This repository has no description
4.3 kB
139 lines
1{
2 config,
3 pkgs,
4 lib,
5 ...
6}:
7let
8 torrentport = 56709; # port forwarded in airvpn webinterface
9in
10{
11 clan.core.vars.password-store.secretLocation = "/var/state/secret-vars";
12
13 imports = [
14 ../../2configs
15 ../../2configs/retiolum.nix
16 ../../2configs/services/flix
17 ../../2configs/autoupdate.nix
18 ];
19
20 # we need to configure another port for the mycelium admin interface, because it conflicts with sonarr.
21 services.mycelium.extraArgs = [
22 "--api-addr"
23 "127.0.0.1:9898"
24 ];
25
26 services.transmission.settings.peer-port = torrentport;
27 krebs.build.host = config.krebs.hosts.yellow;
28
29 krebs.sync-containers3.inContainer = {
30 enable = true;
31 pubkey = builtins.readFile ./facts/yellow.sync.pub;
32 };
33
34 networking.useHostResolvConf = false;
35 networking.useNetworkd = true;
36 # we need to set a namserver here that can be also be reached from the transmission network namespace
37 environment.etc."resolv.conf".text = ''
38 options edns0
39 nameserver 9.9.9.9
40 '';
41 services.resolved.enable = lib.mkForce false;
42
43 systemd.services."netns@" = {
44 description = "%I network namespace";
45 before = [ "network.target" ];
46 serviceConfig = {
47 Type = "oneshot";
48 RemainAfterExit = true;
49 ExecStart = "${pkgs.iproute2}/bin/ip netns add %I";
50 ExecStop = "${pkgs.iproute2}/bin/ip netns del %I";
51 };
52 };
53
54 systemd.services.transmission-netns = {
55 bindsTo = [ "netns@transmission.service" ];
56 after = [ "netns@transmission.service" ];
57 path = [
58 pkgs.iproute2
59 pkgs.wireguard-tools
60 ];
61 script = ''
62 set -efux
63 until ${pkgs.dig.host}/bin/host europe.vpn.airdns.org; do sleep; done
64
65 ip link del t2 || :
66 ip -n transmission link set lo up
67 ip link add airvpn type wireguard
68 ip -n transmission link del airvpn || :
69 ip link set airvpn netns transmission
70 ip -n transmission addr add 10.176.43.231/32 dev airvpn
71 ip -n transmission addr add fd7d:76ee:e68f:a993:41b3:846b:d271:30d8/128 dev airvpn
72 ip netns exec transmission wg syncconf airvpn <(wg-quick strip ${
73 config.clan.core.vars.generators.airvpn.files."airvpn.conf".path
74 })
75 ip -n transmission link set airvpn up
76 ip -n transmission route add default dev airvpn
77 ip -6 -n transmission route add default dev airvpn
78 ip link add t1 type veth peer name t2
79
80 ip -n transmission link del t1 || :
81 ip link set t1 netns transmission
82
83 ip addr add 128.0.0.2/30 dev t2
84 ip addr add fdb4:3310:947::1/64 dev t2
85 ip link set t2 up
86 ip -n transmission addr add 128.0.0.1/30 dev t1
87 ip -n transmission addr add fdb4:3310:947::2/64 dev t1
88 ip -n transmission link set t1 up
89 ip -n transmission route add 42:0:ce16::3110/16 via fdb4:3310:947::1 dev t1
90 '';
91 serviceConfig = {
92 RemainAfterExit = true;
93 Type = "oneshot";
94 };
95 };
96
97 clan.core.vars.generators.airvpn = {
98 files."airvpn.conf" = { };
99 prompts.config.description = ''
100 login into https://airvpn.org/ goto https://airvpn.org/generator/
101 generate a wireguard config
102 paste the config here
103 '';
104 runtimeInputs = with pkgs; [ coreutils ];
105 script = ''
106 cat "$prompts"/config > "$out"/airvpn.conf
107 '';
108 };
109
110 # so we can forward traffic from the transmission network namespace
111 boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
112
113 systemd.services.transmission = {
114 after = [ "transmission-netns.service" ];
115 wants = [ "transmission-netns.service" ];
116 bindsTo = [ "netns@transmission.service" ];
117 serviceConfig = {
118 NetworkNamespacePath = "/var/run/netns/transmission";
119 # https://github.com/NixOS/nixpkgs/issues/258793
120 RootDirectoryStartOnly = lib.mkForce false;
121 RootDirectory = lib.mkForce "";
122 CPUSchedulingPolicy = "idle";
123 IOSchedulingClass = "idle";
124 IOSchedulingPriority = 7;
125 };
126 };
127 clan.core.vars.generators.yellow-container = {
128 files."yellow.sync.key" = { };
129 files."yellow.sync.pub".secret = false;
130 runtimeInputs = with pkgs; [
131 coreutils
132 openssh
133 ];
134 script = ''
135 ssh-keygen -t ed25519 -N "" -f "$out"/yellow.sync.key
136 mv "$out"/yellow.sync.key.pub "$out"/yellow.sync.pub
137 '';
138 };
139}