, and Prometheus

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/examples/example-4/index.md

This Nix configuration enables and sets up Jellyfin, qBittorrent with VPN, multiple Arrs services, and Prometheus exporters for monitoring. Ensure the VPN's WireGuard configuration and peer port are correctly specified.

```nix
nixarr = {
  enable = true;
  mediaDir = "/data/media";
  stateDir = "/data/media/.state/nixarr";

  vpn = {
    enable = true;
    wgConf = "/data/.secret/wg.conf";
  };

  jellyfin = {
    enable = true;
    expose.https = {
      enable = true;
      domainName = "your.domain.com";
      acmeMail = "your@email.com";
    };
  };

  # --- qBittorrent with VPN ---
  # qBittorrent is an alternative to Transmission with a more
  # feature-rich WebUI. The "qui" WebUI is enabled by default.
  qbittorrent = {
    enable = true;
    vpn.enable = true;
    peerPort = 50000; # Set this to the port forwarded by your VPN
    webuiPort = 5252; # Port for the qui WebUI (default)

    # Disable DHT/PeX for private trackers (optional)
    # privateTrackers.disableDhtPex = true;

    # Extra qBittorrent configuration (optional)
    # See: https://github.com/qbittorrent/qBittorrent/wiki/Explanation-of-Options-in-qBittorrent
    extraConfig = {
      BitTorrent = {
        "Session\MaxActiveDownloads" = 3;
        "Session\MaxActiveTorrents" = 5;
      };
    };
  };

  # Enable Arrs
  bazarr.enable = true;
  lidarr.enable = true;
  prowlarr.enable = true;
  radarr.enable = true;
  readarr.enable = true;
  sonarr.enable = true;
  jellyseerr.enable = true;

  # --- Prometheus Monitoring ---
  # Enable exporters for all services. This sets up:
  # - Exportarr for Sonarr, Radarr, Lidarr, Readarr, Prowlarr
  # - qBittorrent exporter
  # - Node and systemd exporters
  # - WireGuard exporter (when VPN is enabled)
  exporters.enable = true;

  # Per-service exporter configuration (all optional, shown with defaults):
  # sonarr.exporter = { enable = true; port = 9707; };
  # radarr.exporter = { enable = true; port = 9708; };
  # lidarr.exporter = { enable = true; port = 9709; };
  # readarr.exporter = { enable = true; port = 9710; };
  # prowlarr.exporter = { enable = true; port = 9711; };
  # qbittorrent.exporter = { enable = true; port = 9713; };
  # wireguard.exporter = { enable = true; port = 9586; };

  # Declarative settings (as shown in example-3)
  prowlarr.settings-sync.enable-nixarr-apps = true;
};

```

--------------------------------

### Nixarr CLI: Show Download Client Schemas

Source: https://context7.com/nix-media-server/nixarr/llms.txt

List available download client schemas for Sonarr or Radarr using `nixarr show-sonarr-schemas` or `nixarr show-radarr-schemas`.

```bash
# Show available download client schemas for Sonarr/Radarr
sudo nixarr show-sonarr-schemas download_client | jq '.[].implementation'
sudo nixarr show-radarr-schemas download_client | jq '.[].implementation'

```

--------------------------------

### Configure Nixarr with Jellyfin, VPN, and *Arrs

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/examples/example-1/index.md

