This repository has no description
1.5 kB
45 lines
1{ config, lib, pkgs, ... }: let
2 vpnPort = 1637;
3 torrentport = 56709; # port forwarded in airvpn webinterface
4in {
5 imports = [
6 ../../.
7 ../../2configs
8 ../../2configs/retiolum.nix
9 ../../2configs/services/flix
10 ];
11
12 krebs.build.host = config.krebs.hosts.yellow;
13
14 krebs.sync-containers3.inContainer = {
15 enable = true;
16 pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN737BAP36KiZO97mPKTIUGJUcr97ps8zjfFag6cUiYL";
17 };
18
19 networking.useHostResolvConf = false;
20 networking.useNetworkd = true;
21
22 networking.wg-quick.interfaces.airvpn.configFile = "/var/src/secrets/airvpn.conf";
23 services.transmission.settings.peer-port = torrentport;
24
25 # only allow traffic through openvpn
26 krebs.iptables = {
27 enable = true;
28 tables.filter.INPUT.rules = [
29 { predicate = "-i airvpn -p tcp --dport ${toString torrentport}"; target = "ACCEPT"; }
30 { predicate = "-i airvpn -p udp --dport ${toString torrentport}"; target = "ACCEPT"; }
31 ];
32 tables.filter.OUTPUT = {
33 policy = "DROP";
34 rules = [
35 { predicate = "-o lo"; target = "ACCEPT"; }
36 { predicate = "-p udp --dport ${toString vpnPort}"; target = "ACCEPT"; }
37 { predicate = "-o airvpn"; target = "ACCEPT"; }
38 { predicate = "-o retiolum"; target = "ACCEPT"; }
39 { v6 = false; predicate = "-d 1.1.1.1/32"; target = "ACCEPT"; }
40 { v6 = false; predicate = "-d 1.0.0.1/32"; target = "ACCEPT"; }
41 { v6 = false; predicate = "-o eth0 -d 10.233.2.0/24"; target = "ACCEPT"; }
42 ];
43 };
44 };
45}