Add new server modules and configurations for various services

- Introduced `default-creds` module for managing default credentials with Umami integration.
- Added `fail2ban` module for brute-force attack protection with configurable ban times.
- Created `firewall` module to enable and configure basic firewall settings.
- Implemented `gitea` module for self-hosted Git service with PostgreSQL backend.
- Developed `glance` module for a customizable dashboard with various widgets and themes.
- Added `iknowyou` module for a self-hosted password manager with production and demo environments.
- Introduced `kernel-hardening` module for enhancing kernel security settings.
- Created `mazanoke` module for a simple web application with Nginx integration.
- Added `mealie` module for a self-hosted meal planning application.
- Implemented `stirling-pdf` module for PDF generation service.
- Developed `umami` module for self-hosted analytics with secret management.
- Added `ssh` module for secure SSH configuration with user restrictions.
- Introduced `nixy` theme for a customized aesthetic experience across services.

server-modules/arr.nix

@@ -0,0 +1,66 @@
+# *arr is a collection of media management applications.
+# See https://github.com/rasmus-kirk/nixarr
+# Setup guide: https://nixarr.com/wiki/setup/
+{config, ...}: let
+  username = config.var.username;
+in {
+  # Add my secrets
+  sops.secrets = {
+    recyclarr = {
+      owner = "recyclarr";
+      mode = "0777";
+    };
+    wireguard-pia = {
+      group = "media";
+      mode = "0600";
+    };
+  };
+
+  nixarr = {
+    enable = true;
+
+    mediaUsers = [username];
+    mediaDir = "/mnt/data/media";
+    stateDir = "/mnt/data/.state/nixarr";
+
+    vpn = {
+      enable = true;
+      wgConf = config.sops.secrets.wireguard-pia.path;
+    };
+
+    jellyfin.enable = true;
+    jellyseerr.enable = true;
+    prowlarr.enable = true;
+    radarr.enable = true;
+    sonarr.enable = true;
+    bazarr.enable = true;
+    transmission = {
+      enable = true;
+      extraSettings = {
+        trash-original-torrent-files = true;
+        rpc-whitelist-enabled = false;
+        rpc-host-whitelist-enabled = false;
+      };
+      vpn.enable = true;
+    };
+    recyclarr = {
+      enable = true;
+      configFile = config.sops.secrets.recyclarr.path;
+    };
+  };
+
+  users.users.jellyfin.extraGroups = [
+    "video"
+    "render"
+  ];
+
+  services.cloudflared.tunnels."${config.var.tunnelId}".ingress = {
+    "media.${config.var.domain}" = "http://localhost:8096";
+    "demandemedia.${config.var.domain}" = "http://localhost:5055";
+    "bazarr.${config.var.domain}" = "http://localhost:6767";
+    "prowlarr.${config.var.domain}" = "http://localhost:9696";
+    "radarr.${config.var.domain}" = "http://localhost:7878";
+    "sonarr.${config.var.domain}" = "http://localhost:8989";
+    "transmission.${config.var.domain}" = "http://localhost:9091";
+  };
+}