Use this configuration to enable Jellyfin with HTTPS, Transmission with VPN, and multiple *Arrs applications. Ensure media and state directories are correctly set and the VPN configuration file is not stored in the git repository.

```nix
nixarr = {
    enable = true;
    # These two values are also the default, but you can set them to whatever
    # else you want
    # WARNING: Do _not_ set them to `/home/user/whatever`, it will not work!
    mediaDir = "/data/media";
    stateDir = "/data/media/.state/nixarr";

    vpn = {
      enable = true;
      # WARNING: This file must _not_ in the config git directory
      # You can usually get this wireguard file from your VPN provider
      wgConf = "/data/.secret/wg.conf";
    };

    jellyfin = {
      enable = true;
      # These options set up a nginx HTTPS reverse proxy, so you can access
      # Jellyfin on your domain with HTTPS
      expose.https = {
        enable = true;
        domainName = "your.domain.com";
        acmeMail = "your@email.com"; # Required for ACME-bot
      };
    };

    transmission = {
      enable = true;
      vpn.enable = true;
      peerPort = 50000; # Set this to the port forwarded by your VPN
    };

    # It is possible for this module to run the *Arrs through a VPN, but it
    # is generally not recommended, as it can cause rate-limiting issues.
    bazarr.enable = true;
    lidarr.enable = true;
    prowlarr.enable = true;
    radarr.enable = true;
    readarr.enable = true;
    sonarr.enable = true;
    seerr.enable = true;
  };
```

--------------------------------

### Configure Nixarr Bazarr with Settings-Sync

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Enable Bazarr for subtitle management and declaratively configure its connections to Sonarr and Radarr. API keys and ports are automatically populated from Nixarr's configuration.

```nix
nixarr.bazarr = {
  enable = true;
  settings-sync = {
    sonarr.enable = true;
    sonarr.config = {
      sync_only_monitored_series = true;
      sync_only_monitored_episodes = true;
    };
    radarr.enable = true;
    radarr.config = {
      sync_only_monitored_movies = true;
    };
  };
};
# Bazarr at :6767
# Still configure language profiles and subtitle providers manually in the UI

```

--------------------------------

### Nixarr Declarative Configuration

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/examples/example-3/index.md

Configure Nixarr services, including media servers, download clients, and VPN integration. Secrets are read from files at runtime.

```nix
nixarr = {
  enable = true;
  mediaDir = "/data/media";
  stateDir = "/data/media/.state/nixarr";

  vpn = {
    enable = true;
    wgConf = "/data/.secret/wg.conf";
  };

  jellyfin = {
    enable = true;
    expose.https = {
      enable = true;
      domainName = "your.domain.com";
      acmeMail = "your@email.com";
    };
  };

  transmission = {
    enable = true;
    vpn.enable = true;
    peerPort = 50000; # Set this to the port forwarded by your VPN
  };

  # Enable all Arrs
  bazarr.enable = true;
  lidarr.enable = true;
  radarr.enable = true;
  readarr.enable = true;
  sonarr.enable = true;
  jellyseerr.enable = true;

  # --- Declarative Prowlarr Settings ---
  prowlarr = {
    enable = true;

    settings-sync = {
      # Automatically sync all enabled Nixarr apps to Prowlarr.
      # This adds Sonarr, Radarr, Lidarr, and Readarr as applications
      # with the correct URLs and API keys — no manual setup needed.
      enable-nixarr-apps = true;

      # Define tags for organizing indexers
      tags = [ "usenet" "torrent" "private" ];

      # Define indexers directly in Nix
      indexers = [
        {
          sort_name = "nzbgeek";
          tags = [ "usenet" ];
          fields = {
            # Secrets are read from files at runtime, not stored in the Nix store
            apiKey.secret = "/data/.secret/nzbgeek-api-key";
          };
        }
        {
          sort_name = "torznab";
          name = "Jackett";
          tags = [ "torrent" ];
          fields = {
            baseUrl = "http://localhost:9117/api/v2.0/indexers/all/results/torznab/";
            apiKey.secret = "/data/.secret/jackett-api-key";
          };
        }
      ];
    };
  };

  # --- Declarative Sonarr Download Clients ---
  sonarr.settings-sync = {
    # Automatically configure Transmission as a download client.
    # Uses the correct port and localhost (works even across VPN boundaries
    # because Nixarr sets up nginx proxies automatically).
    transmission.enable = true;
  };

  # --- Declarative Radarr Download Clients ---
  radarr.settings-sync = {
    transmission.enable = true;
  };

  # --- Declarative Bazarr Connections ---
  bazarr.settings-sync = {
    # Automatically configure the Sonarr connection in Bazarr.
    # API keys and ports are filled in from Nixarr's configuration.
    sonarr.enable = true;
    sonarr.config = {
      # Optionally only sync subtitles for monitored content
      sync_only_monitored_series = true;
      sync_only_monitored_episodes = true;
    };

    # Same for Radarr
    radarr.enable = true;
    radarr.config = {
      sync_only_monitored_movies = true;
    };
  };
};

