forked from
lass.pds.lassul.us/superconfig
This repository has no description
4.0 kB
121 lines
1{ config, pkgs, lib, ... }: let
2 torrentport = 56709; # port forwarded in airvpn webinterface
3in {
4 imports = [
5 ../../2configs
6 ../../2configs/retiolum.nix
7 ../../2configs/services/flix
8 ];
9
10 # we need to configure another port for the mycelium admin interface, because it conflicts with sonarr.
11 services.mycelium.extraArgs = [
12 "--api-addr" "127.0.0.1:9898"
13 ];
14
15 services.transmission.settings.peer-port = torrentport;
16 krebs.build.host = config.krebs.hosts.yellow;
17
18 krebs.sync-containers3.inContainer = {
19 enable = true;
20 pubkey = builtins.readFile ./facts/yellow.sync.pub;
21 };
22
23 networking.useHostResolvConf = false;
24 networking.useNetworkd = true;
25 # we need to set a namserver here that can be also be reached from the transmission network namespace
26 environment.etc."resolv.conf".text = ''
27 options edns0
28 nameserver 9.9.9.9
29 '';
30 services.resolved.enable = lib.mkForce false;
31
32 systemd.services."netns@" = {
33 description = "%I network namespace";
34 before = [ "network.target" ];
35 serviceConfig = {
36 Type = "oneshot";
37 RemainAfterExit = true;
38 ExecStart = "${pkgs.iproute}/bin/ip netns add %I";
39 ExecStop = "${pkgs.iproute}/bin/ip netns del %I";
40 };
41 };
42
43 systemd.services.transmission-netns = {
44 bindsTo = [ "netns@transmission.service" ];
45 after = [ "netns@transmission.service" ];
46 path = [
47 pkgs.iproute2
48 pkgs.wireguard-tools
49 ];
50 script = ''
51 set -efux
52 ip link del t2 || :
53 ip -n transmission link set lo up
54 ip link add airvpn type wireguard
55 ip -n transmission link del airvpn || :
56 ip link set airvpn netns transmission
57 ip -n transmission addr add 10.176.43.231/32 dev airvpn
58 ip -n transmission addr add fd7d:76ee:e68f:a993:41b3:846b:d271:30d8/128 dev airvpn
59 ip netns exec transmission wg syncconf airvpn <(wg-quick strip ${config.clanCore.facts.services.airvpn.secret."airvpn.conf".path})
60 ip -n transmission link set airvpn up
61 ip -n transmission route add default dev airvpn
62 ip -6 -n transmission route add default dev airvpn
63 ip link add t1 type veth peer name t2
64
65 ip -n transmission link del t1 || :
66 ip link set t1 netns transmission
67
68 ip addr add 128.0.0.2/30 dev t2
69 ip addr add fdb4:3310:947::1/64 dev t2
70 ip link set t2 up
71 ip -n transmission addr add 128.0.0.1/30 dev t1
72 ip -n transmission addr add fdb4:3310:947::2/64 dev t1
73 ip -n transmission link set t1 up
74 ip -n transmission route add 42:0:ce16::3110/16 via fdb4:3310:947::1 dev t1
75 '';
76 serviceConfig = {
77 RemainAfterExit = true;
78 Type = "oneshot";
79 };
80 };
81
82 clanCore.facts.services.airvpn = {
83 secret."airvpn.conf" = { };
84 generator.path = with pkgs; [ coreutils ];
85 generator.prompt = ''
86 login into https://airvpn.org/ goto https://airvpn.org/generator/
87 generate a wireguard config
88 paste the config here
89 '';
90 generator.script = ''
91 echo "$prompt_value" > "$secrets"/airvpn.conf
92 '';
93 };
94
95 # so we can forward traffic from the transmission network namespace
96 boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
97
98 systemd.services.transmission = {
99 after = [ "transmission-netns.service" ];
100 wants = [ "transmission-netns.service" ];
101 bindsTo = [ "netns@transmission.service" ];
102 serviceConfig = {
103 NetworkNamespacePath = "/var/run/netns/transmission";
104 # https://github.com/NixOS/nixpkgs/issues/258793
105 RootDirectoryStartOnly = lib.mkForce false;
106 RootDirectory = lib.mkForce "";
107 CPUSchedulingPolicy = "idle";
108 IOSchedulingClass = "idle";
109 IOSchedulingPriority = 7;
110 };
111 };
112 clanCore.facts.services.yellow-container = {
113 secret."yellow.sync.key" = { };
114 public."yellow.sync.pub" = { };
115 generator.path = with pkgs; [ coreutils openssh ];
116 generator.script = ''
117 ssh-keygen -t ed25519 -N "" -f "$secrets"/yellow.sync.key
118 mv "$secrets"/yellow.sync.key "$facts"/yellow.sync.pub
119 '';
120 };
121}