This repository has no description
5.1 kB
153 lines
1{
2 config,
3 pkgs,
4 lib,
5 ...
6}:
7let
8 torrentport = 56709; # port forwarded in airvpn webinterface
9in
10{
11 clan.core.vars.password-store.secretLocation = "/var/state/secret-vars";
12
13 imports = [
14 ../../configs
15 ../../configs/retiolum.nix
16 ../../configs/services/flix
17 ../../configs/autoupdate.nix
18 ../../configs/services/archiver-bot.nix
19 ];
20
21 # we need to configure another port for the mycelium admin interface, because it conflicts with sonarr.
22 services.mycelium.extraArgs = [
23 "--api-addr"
24 "127.0.0.1:9898"
25 ];
26
27 services.transmission.settings.peer-port = torrentport;
28 krebs.build.host = config.krebs.hosts.yellow;
29
30 krebs.sync-containers3.inContainer = {
31 enable = true;
32 pubkey = builtins.readFile ./facts/yellow.sync.pub;
33 };
34
35 networking.useHostResolvConf = false;
36 networking.useNetworkd = true;
37 networking.resolvconf.enable = false;
38 # we need to set a namserver here that can be also be reached from the transmission network namespace
39 environment.etc."resolv.conf".text = ''
40 options edns0
41 nameserver 1.1.1.1
42 '';
43 services.resolved.enable = lib.mkForce false;
44
45 systemd.services."netns@" = {
46 description = "%I network namespace";
47 before = [ "network.target" ];
48 serviceConfig = {
49 Type = "oneshot";
50 RemainAfterExit = true;
51 ExecStart = "${pkgs.iproute2}/bin/ip netns add %I";
52 ExecStop = "${pkgs.iproute2}/bin/ip netns del %I";
53 };
54 };
55
56 systemd.services.transmission-netns = {
57 bindsTo = [ "netns@transmission.service" ];
58 after = [ "netns@transmission.service" ];
59 path = [
60 pkgs.iproute2
61 pkgs.wireguard-tools
62 pkgs.gnused
63 pkgs.gawk
64 ];
65 script = ''
66 set -efux
67 until ${pkgs.dig.host}/bin/host europe.vpn.airdns.org; do sleep 1; done
68
69 ip link del t2 || :
70 ip -n transmission link set lo up
71 ip link add airvpn type wireguard
72 ip -n transmission link del airvpn || :
73 ip link set airvpn netns transmission
74 ip -n transmission addr add 10.176.43.231/32 dev airvpn
75 ip -n transmission addr add fd7d:76ee:e68f:a993:41b3:846b:d271:30d8/128 dev airvpn
76 # The transmission netns has no route until the tunnel is up, so wg must
77 # not resolve the endpoint from inside it: recent wireguard-tools resolve
78 # in the current netns, which stalls the deploy on ~70s of DNS retries.
79 # Resolve here in the main netns and hand wg a numeric Endpoint.
80 conf=$(wg-quick strip ${config.clan.core.vars.generators.airvpn.files."airvpn.conf".path})
81 ep=$(printf '%s\n' "$conf" | sed -n 's/^Endpoint *= *//p')
82 ephost=''${ep%:*}
83 epport=''${ep##*:}
84 epip=$(${pkgs.dig.host}/bin/host "$ephost" | awk '/has address/ { print $NF; exit }')
85 ip netns exec transmission wg syncconf airvpn \
86 <(printf '%s\n' "$conf" | sed "s|$ephost:$epport|$epip:$epport|")
87 ip -n transmission link set airvpn up
88 ip -n transmission route add default dev airvpn
89 ip -6 -n transmission route add default dev airvpn
90 ip link add t1 type veth peer name t2
91
92 ip -n transmission link del t1 || :
93 ip link set t1 netns transmission
94
95 ip addr add 128.0.0.2/30 dev t2
96 ip addr add fdb4:3310:947::1/64 dev t2
97 ip link set t2 up
98 ip -n transmission addr add 128.0.0.1/30 dev t1
99 ip -n transmission addr add fdb4:3310:947::2/64 dev t1
100 ip -n transmission link set t1 up
101 ip -n transmission route add 42:0:ce16::3110/16 via fdb4:3310:947::1 dev t1
102 '';
103 serviceConfig = {
104 RemainAfterExit = true;
105 Type = "oneshot";
106 };
107 };
108
109 clan.core.vars.generators.airvpn = {
110 files."airvpn.conf" = { };
111 prompts.config.description = ''
112 login into https://airvpn.org/ goto https://airvpn.org/generator/
113 generate a wireguard config
114 paste the config here
115 '';
116 runtimeInputs = with pkgs; [ coreutils ];
117 script = ''
118 cat "$prompts"/config > "$out"/airvpn.conf
119 '';
120 };
121
122 # so we can forward traffic from the transmission network namespace
123 boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
124
125 systemd.services.transmission = {
126 after = [ "transmission-netns.service" ];
127 wants = [ "transmission-netns.service" ];
128 bindsTo = [ "netns@transmission.service" ];
129 serviceConfig = {
130 NetworkNamespacePath = "/var/run/netns/transmission";
131 # https://github.com/NixOS/nixpkgs/issues/258793
132 RootDirectoryStartOnly = lib.mkForce false;
133 RootDirectory = lib.mkForce "";
134 CPUSchedulingPolicy = "idle";
135 IOSchedulingClass = "idle";
136 IOSchedulingPriority = 7;
137 # increase file descriptor limit to handle many torrents/peers
138 LimitNOFILE = 65536;
139 };
140 };
141 clan.core.vars.generators.yellow-container = {
142 files."yellow.sync.key" = { };
143 files."yellow.sync.pub".secret = false;
144 runtimeInputs = with pkgs; [
145 coreutils
146 openssh
147 ];
148 script = ''
149 ssh-keygen -t ed25519 -N "" -f "$out"/yellow.sync.key
150 mv "$out"/yellow.sync.key.pub "$out"/yellow.sync.pub
151 '';
152 };
153}