```

--------------------------------

### Enable Nixarr Module

Source: https://context7.com/nix-media-server/nixarr/llms.txt

The top-level switch to activate the Nixarr module. Enables media directory structure, user/group management, permissions, and the `nixarr` CLI. All per-service options are ignored unless this is true.

```nix
# configuration.nix
nixarr = {
  enable = true;
  # Base directory for all media files (default: /data/media)
  mediaDir = "/data/media";
  # Base directory for all service state (default: /data/media/.state/nixarr)
  stateDir = "/data/media/.state/nixarr";
};

```

--------------------------------

### Configure Njalla DDNS with Nixarr

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Set up Njalla Dynamic DNS service by specifying the keys file path. Ensure the keys file has restricted permissions.

```nix
nixarr.ddns.njalla = {
  enable = true;
  keysFile = "/data/.secret/njalla/keys-file.json";
};

```

--------------------------------

### Enable VPN with Nixarr

Source: https://github.com/nix-media-server/nixarr/blob/main/README.md

Configure Nixarr to run services through a VPN by providing the path to a wg-quick configuration file. Ensure the configuration file is not stored within the Nix configuration git directory.

```nix
nixarr.vpn = {
    enable = true;
    # WARNING: This file must _not_ be in the config git directory
    # You can usually get this wireguard file from your VPN provider
    wgConf = "/data/.secret/wg.conf";
  }
```

--------------------------------

### Configure Bazarr Sonarr Connection Declaratively

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/setup/index.md

Automatically configure the Sonarr connection for Bazarr. Ensures subtitles are synced only for monitored content.

```nix
nixarr.bazarr.settings-sync = {
    # Automatically configure the Sonarr connection
    sonarr.enable = true;
    sonarr.config = {
      # Only sync subtitles for monitored content (optional)
      sync_only_monitored_series = true;
      sync_only_monitored_episodes = true;
    };

    # Automatically configure the Radarr connection
    radarr.enable = true;
    radarr.config = {
      sync_only_monitored_movies = true;
    };
  };
```

--------------------------------

### Configure Nixarr Arr Services

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Enable and declaratively configure Sonarr, Radarr, and Lidarr services. Supports optional VPN confinement and automatic download client configuration via settings-sync.

```nix
nixarr = {
  sonarr = {
    enable = true;
    # Declaratively configure download clients
    settings-sync = {
      transmission.enable = true; # Auto-configure Transmission with correct settings

      # Or specify custom clients
      downloadClients = [
        {
          name = "SABnzbd";
          implementation = "Sabnzbd";
          fields = {
            host = "localhost";
            port = 8080;
            apiKey.secret = "/data/.secret/sabnzbd-api-key"; # Read from file at runtime
          };
        }
      ];
    };
  };

  radarr = {
    enable = true;
    settings-sync.transmission.enable = true;
  };

  lidarr.enable = true;
};
# Sonarr at :8989, Radarr at :7878, Lidarr at :8686
# Find available download client schemas:
# sudo nixarr show-sonarr-schemas download_client | jq '.[].implementation'

```

--------------------------------

### Enable Jellyfin Media Server

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Enables Jellyfin with optional HTTPS reverse proxy (nginx + ACME), VPN confinement, and LAN-only exposure. Access at http://{SERVER_IP}:8096 or https://jellyfin.example.com.

```nix
nixarr.jellyfin = {
  enable = true;
  # Expose publicly with HTTPS via nginx + Let's Encrypt
  expose.https = {
    enable = true;
    domainName = "jellyfin.example.com";
    acmeMail = "you@example.com";
  };
  # Or expose only through the VPN (e.g., Tailscale/WireGuard)
  # expose.vpn.enable = true;
};
# Access at http://{SERVER_IP}:8096 or https://jellyfin.example.com

```

--------------------------------

### Nixarr CLI: List API Keys

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Retrieve a list of API keys for all enabled *Arr services using the `nixarr list-api-keys` command.

```bash
# List API keys for all enabled *Arr services
sudo nixarr list-api-keys
# Output: sonarr: abc123...  radarr: def456...

