nixfiles/nixos/boxes/colony/vms/shill/containers/jackflix/networking.nix

158 lines
4.4 KiB
Nix
Raw Normal View History

2022-06-11 19:13:20 +01:00
{ lib, pkgs, config, assignments, ... }:
let
2022-06-12 14:03:44 +01:00
inherit (lib) mkMerge mkIf;
2022-06-11 19:13:20 +01:00
inherit (lib.my) networkdAssignment;
2023-11-02 13:41:50 +00:00
inherit (lib.my.c.colony) prefixes;
2022-06-11 19:13:20 +01:00
wg = {
2023-07-30 15:12:45 +01:00
keyFile = "jackflix/airvpn-privkey";
pskFile = "jackflix/airvpn-psk";
2022-06-11 19:13:20 +01:00
fwMark = 42;
routeTable = 51820;
};
2022-06-12 14:03:44 +01:00
2023-07-30 15:12:45 +01:00
# Forwarded in AirVPN config
transmissionPeerPort = 47016;
2022-06-11 19:13:20 +01:00
in
{
2022-06-12 14:03:44 +01:00
config = mkMerge [
{
my = {
secrets = {
files."${wg.keyFile}" = {
group = "systemd-network";
mode = "440";
};
2023-07-30 15:12:45 +01:00
files."${wg.pskFile}" = {
group = "systemd-network";
mode = "440";
};
2022-06-11 19:13:20 +01:00
};
2022-06-12 14:03:44 +01:00
firewall = {
extraRules = ''
# Make sure that VPN connections are dropped (except for the Transmission port)
table inet filter {
chain tcp-ext {
tcp dport ${toString transmissionPeerPort} accept
iifname vpn return
2022-06-11 19:13:20 +01:00
2024-05-06 00:57:52 +01:00
tcp dport { 19999, 9091, 9117, 7878, 8989, 8096, 2342 } accept
2022-06-12 14:03:44 +01:00
return
}
chain input {
tcp flags & (fin|syn|rst|ack) == syn ct state new jump tcp-ext
}
2022-06-11 19:13:20 +01:00
}
2022-06-12 14:03:44 +01:00
'';
2022-06-11 19:13:20 +01:00
};
2022-06-12 14:03:44 +01:00
};
2022-06-11 19:13:20 +01:00
2022-06-12 14:03:44 +01:00
environment.systemPackages = with pkgs; [
wireguard-tools
];
2022-06-11 19:13:20 +01:00
2022-06-12 14:03:44 +01:00
services = {
transmission.settings.peer-port = transmissionPeerPort;
};
2022-06-11 19:13:20 +01:00
2022-06-12 14:03:44 +01:00
systemd = {
network = {
netdevs."30-vpn" = with wg; {
netdevConfig = {
Name = "vpn";
Kind = "wireguard";
2023-07-30 15:12:45 +01:00
# Specified by AirVPN
MTUBytes = "1320";
2022-06-12 14:03:44 +01:00
};
wireguardConfig = {
PrivateKeyFile = config.age.secrets."${keyFile}".path;
FirewallMark = fwMark;
RouteTable = routeTable;
};
wireguardPeers = [
2022-06-11 19:13:20 +01:00
{
2023-07-30 15:12:45 +01:00
# AirVPN NL
2022-06-12 14:03:44 +01:00
wireguardPeerConfig = {
2023-07-30 15:12:45 +01:00
Endpoint = "2a00:1678:1337:2329:e5f:35d4:4404:ef9f:1637";
PublicKey = "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=";
PresharedKeyFile = config.age.secrets."${pskFile}".path;
2022-06-12 14:03:44 +01:00
AllowedIPs = [ "0.0.0.0/0" "::/0" ];
};
2022-06-11 19:13:20 +01:00
}
2022-06-12 14:03:44 +01:00
];
};
2022-06-11 19:13:20 +01:00
2022-06-12 14:03:44 +01:00
networks = {
"80-container-host0" = mkMerge [
(networkdAssignment "host0" assignments.internal)
2022-06-11 19:13:20 +01:00
{
2022-06-12 14:03:44 +01:00
networkConfig.DNSDefaultRoute = false;
2022-06-11 19:13:20 +01:00
}
];
2022-06-12 14:03:44 +01:00
"90-vpn" = with wg; {
matchConfig.Name = "vpn";
2023-07-30 15:12:45 +01:00
address = [ "10.182.97.37/32" "fd7d:76ee:e68f:a993:735d:ef5e:6907:b122/128" ];
dns = [ "10.128.0.1" "fd7d:76ee:e68f:a993::1" ];
2022-06-12 14:03:44 +01:00
routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
{
Family = "both";
SuppressPrefixLength = 0;
Table = "main";
Priority = 100;
}
{
2023-11-02 13:41:50 +00:00
From = prefixes.all.v4;
2022-06-12 14:03:44 +01:00
Table = "main";
Priority = 100;
}
{
2023-11-02 13:41:50 +00:00
To = prefixes.all.v4;
2022-06-12 14:03:44 +01:00
Table = "main";
Priority = 100;
}
{
2023-11-02 13:41:50 +00:00
From = prefixes.all.v6;
2022-06-12 14:03:44 +01:00
Table = "main";
Priority = 100;
}
{
2023-11-02 13:41:50 +00:00
To = prefixes.all.v6;
2022-06-12 14:03:44 +01:00
Table = "main";
Priority = 100;
}
{
Family = "both";
InvertRule = true;
FirewallMark = fwMark;
Table = routeTable;
Priority = 110;
}
];
};
2022-06-11 19:13:20 +01:00
};
};
};
2022-06-12 14:03:44 +01:00
}
(mkIf config.my.build.isDevVM {
virtualisation = {
forwardPorts = [
# Transmission
{ from = "host"; host.port = 9091; guest.port = 9091; }
# Jackett
{ from = "host"; host.port = 9117; guest.port = 9117; }
# Radarr
{ from = "host"; host.port = 7878; guest.port = 7878; }
# Sonarr
{ from = "host"; host.port = 8989; guest.port = 8989; }
# Jellyfin
{ from = "host"; host.port = 8096; guest.port = 8096; }
];
};
})
];
2022-06-11 19:13:20 +01:00
}