This repository has no description
3.0 kB
88 lines
1{ config, pkgs, lib, ... }: let
2 torrentport = 56709; # port forwarded in airvpn webinterface
3in {
4 imports = [
5 ../../2configs
6 ../../2configs/retiolum.nix
7 ../../2configs/services/flix
8 ];
9
10 services.transmission.settings.peer-port = torrentport;
11 krebs.build.host = config.krebs.hosts.yellow;
12
13 krebs.sync-containers3.inContainer = {
14 enable = true;
15 pubkey = builtins.readFile ./facts/yellow.sync.pub;
16 };
17
18 networking.useHostResolvConf = false;
19 networking.useNetworkd = true;
20 # we need to set a namserver here that can be also be reached from the transmission network namespace
21 environment.etc."resolv.conf".text = ''
22 options edns0
23 nameserver 9.9.9.9
24 '';
25 services.resolved.enable = lib.mkForce false;
26
27 systemd.services.transmission-netns = {
28 wantedBy = [ "multi-user.target" ];
29 path = [
30 pkgs.iproute2
31 pkgs.wireguard-tools
32 ];
33 script = ''
34 set -efux
35 ip netns delete transmission || :
36 ip link del t2 || :
37 ip netns add transmission
38 ip -n transmission link set lo up
39 ip link add airvpn type wireguard
40 ip link set airvpn netns transmission
41 ip -n transmission addr add 10.176.43.231/32 dev airvpn
42 ip -n transmission addr add fd7d:76ee:e68f:a993:41b3:846b:d271:30d8/128 dev airvpn
43 ip netns exec transmission wg syncconf airvpn <(wg-quick strip /etc/secrets/airvpn.conf)
44 ip -n transmission link set airvpn up
45 ip -n transmission route add default dev airvpn
46 ip -6 -n transmission route add default dev airvpn
47 ip link add t1 type veth peer name t2
48 ip link set t1 netns transmission
49
50 ip addr add 128.0.0.2/30 dev t2
51 ip addr add fdb4:3310:947::1/64 dev t2
52 ip link set t2 up
53 ip -n transmission addr add 128.0.0.1/30 dev t1
54 ip -n transmission addr add fdb4:3310:947::2/64 dev t1
55 ip -n transmission link set t1 up
56 ip -n transmission route add 42:0:ce16::3110/16 via fdb4:3310:947::1 dev t1
57 '';
58 serviceConfig = {
59 RemainAfterExit = true;
60 Type = "oneshot";
61 };
62 };
63
64 # so we can forward traffic from the transmission network namespace
65 boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
66
67 systemd.services.transmission = {
68 after = [ "transmission-netns.service" ];
69 serviceConfig = {
70 NetworkNamespacePath = "/var/run/netns/transmission";
71 # https://github.com/NixOS/nixpkgs/issues/258793
72 RootDirectoryStartOnly = lib.mkForce false;
73 RootDirectory = lib.mkForce "";
74 CPUSchedulingPolicy = "idle";
75 IOSchedulingClass = "idle";
76 IOSchedulingPriority = 7;
77 };
78 };
79 clanCore.secrets.yellow-container = {
80 secrets."yellow.sync.key" = { };
81 facts."yellow.sync.pub" = { };
82 generator.path = with pkgs; [ coreutils openssh ];
83 generator.script = ''
84 ssh-keygen -t ed25519 -N "" -f "$secrets"/yellow.sync.key
85 mv "$secrets"/yellow.sync.key "$facts"/yellow.sync.pub
86 '';
87 };
88}