```

--------------------------------

### Configure Radarr Declarative Download Clients (Nix)

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/setup/index.md

Automatically add Transmission or custom download clients to Radarr using Nix configuration. Ensure the 'implementation' field matches the download client type.

```nix
nixarr.radarr.settings-sync = {
    # Automatically add Transmission with the correct settings
    transmission.enable = true;

    # Or add custom download clients
    downloadClients = [
      {
        name = "NZBGet";
        implementation = "Nzbget";
        fields = {
          host = "localhost";
          port = 6789;
        };
      }
    ];
  };
```

--------------------------------

### Configure Sonarr Declarative Download Clients (Nix)

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/setup/index.md

Automatically add Transmission or custom download clients to Sonarr using Nix configuration. Ensure the 'implementation' field matches the download client type and provide API key secrets if necessary.

```nix
nixarr.sonarr.settings-sync = {
    # Automatically add Transmission with the correct settings
    transmission.enable = true;

    # Or add custom download clients
    downloadClients = [
      {
        name = "SABnzbd";
        implementation = "Sabnzbd";
        fields = {
          host = "localhost";
          port = 8080;
          apiKey.secret = "/data/.secret/sabnzbd-api-key";
        };
      }
    ];
  };
```

--------------------------------

### Show Sonarr Download Client Schemas

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/examples/example-3/index.md

Discover available Sonarr download client schemas using this CLI command. Use jq to parse the JSON output.

```bash
sudo nixarr show-sonarr-schemas download_client | jq '.[].implementation'
```

--------------------------------

### Configure WireGuard VPN Confinement

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Configures a WireGuard VPN namespace for service traffic confinement. Requires a wg-quick .conf file. Services opt into VPN confinement individually via their own `vpn.enable` option.

```nix
nixarr.vpn = {
  enable = true;
  # Must NOT be inside the config git repo (kept secret/impure)
  wgConf = "/data/.secret/wg.conf";
};

# Run Transmission through the VPN
nixarr.transmission = {
  enable = true;
  vpn.enable = true;
  peerPort = 50000; # Port forwarded by your VPN provider (e.g., AirVPN)
};

```

--------------------------------

### Nixarr CLI: Show Prowlarr Schemas

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Display available Prowlarr indexer or application schemas using `nixarr show-prowlarr-schemas`. Useful for configuring `settings-sync`.

```bash
# Show available Prowlarr indexer schemas (to configure settings-sync)
sudo nixarr show-prowlarr-schemas indexer | jq '.[].sort_name'
sudo nixarr show-prowlarr-schemas application | jq '.[].implementation'

```

--------------------------------

### Show Available Prowlarr Indexer Schemas

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/examples/example-3/index.md

Use this command to list all available Prowlarr indexer schemas. Pipe the output to jq for formatted results.

```bash
sudo nixarr show-prowlarr-schemas indexer | jq '.[].sort_name'
```

--------------------------------

### Show Radarr Download Client Schemas

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/examples/example-3/index.md

List available Radarr download client schemas with this command. The 'jq' utility can be used to filter and format the results.

```bash
sudo nixarr show-radarr-schemas download_client | jq '.[].implementation'
```

--------------------------------

### Import Nixarr Flake Input

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Add Nixarr as a flake input and include its NixOS module in your system configuration.

```nix
# flake.nix
{
  description = "Your nix flake";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
    nixarr.url = "github:nix-media-server/nixarr";
  };

  outputs = { nixpkgs, nixarr, ... }@inputs:
    {
      nixosConfigurations = {
        servarr = nixpkgs.lib.nixosSystem {
          system = "x86_64-linux";
          modules = [
            ./nixos/servarr/configuration.nix
            nixarr.nixosModules.default
          ];
          specialArgs = { inherit inputs; };
        };
      };
    };
}

