nixos/kelder: Add acquisition

nixos/boxes/kelder/containers/acquisition/default.nix

@@ -0,0 +1,105 @@
+{ lib, ... }: {
+  nixos.systems.kelder-acquisition = {
+    system = "x86_64-linux";
+    nixpkgs = "mine";
+
+    assignments = {
+      internal = {
+        name = "acquisition-ctr";
+        domain = lib.my.kelder.domain;
+        ipv4.address = "${lib.my.kelder.start.ctrs.v4}2";
+      };
+    };
+
+    configuration = { lib, pkgs, config, ... }:
+    let
+      inherit (lib);
+    in
+    {
+      imports = [ ./networking.nix ];
+
+      config = {
+        # Hardware acceleration for Jellyfin
+        hardware.opengl = {
+          enable = true;
+          extraPackages = with pkgs; [
+            vaapiIntel
+            intel-ocl
+          ];
+        };
+
+        my = {
+          deploy.enable = false;
+          server.enable = true;
+          user.config.name = "kontent";
+
+          secrets = {
+            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILSJ8d0prcSvyYi0UasnxMk/HGF5lWZz/t/VFYgQuFwO";
+          };
+        };
+
+        users = {
+          groups.media.gid = lib.my.kelder.groups.media;
+          users = {
+            "${config.my.user.config.name}".extraGroups = [ "media" ];
+
+            transmission.extraGroups = [ "media" ];
+            radarr.extraGroups = [ "media" ];
+            sonarr.extraGroups = [ "media" ];
+            jellyfin.extraGroups = [ "render" ];
+          };
+        };
+
+        environment.systemPackages = with pkgs; [
+          libva-utils
+          clinfo
+          jellyfin-ffmpeg
+        ];
+
+        systemd = {
+          services = {
+            jackett.bindsTo = [ "systemd-networkd-wait-online@vpn.service" ];
+            transmission.bindsTo = [ "systemd-networkd-wait-online@vpn.service" ];
+
+            radarr.serviceConfig.UMask = "0002";
+            sonarr.serviceConfig.UMask = "0002";
+          };
+        };
+
+        services = {
+          transmission = {
+            enable = true;
+            downloadDirPermissions = null;
+            performanceNetParameters = true;
+            settings = {
+              download-dir = "/mnt/media/downloads/torrents";
+              incomplete-dir-enabled = true;
+              incomplete-dir = "/mnt/media/downloads/torrents/.incomplete";
+              umask = 002;
+
+              utp-enabled = true;
+              port-forwarding-enabled = false;
+
+              speed-limit-down = 20480;
+              speed-limit-down-enabled = true;
+              speed-limit-up = 1024;
+              speed-limit-up-enabled = true;
+              ratio-limit = 2.0;
+              ratio-limit-enabled = true;
+
+              rpc-bind-address = "::";
+              rpc-whitelist-enabled = false;
+              rpc-host-whitelist-enabled = false;
+            };
+          };
+
+          jackett.enable = true;
+          radarr.enable = true;
+          sonarr.enable = true;
+
+          jellyfin.enable = true;
+        };
+      };
+    };
+  };
+}

nixos/boxes/kelder/containers/acquisition/networking.nix

@@ -0,0 +1,137 @@
+{ lib, pkgs, config, assignments, ... }:
+let
+  inherit (lib) mkMerge mkIf;
+  inherit (lib.my) networkdAssignment;
+
+  wg = {
+    keyFile = "kelder/acquisition/mullvad-privkey";
+    fwMark = 42;
+    routeTable = 51820;
+  };
+
+  # Forwarded in Mullvad config
+  transmissionPeerPort = 56630;
+in
+{
+  config = mkMerge [
+    {
+      my = {
+        secrets = {
+          files."${wg.keyFile}" = {
+            group = "systemd-network";
+            mode = "440";
+          };
+        };
+
+        firewall = {
+          extraRules = ''
+            # Make sure that VPN connections are dropped (except for the Transmission port)
+            table inet filter {
+              chain tcp-ext {
+                tcp dport ${toString transmissionPeerPort} accept
+                iifname vpn return
+
+                tcp dport { 9091, 9117, 7878, 8989, 8096 } accept
+                return
+              }
+              chain input {
+                tcp flags & (fin|syn|rst|ack) == syn ct state new jump tcp-ext
+              }
+            }
+          '';
+        };
+      };
+
+      environment.systemPackages = with pkgs; [
+        wireguard-tools
+      ];
+
+      services = {
+        transmission.settings.peer-port = transmissionPeerPort;
+      };
+
+      systemd = {
+        network = {
+          netdevs."30-vpn" = with wg; {
+            netdevConfig = {
+              Name = "vpn";
+              Kind = "wireguard";
+            };
+            wireguardConfig = {
+              PrivateKeyFile = config.age.secrets."${keyFile}".path;
+              FirewallMark = fwMark;
+              RouteTable = routeTable;
+            };
+            wireguardPeers = [
+              {
+                # mlvd-ie-dub-wg-101
+                wireguardPeerConfig = {
+                  Endpoint = "146.70.189.2:51820";
+                  PublicKey = "lHrukA9+vn7Jjzx2Nb/1NQ0WiaiKppEqVxrGT5X1RFQ=";
+                  AllowedIPs = [ "0.0.0.0/0" "::/0" ];
+                };
+              }
+            ];
+          };
+
+          networks = {
+            "80-container-host0" = mkMerge [
+              (networkdAssignment "host0" assignments.internal)
+              {
+                networkConfig.DNSDefaultRoute = false;
+              }
+            ];
+            "90-vpn" = with wg; {
+              matchConfig.Name = "vpn";
+              address = [ "10.66.242.99/32" "fc00:bbbb:bbbb:bb01::3:f262/128" ];
+              dns = [ "10.64.0.1" ];
+              routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
+                {
+                  Family = "both";
+                  SuppressPrefixLength = 0;
+                  Table = "main";
+                  Priority = 100;
+                }
+
+                {
+                  From = lib.my.kelder.prefixes.all.v4;
+                  Table = "main";
+                  Priority = 100;
+                }
+                {
+                  To = lib.my.kelder.prefixes.all.v4;
+                  Table = "main";
+                  Priority = 100;
+                }
+
+                {
+                  Family = "both";
+                  InvertRule = true;
+                  FirewallMark = fwMark;
+                  Table = routeTable;
+                  Priority = 110;
+                }
+              ];
+            };
+          };
+        };
+      };
+    }
+    (mkIf config.my.build.isDevVM {
+      virtualisation = {
+        forwardPorts = [
+          # Transmission
+          { from = "host"; host.port = 9091; guest.port = 9091; }
+          # Jackett
+          { from = "host"; host.port = 9117; guest.port = 9117; }
+          # Radarr
+          { from = "host"; host.port = 7878; guest.port = 7878; }
+          # Sonarr
+          { from = "host"; host.port = 8989; guest.port = 8989; }
+          # Jellyfin
+          { from = "host"; host.port = 8096; guest.port = 8096; }
+        ];
+      };
+    })
+  ];
+}

nixos/boxes/kelder/containers/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./acquisition
+  ];
+}