framework changes

nixos/celestia/configuration.nix

@@ -100,10 +100,6 @@ in {
     };
   };
 
-  systemd.services.dnscrypt-proxy2.serviceConfig = {
-    StateDirectory = "dnscrypt-proxy";
-  };
-
   security.acme = {
     acceptTerms = true;
     defaults = {
@@ -124,9 +120,9 @@ in {
       openFirewall = true;
       useRoutingFeatures = "both";
       extraUpFlags = ["--advertise-routes=192.168.1.11/32"];
-      authKeyFile = config.sops.secrets."tailscale-auth-key".path;  
+      authKeyFile = config.sops.secrets."tailscale-auth-key".path;
     };
-    
+
     dnscrypt-proxy2 = {
       enable = true;
       settings = {
@@ -413,4 +409,27 @@ in {
     enable = true;
     powerUpCommands = lib.strings.concatMapStringsSep "\n" (disk: "${pkgs.hdparm}/sbin/hdparm -S 241 " + disk) disks;
   };
+
+  systemd.services = let
+    ensure-perms = path: user: group: {
+      enable = true;
+      description = "Ensures permissionsions and ownership of files in ${path}";
+      wantedBy = ["multi-user.target"];
+
+      script = ''
+        while read -r evt file; do
+          ${pkgs.coreutils}/bin/chown ${user}:${group} "$file"
+          ${pkgs.coreutils}/bin/chmod 755 "$file"
+        done < <(${pkgs.inotify-tools}/bin/inotifywait -e create,move -m -r --format '%e %w%f' ${path})
+      '';
+    };
+  in {
+    dnscrypt-proxy2.serviceConfig = {
+      StateDirectory = "dnscrypt-proxy";
+    };
+
+    ensure-radarr-perms = ensure-perms "/tank/video/movie" "radarr" "nas";
+    ensure-sonarr-perms = ensure-perms "/tank/video/series" "sonarr" "nas";
+    ensure-lidarr-perms = ensure-perms "/tank/audio" "lidarr" "nas";
+  };
 }