```

--------------------------------

### Enable Nixarr App Sync in Prowlarr

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/setup/index.md

Automatically sync your enabled *Arr applications to Prowlarr. This simplifies the management of your media server applications.

```nix
nixarr.prowlarr.settings-sync.enable-nixarr-apps = true;
```

--------------------------------

### Enable VPN Port Debugging Service

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Activate a test service to verify VPN connectivity and port forwarding. The specified port must match your VPN provider's forwarded port.

```nix
nixarr.vpn.vpnTestService = {
  enable = true;
  port = 12345; # Must match the port forwarded by your VPN provider
};

```

--------------------------------

### Configure VPN Ports and Service Confinement

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/vpn/uncovered-services/index.md

Open VPN ports for services and enforce VPN confinement for a specific service like Monero. Ensure the `vpnnamespace` matches Nixarr's internal name, which is 'wg'.

```nix
  # Open vpnports, must also be opened by VPN-provider
  vpnnamespaces.wg = {
    openVPNPorts = [
      { port = xmrP2PPort; protocol = "both"; }
      { port = xmrRpcPort; protocol = "both"; }
    ];
  };

  # Force moneronode to VPN
  systemd.services.monero.vpnconfinement = {
    enable = true;
    vpnnamespace = "wg"; # This must be "wg", that's what nixarr uses
  };

  services.monero = {
    enable = true;
    # Run as public node
    extraConfig = ''
      p2p-bind-ip=0.0.0.0
      p2p-bind-port=${builtins.toString xmrP2PPort}

      rpc-restricted-bind-ip=0.0.0.0
      rpc-restricted-bind-port=${builtins.toString xmrRpcPort}

      # Disable UPnP port mapping
      no-igd=1

      # Public-node
      public-node=1

      # ZMQ configuration
      no-zmq=1

      # Block known-malicious nodes from a DNSBL
      enable-dns-blocklist=1
    '';
  };
```

--------------------------------

### Connect to Open Port via Netcat

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/vpn/ports/index.md

Connect to a specified port on your public VPN IP address using netcat for testing. Replace placeholders with your actual VPN IP and port.

```sh
nc <public VPN ip> <specified port>
```

--------------------------------

### List Series with Sonarr Client

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Use the sonarr_client to list all series from Sonarr. This client requires access to configuration and API keys.

```python
import sonarr
from nixarr_py.clients import sonarr_client

with sonarr_client() as client:
    series_list = sonarr.SeriesApi(client).list_series()
    for series in series_list:
        print(f"{series.title}: {series.statistics.episode_count} episodes")
```

--------------------------------

### Enable Individual Apps in Prowlarr Declarative Config

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/setup/index.md

Declaratively enable individual applications like Sonarr and Radarr to be synced with Prowlarr. Supports various *Arr applications.

```nix
nixarr.prowlarr.settings-sync = {
    sonarr.enable = true;
    radarr.enable = true;
    # lidarr, readarr, readarr-audiobook, whisparr also available
  };
```

--------------------------------

### Configure Nixarr VPN with Secret File

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/secrets/index.md

Reference the path to your secret VPN configuration file in your Nixarr settings.

```nix
nixarr.vpn = {
  enable = true;
  wgConf = "/data/.secret/vpn/wg.conf";
};
```

--------------------------------

### Enable and Configure VPN Port Test Service

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/vpn/ports/index.md

Enable Nixarr's VPN test service to debug open ports. Specify the port to be tested.

```nix
nixarr.vpn.vpnTestService = {
    enable = true;
    port = 12345;
  };
```

--------------------------------

### Configure Local API Access for Services

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/examples/example-3/index.md

