This repository has no description
machines.yellow: use netns for transmission
author
lassulus
date
(Sep 15, 2023, 3:53 PM CEST)
commit
4ab67860
4ab67860b2e50527810c448406f68eebc49a21c2
parent
60a99d3e
60a99d3ebd520fec752a614639b2bcd4ca9754bd
+36
-24
+34
-22
nixos/machines/yellow/config.nix
+34
-22
nixos/machines/yellow/config.nix
···
1
-
{ config, lib, pkgs, ... }: let
2
-
vpnPort = 1637;
1
+
{ config, pkgs, ... }: let
3
2
torrentport = 56709; # port forwarded in airvpn webinterface
4
3
in {
5
4
imports = [
···
9
8
../../2configs/services/flix
10
9
];
11
10
11
+
services.transmission.settings.peer-port = torrentport;
12
12
krebs.build.host = config.krebs.hosts.yellow;
13
13
14
14
krebs.sync-containers3.inContainer = {
···
19
19
networking.useHostResolvConf = false;
20
20
networking.useNetworkd = true;
21
21
22
-
networking.wg-quick.interfaces.airvpn.configFile = "/var/src/secrets/airvpn.conf";
23
-
services.transmission.settings.peer-port = torrentport;
24
-
25
-
# only allow traffic through openvpn
26
-
krebs.iptables = {
27
-
enable = true;
28
-
tables.filter.INPUT.rules = [
29
-
{ predicate = "-i airvpn -p tcp --dport ${toString torrentport}"; target = "ACCEPT"; }
30
-
{ predicate = "-i airvpn -p udp --dport ${toString torrentport}"; target = "ACCEPT"; }
22
+
systemd.services.transmission-netns = {
23
+
wantedBy = [ "multi-user.target" ];
24
+
path = [
25
+
pkgs.iproute2
26
+
pkgs.wireguard-tools
31
27
];
32
-
tables.filter.OUTPUT = {
33
-
policy = "DROP";
34
-
rules = [
35
-
{ predicate = "-o lo"; target = "ACCEPT"; }
36
-
{ predicate = "-p udp --dport ${toString vpnPort}"; target = "ACCEPT"; }
37
-
{ predicate = "-o airvpn"; target = "ACCEPT"; }
38
-
{ predicate = "-o retiolum"; target = "ACCEPT"; }
39
-
{ v6 = false; predicate = "-d 1.1.1.1/32"; target = "ACCEPT"; }
40
-
{ v6 = false; predicate = "-d 1.0.0.1/32"; target = "ACCEPT"; }
41
-
{ v6 = false; predicate = "-o eth0 -d 10.233.2.0/24"; target = "ACCEPT"; }
42
-
];
28
+
script = ''
29
+
set -efux
30
+
ip netns delete transmission || :
31
+
ip netns add transmission
32
+
ip -n transmission link set lo up
33
+
ip link add airvpn type wireguard
34
+
ip link set airvpn netns transmission
35
+
ip -n transmission addr add 10.176.43.231/32 dev airvpn
36
+
ip -n transmission addr add fd7d:76ee:e68f:a993:41b3:846b:d271:30d8/128 dev airvpn
37
+
ip netns exec transmission wg syncconf airvpn <(wg-quick strip /etc/secrets/airvpn.conf)
38
+
ip -n transmission link set airvpn up
39
+
ip -n transmission route add default dev airvpn
40
+
ip link add t1 type veth peer name t2
41
+
ip link set t1 netns transmission
42
+
ip addr add 128.0.0.2/30 dev t2
43
+
ip link set t2 up
44
+
ip -n transmission addr add 128.0.0.1/30 dev t1
45
+
ip -n transmission link set t1 up
46
+
'';
47
+
serviceConfig = {
48
+
RemainAfterExit = true;
49
+
Type = "oneshot";
43
50
};
51
+
};
52
+
53
+
systemd.services.transmission = {
54
+
after = [ "transmission-netns.service" ];
55
+
serviceConfig.NetworkNamespacePath = "/var/run/netns/transmission";
44
56
};
45
57
}
+2
-2
nixos/2configs/services/flix/default.nix
+2
-2
nixos/2configs/services/flix/default.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ config, pkgs, ... }:
2
2
{
3
3
users.groups.download.members = [ "transmission" ];
4
4
services.transmission = {
···
141
141
addSSL = true;
142
142
locations."/" = {
143
143
proxyWebsockets = true;
144
-
proxyPass = "http://localhost:9091";
144
+
proxyPass = "http://128.0.0.1:9091";
145
145
};
146
146
};
147
147
virtualHosts."radar.r" = {