This repository has no description
4.8 kB
147 lines
1{
2 config,
3 pkgs,
4 lib,
5 ...
6}:
7let
8 torrentport = 56709; # port forwarded in airvpn webinterface
9in
10{
11 clan.core.vars.password-store.secretLocation = "/var/state/secret-vars";
12
13 imports = [
14 ../../configs
15 ../../configs/retiolum.nix
16 ../../configs/services/flix
17 ../../configs/autoupdate.nix
18 ../../configs/services/archiver-bot.nix
19 ./backup.nix
20 ];
21
22 services.transmission.settings.peer-port = torrentport;
23
24 lass.sync-containers3.inContainer = {
25 enable = true;
26 pubkey = builtins.readFile ./facts/yellow.sync.pub;
27 };
28
29 networking.useHostResolvConf = false;
30 networking.useNetworkd = true;
31 networking.resolvconf.enable = false;
32 # we need to set a namserver here that can be also be reached from the transmission network namespace
33 environment.etc."resolv.conf".text = ''
34 options edns0
35 nameserver 1.1.1.1
36 '';
37 services.resolved.enable = lib.mkForce false;
38
39 systemd.services."netns@" = {
40 description = "%I network namespace";
41 before = [ "network.target" ];
42 serviceConfig = {
43 Type = "oneshot";
44 RemainAfterExit = true;
45 ExecStart = "${pkgs.iproute2}/bin/ip netns add %I";
46 ExecStop = "${pkgs.iproute2}/bin/ip netns del %I";
47 };
48 };
49
50 systemd.services.transmission-netns = {
51 bindsTo = [ "netns@transmission.service" ];
52 after = [ "netns@transmission.service" ];
53 path = [
54 pkgs.iproute2
55 pkgs.wireguard-tools
56 pkgs.gnused
57 pkgs.gawk
58 ];
59 script = ''
60 set -efux
61 until ${pkgs.dig.host}/bin/host europe.vpn.airdns.org; do sleep 1; done
62
63 ip link del t2 || :
64 ip -n transmission link set lo up
65 ip link add airvpn type wireguard
66 ip -n transmission link del airvpn || :
67 ip link set airvpn netns transmission
68 ip -n transmission addr add 10.176.43.231/32 dev airvpn
69 ip -n transmission addr add fd7d:76ee:e68f:a993:41b3:846b:d271:30d8/128 dev airvpn
70 # The transmission netns has no route until the tunnel is up, so wg must
71 # not resolve the endpoint from inside it: recent wireguard-tools resolve
72 # in the current netns, which stalls the deploy on ~70s of DNS retries.
73 # Resolve here in the main netns and hand wg a numeric Endpoint.
74 conf=$(wg-quick strip ${config.clan.core.vars.generators.airvpn.files."airvpn.conf".path})
75 ep=$(printf '%s\n' "$conf" | sed -n 's/^Endpoint *= *//p')
76 ephost=''${ep%:*}
77 epport=''${ep##*:}
78 epip=$(${pkgs.dig.host}/bin/host "$ephost" | awk '/has address/ { print $NF; exit }')
79 ip netns exec transmission wg syncconf airvpn \
80 <(printf '%s\n' "$conf" | sed "s|$ephost:$epport|$epip:$epport|")
81 ip -n transmission link set airvpn up
82 ip -n transmission route add default dev airvpn
83 ip -6 -n transmission route add default dev airvpn
84 ip link add t1 type veth peer name t2
85
86 ip -n transmission link del t1 || :
87 ip link set t1 netns transmission
88
89 ip addr add 128.0.0.2/30 dev t2
90 ip addr add fdb4:3310:947::1/64 dev t2
91 ip link set t2 up
92 ip -n transmission addr add 128.0.0.1/30 dev t1
93 ip -n transmission addr add fdb4:3310:947::2/64 dev t1
94 ip -n transmission link set t1 up
95 ip -n transmission route add 42:0:ce16::3110/16 via fdb4:3310:947::1 dev t1
96 '';
97 serviceConfig = {
98 RemainAfterExit = true;
99 Type = "oneshot";
100 };
101 };
102
103 clan.core.vars.generators.airvpn = {
104 files."airvpn.conf" = { };
105 prompts.config.description = ''
106 login into https://airvpn.org/ goto https://airvpn.org/generator/
107 generate a wireguard config
108 paste the config here
109 '';
110 runtimeInputs = with pkgs; [ coreutils ];
111 script = ''
112 cat "$prompts"/config > "$out"/airvpn.conf
113 '';
114 };
115
116 # so we can forward traffic from the transmission network namespace
117 boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
118
119 systemd.services.transmission = {
120 after = [ "transmission-netns.service" ];
121 wants = [ "transmission-netns.service" ];
122 bindsTo = [ "netns@transmission.service" ];
123 serviceConfig = {
124 NetworkNamespacePath = "/var/run/netns/transmission";
125 # https://github.com/NixOS/nixpkgs/issues/258793
126 RootDirectoryStartOnly = lib.mkForce false;
127 RootDirectory = lib.mkForce "";
128 CPUSchedulingPolicy = "idle";
129 IOSchedulingClass = "idle";
130 IOSchedulingPriority = 7;
131 # increase file descriptor limit to handle many torrents/peers
132 LimitNOFILE = 65536;
133 };
134 };
135 clan.core.vars.generators.yellow-container = {
136 files."yellow.sync.key" = { };
137 files."yellow.sync.pub".secret = false;
138 runtimeInputs = with pkgs; [
139 coreutils
140 openssh
141 ];
142 script = ''
143 ssh-keygen -t ed25519 -N "" -f "$out"/yellow.sync.key
144 mv "$out"/yellow.sync.key.pub "$out"/yellow.sync.pub
145 '';
146 };
147}