Ensure authentication is set to allow local API access for settings-sync to function correctly. This configuration is required for Prowlarr, Sonarr, and Radarr.

```nix
services.prowlarr.settings.auth.required = "DisabledForLocalAddresses";
services.sonarr.settings.auth.required = "DisabledForLocalAddresses";
services.radarr.settings.auth.required = "DisabledForLocalAddresses";
```

--------------------------------

### Enable All Nixarr Exporters

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/setup/index.md

Set this option to true to enable Prometheus exporters for all supported services. This includes exportarr, qBittorrent exporter, Node and systemd exporters, and WireGuard exporter if applicable.

```nix
nixarr.exporters.enable = true;
```

--------------------------------

### Nixarr Configuration for VPN and Services

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/examples/example-2/index.md

This Nix configuration enables Nixarr with VPN support, exposing services like Jellyfin and SSH through the VPN tunnel. It also configures various media server applications (*Arrs) to run within this VPN-secured environment. Ensure your VPN provider forwards the specified peer port for Transmission.

```nix
nixarr = {
  enable = true;

  vpn = {
    enable = true;
    wgConf = "/data/.secret/wg.conf";
  };

  jellyfin.enable = true;

  # Setup SSH service that runs through VPN.
  # Lets you connect through ssh from the internet without having access to
  # port forwarding
  openssh.expose.vpn.enable = true;

  transmission = {
    enable = true;
    vpn.enable = true;
    peerPort = 50000; # Set this to the port forwarded by your VPN
  };

  bazarr.enable = true;
  sonarr.enable = true;
  radarr.enable = true;
  prowlarr.enable = true;
  readarr.enable = true;
  lidarr.enable = true;
  seerr.enable = true;
};

# The `openssh.vpn.enable` option does not enable openssh, so we do that here:
# We disable password authentication as it's generally insecure.
services.openssh = {
  enable = true;
  settings.PasswordAuthentication = false;
  # Get this port from your VPN provider
  ports = [ 34567 ]
};
# Adds your public keys as trusted devices
users.extraUsers.username.openssh.authorizedKeys.keyFiles = [
  ./path/to/public/key/machine.pub
];
```

--------------------------------

### Show Prowlarr Application Schemas

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/examples/example-3/index.md

This command displays available Prowlarr application schemas. The output can be processed with jq to extract specific fields like 'implementation'.

```bash
sudo nixarr show-prowlarr-schemas application | jq '.[].implementation'
```

--------------------------------

### Move Secret File to Directory

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/secrets/index.md

Place your secret files, such as VPN configurations, into the designated secrets directory.

```shell
sudo mkdir -p /data/.secret/vpn
sudo mv /path/to/wireguard/config/wg.conf /data/.secret/vpn/wg.conf
```

--------------------------------

### Create and Secure Secrets Directory

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/secrets/index.md

Use these commands to create a hidden directory for secrets and set restrictive permissions.

```shell
sudo mkdir -p /data/.secret
sudo chmod 700 /data/.secret
```

--------------------------------

### Nix Configuration for Njalla DDNS

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/ddns/njalla/index.md

Integrate the Njalla DDNS service into your Nix configuration by enabling it and specifying the path to your secure keys file.

```nix
nixarr.ddns.njalla = {
  enable = true;
  keysFile = "/data/.secret/njalla/keys-file.json";
};
```

--------------------------------

### List Indexers with Prowlarr Client

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Use the prowlarr_client to list all configured indexers in Prowlarr. Ensure the client has access to necessary configuration and API keys.

```python
import prowlarr
from nixarr_py.clients import prowlarr_client

with prowlarr_client() as client:
    indexers = prowlarr.IndexerApi(client).list_indexer()
    for idx in indexers:
        print(f"{idx.name} — enabled: {idx.enable_rss}")
```

