This repository has no description
4.2 kB
138 lines
1{
2 config,
3 pkgs,
4 lib,
5 ...
6}:
7let
8 torrentport = 56709; # port forwarded in airvpn webinterface
9in
10{
11 imports = [
12 ../../2configs
13 ../../2configs/retiolum.nix
14 ../../2configs/services/flix
15 ];
16
17 clan.password-store.targetDirectory = "/var/state/secrets";
18
19 # we need to configure another port for the mycelium admin interface, because it conflicts with sonarr.
20 services.mycelium.extraArgs = [
21 "--api-addr"
22 "127.0.0.1:9898"
23 ];
24
25 services.transmission.settings.peer-port = torrentport;
26 krebs.build.host = config.krebs.hosts.yellow;
27
28 krebs.sync-containers3.inContainer = {
29 enable = true;
30 pubkey = builtins.readFile ./facts/yellow.sync.pub;
31 };
32
33 networking.useHostResolvConf = false;
34 networking.useNetworkd = true;
35 # we need to set a namserver here that can be also be reached from the transmission network namespace
36 environment.etc."resolv.conf".text = ''
37 options edns0
38 nameserver 9.9.9.9
39 '';
40 services.resolved.enable = lib.mkForce false;
41
42 systemd.services."netns@" = {
43 description = "%I network namespace";
44 before = [ "network.target" ];
45 serviceConfig = {
46 Type = "oneshot";
47 RemainAfterExit = true;
48 ExecStart = "${pkgs.iproute}/bin/ip netns add %I";
49 ExecStop = "${pkgs.iproute}/bin/ip netns del %I";
50 };
51 };
52
53 systemd.services.transmission-netns = {
54 bindsTo = [ "netns@transmission.service" ];
55 after = [ "netns@transmission.service" ];
56 path = [
57 pkgs.iproute2
58 pkgs.wireguard-tools
59 ];
60 script = ''
61 set -efux
62 until ${pkgs.dig.host}/bin/host europe.vpn.airdns.org; do sleep; done
63
64 ip link del t2 || :
65 ip -n transmission link set lo up
66 ip link add airvpn type wireguard
67 ip -n transmission link del airvpn || :
68 ip link set airvpn netns transmission
69 ip -n transmission addr add 10.176.43.231/32 dev airvpn
70 ip -n transmission addr add fd7d:76ee:e68f:a993:41b3:846b:d271:30d8/128 dev airvpn
71 ip netns exec transmission wg syncconf airvpn <(wg-quick strip ${
72 config.clanCore.facts.services.airvpn.secret."airvpn.conf".path
73 })
74 ip -n transmission link set airvpn up
75 ip -n transmission route add default dev airvpn
76 ip -6 -n transmission route add default dev airvpn
77 ip link add t1 type veth peer name t2
78
79 ip -n transmission link del t1 || :
80 ip link set t1 netns transmission
81
82 ip addr add 128.0.0.2/30 dev t2
83 ip addr add fdb4:3310:947::1/64 dev t2
84 ip link set t2 up
85 ip -n transmission addr add 128.0.0.1/30 dev t1
86 ip -n transmission addr add fdb4:3310:947::2/64 dev t1
87 ip -n transmission link set t1 up
88 ip -n transmission route add 42:0:ce16::3110/16 via fdb4:3310:947::1 dev t1
89 '';
90 serviceConfig = {
91 RemainAfterExit = true;
92 Type = "oneshot";
93 };
94 };
95
96 clanCore.facts.services.airvpn = {
97 secret."airvpn.conf" = { };
98 generator.path = with pkgs; [ coreutils ];
99 generator.prompt = ''
100 login into https://airvpn.org/ goto https://airvpn.org/generator/
101 generate a wireguard config
102 paste the config here
103 '';
104 generator.script = ''
105 echo "$prompt_value" > "$secrets"/airvpn.conf
106 '';
107 };
108
109 # so we can forward traffic from the transmission network namespace
110 boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
111
112 systemd.services.transmission = {
113 after = [ "transmission-netns.service" ];
114 wants = [ "transmission-netns.service" ];
115 bindsTo = [ "netns@transmission.service" ];
116 serviceConfig = {
117 NetworkNamespacePath = "/var/run/netns/transmission";
118 # https://github.com/NixOS/nixpkgs/issues/258793
119 RootDirectoryStartOnly = lib.mkForce false;
120 RootDirectory = lib.mkForce "";
121 CPUSchedulingPolicy = "idle";
122 IOSchedulingClass = "idle";
123 IOSchedulingPriority = 7;
124 };
125 };
126 clanCore.facts.services.yellow-container = {
127 secret."yellow.sync.key" = { };
128 public."yellow.sync.pub" = { };
129 generator.path = with pkgs; [
130 coreutils
131 openssh
132 ];
133 generator.script = ''
134 ssh-keygen -t ed25519 -N "" -f "$secrets"/yellow.sync.key
135 mv "$secrets"/yellow.sync.key "$facts"/yellow.sync.pub
136 '';
137 };
138}