This repository has no description
4.1 kB
123 lines
1{ config, pkgs, lib, ... }: let
2 torrentport = 56709; # port forwarded in airvpn webinterface
3in {
4 imports = [
5 ../../2configs
6 ../../2configs/retiolum.nix
7 ../../2configs/services/flix
8 ];
9
10 clan.password-store.targetDirectory = "/var/state/secrets";
11
12 # we need to configure another port for the mycelium admin interface, because it conflicts with sonarr.
13 services.mycelium.extraArgs = [
14 "--api-addr" "127.0.0.1:9898"
15 ];
16
17 services.transmission.settings.peer-port = torrentport;
18 krebs.build.host = config.krebs.hosts.yellow;
19
20 krebs.sync-containers3.inContainer = {
21 enable = true;
22 pubkey = builtins.readFile ./facts/yellow.sync.pub;
23 };
24
25 networking.useHostResolvConf = false;
26 networking.useNetworkd = true;
27 # we need to set a namserver here that can be also be reached from the transmission network namespace
28 environment.etc."resolv.conf".text = ''
29 options edns0
30 nameserver 9.9.9.9
31 '';
32 services.resolved.enable = lib.mkForce false;
33
34 systemd.services."netns@" = {
35 description = "%I network namespace";
36 before = [ "network.target" ];
37 serviceConfig = {
38 Type = "oneshot";
39 RemainAfterExit = true;
40 ExecStart = "${pkgs.iproute}/bin/ip netns add %I";
41 ExecStop = "${pkgs.iproute}/bin/ip netns del %I";
42 };
43 };
44
45 systemd.services.transmission-netns = {
46 bindsTo = [ "netns@transmission.service" ];
47 after = [ "netns@transmission.service" ];
48 path = [
49 pkgs.iproute2
50 pkgs.wireguard-tools
51 ];
52 script = ''
53 set -efux
54 ip link del t2 || :
55 ip -n transmission link set lo up
56 ip link add airvpn type wireguard
57 ip -n transmission link del airvpn || :
58 ip link set airvpn netns transmission
59 ip -n transmission addr add 10.176.43.231/32 dev airvpn
60 ip -n transmission addr add fd7d:76ee:e68f:a993:41b3:846b:d271:30d8/128 dev airvpn
61 ip netns exec transmission wg syncconf airvpn <(wg-quick strip ${config.clanCore.facts.services.airvpn.secret."airvpn.conf".path})
62 ip -n transmission link set airvpn up
63 ip -n transmission route add default dev airvpn
64 ip -6 -n transmission route add default dev airvpn
65 ip link add t1 type veth peer name t2
66
67 ip -n transmission link del t1 || :
68 ip link set t1 netns transmission
69
70 ip addr add 128.0.0.2/30 dev t2
71 ip addr add fdb4:3310:947::1/64 dev t2
72 ip link set t2 up
73 ip -n transmission addr add 128.0.0.1/30 dev t1
74 ip -n transmission addr add fdb4:3310:947::2/64 dev t1
75 ip -n transmission link set t1 up
76 ip -n transmission route add 42:0:ce16::3110/16 via fdb4:3310:947::1 dev t1
77 '';
78 serviceConfig = {
79 RemainAfterExit = true;
80 Type = "oneshot";
81 };
82 };
83
84 clanCore.facts.services.airvpn = {
85 secret."airvpn.conf" = { };
86 generator.path = with pkgs; [ coreutils ];
87 generator.prompt = ''
88 login into https://airvpn.org/ goto https://airvpn.org/generator/
89 generate a wireguard config
90 paste the config here
91 '';
92 generator.script = ''
93 echo "$prompt_value" > "$secrets"/airvpn.conf
94 '';
95 };
96
97 # so we can forward traffic from the transmission network namespace
98 boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
99
100 systemd.services.transmission = {
101 after = [ "transmission-netns.service" ];
102 wants = [ "transmission-netns.service" ];
103 bindsTo = [ "netns@transmission.service" ];
104 serviceConfig = {
105 NetworkNamespacePath = "/var/run/netns/transmission";
106 # https://github.com/NixOS/nixpkgs/issues/258793
107 RootDirectoryStartOnly = lib.mkForce false;
108 RootDirectory = lib.mkForce "";
109 CPUSchedulingPolicy = "idle";
110 IOSchedulingClass = "idle";
111 IOSchedulingPriority = 7;
112 };
113 };
114 clanCore.facts.services.yellow-container = {
115 secret."yellow.sync.key" = { };
116 public."yellow.sync.pub" = { };
117 generator.path = with pkgs; [ coreutils openssh ];
118 generator.script = ''
119 ssh-keygen -t ed25519 -N "" -f "$secrets"/yellow.sync.key
120 mv "$secrets"/yellow.sync.key "$facts"/yellow.sync.pub
121 '';
122 };
123}