--------------------------------

### Configure Transmission Torrent Client

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Enables Transmission with optional VPN confinement, cross-seed support, and declarative settings. Downloads are placed in `/data/media/torrents/` with per-*Arr category subdirectories. WebUI at http://{SERVER_IP}:9091.

```nix
nixarr.transmission = {
  enable = true;
  vpn.enable = true;
  peerPort = 50000;

  # Declarative Transmission settings (JSON-serialized)
  settings = {
    ratio-limit = 2.0;
    ratio-limit-enabled = true;
    speed-limit-up = 1000;
    speed-limit-up-enabled = true;
  };

  # Cross-seed with Prowlarr integration (private trackers)
  privateTrackers.cross-seed = {
    enable = true;
    indexIds = [ 1 2 3 ]; # Prowlarr indexer IDs
  };
};
# WebUI at http://{SERVER_IP}:9091

```

--------------------------------

### Configure Prowlarr Indexers Declaratively

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/setup/index.md

Define indexers directly in Nix for Prowlarr. Use `sort_name` to reference the indexer and pass secrets via file references.

```nix
nixarr.prowlarr.settings-sync.indexers = [
    {
      sort_name = "nzbgeek";
      tags = [ "usenet" ];
      fields = {
        apiKey.secret = "/path/to/api/key";
      };
    }
  ];
```

--------------------------------

### List Movies with Radarr Client

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Use the radarr_client to list all movies from Radarr. Ensure the client can access connection details and API keys.

```python
import radarr
from nixarr_py.clients import radarr_client

with radarr_client() as client:
    movies = radarr.MovieApi(client).list_movie()
    for movie in movies:
        print(f"{movie.title} ({movie.year}) — monitored: {movie.monitored}")
```

--------------------------------

### Manage Prowlarr Tags Declaratively

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/setup/index.md

Define tags to be created in Prowlarr using Nix. This allows for organized management of indexers and applications.

```nix
nixarr.prowlarr.settings-sync.tags = [ "usenet" "torrent" "private" ];
```

--------------------------------

### View VPN Test Service Logs

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/vpn/ports/index.md

View the system logs for the VPN test service to identify your public VPN IP address and other diagnostic information.

```sh
journalctl -xeu vpn-test-service
```

--------------------------------

### Add Custom Applications to Prowlarr Declaratively

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/setup/index.md

Add non-Nixarr-managed applications to Prowlarr using Nix. This is useful for integrating external services.

```nix
nixarr.prowlarr.settings-sync.apps = [
    {
      name = "External Sonarr";
      implementation = "Sonarr";
      tags = [ "external" ];
      fields = {
        baseUrl = "http://192.168.1.100:8989";
        apiKey.secret = "/path/to/external-sonarr-api-key";
        prowlarrUrl = "http://localhost:9696";
      };
    }
  ];
```

--------------------------------

### Customize Per-Service Exporter Settings

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/setup/index.md

Configure individual service exporters. You can disable a specific exporter or modify its port and listen address.

```nix
# Disable a specific exporter
nixarr.lidarr.exporter.enable = false;
```

```nix
# Change port or listen address
nixarr.sonarr.exporter.port = 9800;
nixarr.radarr.exporter.listenAddr = "127.0.0.1";
```

--------------------------------

### Nixarr CLI: Fix Permissions

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Use the `nixarr fix-permissions` command to correct ownership and permissions for all directories managed by Nixarr.

```bash
# Fix ownership and permissions for all Nixarr-managed directories
sudo nixarr fix-permissions

```

--------------------------------

### Set Permissions for Njalla Keys File

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/ddns/njalla/index.md

These commands set the ownership and permissions for the Njalla DDNS keys file. It's crucial to restrict access to this file to the root user for security.

```bash
sudo chown root:root /data/.secret/njalla/keys-file.json
```

```bash
sudo chmod 700 /data/.secret/njalla/keys-file.json
```

--------------------------------

### Import Nixarr Module in Nix Flake

Source: https://github.com/nix-media-server/nixarr/blob/main/README.md

Add the Nixarr module to your Nix flake inputs and include it in your system's modules list to enable its functionality.

```nix
{
      description = "Your nix flake";

      inputs = {
        nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
        nixarr.url = "github:nix-media-server/nixarr";
      };

      outputs = { 
        nixpkgs, 
        nixarr, 
        ... 
      }@inputs: {
        nixosConfigurations = {
          servarr = nixpkgs.lib.nixosSystem {
            system = "x86_64-linux";

            modules = [
              ./nixos/servarr/configuration.nix
              nixarr.nixosModules.default
            ];

            specialArgs = { inherit inputs; };
          };
        };
      };
    }
```

