ytdl-sub & pinchflat permissions

1 files changed, 11 insertions, 0 deletions

diff --git a/hostnix/elmo/media.nix b/hostnix/elmo/media.nix
index 1bf4542..7a60030 100644
--- a/hostnix/elmo/media.nix
+++ b/hostnix/elmo/media.nix
@@ -30,9 +30,17 @@
     locations."/".proxyPass = "http://127.0.0.1:8096";
   };
 
+  systemd.tmpfiles.rules = [
+    "d /srv/media/incoming/YouTube 2775 ytdl-sub media -"
+  ];
+
   services.ytdl-sub.instances.main = {
     enable = true;
     # TODO schedule = null;
+    # The unit runs with ProtectSystem=strict, which leaves the whole
+    # filesystem read-only apart from its own state and runtime directories.
+    # Without this the output tree is unwritable however it is chowned.
+    readWritePaths = [ "/srv/media/incoming/YouTube" ];
     config = {
       presets = {
         "YouTube Channel" = {
@@ -69,10 +77,13 @@
           url = "https://www.youtube.com/@moon-channel";
           date_range_after = "20241201";
         };
+        "Pinchflat" = "https://www.youtube.com/playlist?list=PLOqoltSk7NvI";
       };
     };
   };
 
+  systemd.services.ytdl-sub-main.serviceConfig.UMask = "0002";
+
   # TODO kavita vs komga?
   services.kavita = {
     enable = true;