add vpn bypass for Starr services

Author: kiriwalawren

modules/arr-common/mkArrServiceModule.nix

@@ -25,6 +25,18 @@ in {
     {
       enable = mkEnableOption "${capitalizedName}";
 
+      vpn = {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Whether to route ${capitalizedName} traffic through the VPN.
+            When false (default), ${capitalizedName} bypasses the VPN to prevent Cloudflare and image provider blocks.
+            When true, ${capitalizedName} routes through the VPN (requires nixflix.mullvad.enable = true).
+          '';
+        };
+      };
+
       config = mkOption {
         type =
           arrConfigModule
@@ -80,6 +92,14 @@ in {
     };
 
   config = mkIf (nixflix.enable && cfg.enable) {
+    # Assertion: VPN routing requires Mullvad to be enabled
+    assertions = [
+      {
+        assertion = cfg.vpn.enable -> config.nixflix.mullvad.enable;
+        message = "Cannot enable VPN routing for ${capitalizedName} (nixflix.${serviceName}.vpn.enable = true) when Mullvad VPN is disabled. Please set nixflix.mullvad.enable = true.";
+      }
+    ];
+
     # Set pattern-based defaults
     nixflix.${serviceName}.config = {
       apiKeyPath = mkDefault null;
@@ -233,16 +253,29 @@ in {
 
         # Ensure main service (radarr.service, etc.) starts after
         # directories are created and configured dependencies
-        ${serviceName} = {
-          after =
-            ["nixflix-setup-dirs.service"]
-            ++ (optional config.services.postgresql.enable "postgresql-ready.target")
-            ++ (optional config.nixflix.mullvad.enable "mullvad-config.service");
-          requires =
-            ["nixflix-setup-dirs.service"]
-            ++ (optional config.services.postgresql.enable "postgresql-ready.target");
-          wants = optional config.nixflix.mullvad.enable "mullvad-config.service";
-        };
+        ${serviceName} =
+          {
+            after =
+              ["nixflix-setup-dirs.service"]
+              ++ (optional (cfg.config.apiKeyPath != null && cfg.config.hostConfig.passwordPath != null) "${serviceName}-env.service")
+              ++ (optional config.services.postgresql.enable "postgresql-ready.target")
+              ++ (optional config.nixflix.mullvad.enable "mullvad-config.service");
+            requires =
+              ["nixflix-setup-dirs.service"]
+              ++ (optional (cfg.config.apiKeyPath != null && cfg.config.hostConfig.passwordPath != null) "${serviceName}-env.service")
+              ++ (optional config.services.postgresql.enable "postgresql-ready.target");
+            wants = optional config.nixflix.mullvad.enable "mullvad-config.service";
+          }
+          // optionalAttrs (cfg.config.apiKeyPath != null && cfg.config.hostConfig.passwordPath != null) {
+            serviceConfig.EnvironmentFile = "/run/${serviceName}/env";
+          }
+          // optionalAttrs (config.nixflix.mullvad.enable && !cfg.vpn.enable) {
+            # Bypass VPN by wrapping with mullvad-exclude
+            serviceConfig.ExecStart = mkForce (pkgs.writeShellScript "${serviceName}-vpn-bypass" ''
+              exec /run/wrappers/bin/mullvad-exclude ${getExe config.services.${serviceName}.package} \
+                -nobrowser -data='${stateDir}'
+            '');
+          };
       }
       # Only create config and rootfolders services if apiKeyPath is configured
       // optionalAttrs (cfg.config.apiKeyPath != null && cfg.config.hostConfig.passwordPath != null) {
@@ -271,18 +304,6 @@ in {
           '';
         };
 
-        ${serviceName} = {
-          after =
-            ["${serviceName}-env.service" "nixflix-setup-dirs.service"]
-            ++ (optional config.services.postgresql.enable "postgresql-ready.target")
-            ++ (optional config.nixflix.mullvad.enable "mullvad-config.service");
-          requires =
-            ["${serviceName}-env.service" "nixflix-setup-dirs.service"]
-            ++ (optional config.services.postgresql.enable "postgresql-ready.target");
-          wants = optional config.nixflix.mullvad.enable "mullvad-config.service";
-          serviceConfig.EnvironmentFile = "/run/${serviceName}/env";
-        };
-
         # Configure service via API
         "${serviceName}-config" = mkArrHostConfigService serviceName cfg.config;
       }

modules/mullvad.nix

@@ -74,7 +74,7 @@ in {
 
     services.mullvad-vpn = {
       enable = true;
-      enableExcludeWrapper = false;
+      enableExcludeWrapper = true;
       package = mullvadPkg;
     };
 

tests/unit-tests/default.nix

@@ -111,4 +111,70 @@ in {
     hasAllServices = systemdUnits ? prowlarr && systemdUnits ? prowlarr-config && systemdUnits ? prowlarr-indexers;
   in
     assertTest "prowlarr-service-generation" hasAllServices;
+
+  # Test that prowlarr with indexers generates correct systemd units
+  sabnzbd-service-generation = let
+    config = evalConfig [
+      {
+        nixflix = {
+          enable = true;
+          sabnzbd = {
+            enable = true;
+            downloadsDir = "/downloads/usenet";
+            apiKeyPath = pkgs.writeText "sabnzbd-apikey" "testapikey123456789abcdef";
+            nzbKeyPath = pkgs.writeText "sabnzbd-nzbkey" "testnzbkey123456789abcdef";
+            environmentSecrets = [
+              {
+                env = "EWEKA_USERNAME";
+                path = pkgs.writeText "eweka-username" "testuser";
+              }
+              {
+                env = "EWEKA_PASSWORD";
+                path = pkgs.writeText "eweka-password" "testpass123";
+              }
+            ];
+            settings = {
+              port = 8080;
+              host = "127.0.0.1";
+              url_base = "/sabnzbd";
+              ignore_samples = true;
+              direct_unpack = false;
+              article_tries = 5;
+              servers = [
+                {
+                  name = "TestServer";
+                  host = "news.example.com";
+                  port = 563;
+                  username = "$EWEKA_USERNAME";
+                  password = "$EWEKA_PASSWORD";
+                  connections = 10;
+                  ssl = true;
+                  priority = 0;
+                }
+              ];
+              categories = [
+                {
+                  name = "tv";
+                  dir = "tv";
+                  priority = 0;
+                  pp = 3;
+                  script = "None";
+                }
+                {
+                  name = "movies";
+                  dir = "movies";
+                  priority = 1;
+                  pp = 2;
+                  script = "None";
+                }
+              ];
+            };
+          };
+        };
+      }
+    ];
+    systemdUnits = config.config.systemd.services;
+    hasAllServices = systemdUnits ? sabnzbd && systemdUnits ? sabnzbd-config;
+  in
+    assertTest "prowlarr-service-generation" hasAllServices;
 }