--------------------------------

### Confine Services to VPN Namespace

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Use Nixarr's VPN confinement submodule to run arbitrary NixOS services within the same VPN namespace as Nixarr. This allows services to communicate via internal VPN IPs.

```nix
let
  xmrP2PPort = 18080;
  xmrRpcPort = 18089;
in {
  # Open ports inside the VPN namespace
  vpnnamespaces.wg = {
    openVPNPorts = [
      { port = xmrP2PPort; protocol = "both"; }
      { port = xmrRpcPort; protocol = "both"; }
    ];
  };

  # Confine monero to the same VPN namespace Nixarr uses ("wg")
  systemd.services.monero.vpnconfinement = {
    enable = true;
    vpnnamespace = "wg";
  };

  services.monero = {
    enable = true;
    extraConfig = ''
      p2p-bind-ip=0.0.0.0
      p2p-bind-port=${builtins.toString xmrP2PPort}
      rpc-restricted-bind-ip=0.0.0.0
      rpc-restricted-bind-port=${builtins.toString xmrRpcPort}
      no-igd=1
      public-node=1
    '';
  };
  # Services inside VPN reach each other via 192.168.15.1 instead of 127.0.0.1
}

```

--------------------------------

### Njalla DDNS Keys File Configuration

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/ddns/njalla/index.md

This JSON structure defines the mapping between your domain and its corresponding Njalla DDNS token. Ensure this file is stored securely and has restricted permissions.

```json
{
  "jellyfin.example.com": "48esqclnvqGiCZPbd"
}
```

--------------------------------

### Configure Transmission with VPN Peer Port

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/vpn/ports/index.md

Set the peer port for Transmission when using a VPN. Ensure the port is opened with your VPN provider.

```nix
nixarr.transmission = {
    enable = true;
    vpn.enable = true;
    peerPort = 12345;
  };
```

--------------------------------

### Expose SSH through VPN with Nixarr

Source: https://context7.com/nix-media-server/nixarr/llms.txt

Configure NixOS to expose SSH through the VPN for remote access. Ensure SSH is enabled, disable password authentication, and specify the VPN-forwarded port.

```nix
# NixOS config: expose SSH through the VPN for remote access
nixarr.openssh.expose.vpn.enable = true;

services.openssh = {
  enable = true;
  settings.PasswordAuthentication = false;
  ports = [ 34567 ]; # VPN-forwarded port from your provider
};
users.extraUsers.myuser.openssh.authorizedKeys.keyFiles = [
  ./keys/my-laptop.pub
];

```

--------------------------------

### Restart VPN Test Service

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/vpn/ports/index.md

Restart the VPN test service to re-run port checks and diagnostics.

```sh
systemctl restart vpn-test-service
```

--------------------------------

### Check Njalla DDNS Service Status

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/ddns/njalla/index.md

Use this command to check the status and logs of the `ddnsNjalla.service` to ensure it is running correctly and to view any output messages.

```sh
sudo systemctl status ddnsNjalla.service
```

--------------------------------

### SSH Tunneling for Service Access

Source: https://github.com/nix-media-server/nixarr/blob/main/docs/wiki/examples/example-2/index.md

Use this SSH command to create tunnels for accessing Nixarr services remotely when direct access is not possible. Replace `user` and `ip` with your VPN user and IP address. This command maps local ports to the respective service ports on the remote server via the VPN.

```sh
ssh -N user@ip \
  -L 6001:localhost:9091 \
  -L 6002:localhost:9696 \
  -L 6003:localhost:8989 \
  -L 6004:localhost:7878 \
  -L 6005:localhost:8686 \
  -L 6006:localhost:8787 \
  -L 6007:localhost:6767 \
  -L 6008:localhost:8096
```