nixos/jackflix: Improve firewall

nixos/boxes/colony/vms/shill/containers/jackflix/default.nix

@@ -17,13 +17,12 @@
 
     configuration = { lib, pkgs, config, ... }:
     let
-      inherit (lib) mkMerge mkIf;
+      inherit (lib);
     in
     {
       imports = [ ./networking.nix ];
 
-      config = mkMerge [
+      config = {
-        {
         my = {
           deploy.enable = false;
           server.enable = true;
@@ -53,8 +52,6 @@
         services = {
           transmission = {
             enable = true;
-              openPeerPorts = true;
-              openRPCPort = true;
             downloadDirPermissions = null;
             performanceNetParameters = true;
             settings = {
@@ -63,7 +60,6 @@
               incomplete-dir = "/mnt/media/downloads/torrents/.incomplete";
               umask = 002;
 
-                peer-port = 55471;
               utp-enabled = true;
               port-forwarding-enabled = false;
 
@@ -76,26 +72,10 @@
             };
           };
 
-            jackett = {
+          jackett.enable = true;
-              enable = true;
+          radarr.enable = true;
-              openFirewall = true;
-            };
-            radarr = {
-              enable = true;
-              openFirewall = true;
         };
       };
-        }
-        (mkIf config.my.build.isDevVM {
-          virtualisation = {
-            forwardPorts = [
-              { from = "host"; host.port = 9117; guest.port = 9117; }
-              { from = "host"; host.port = 7878; guest.port = 7878; }
-              { from = "host"; host.port = 8989; guest.port = 8989; }
-            ];
-          };
-        })
-      ];
     };
   };
 }

nixos/boxes/colony/vms/shill/containers/jackflix/networking.nix

@@ -1,6 +1,6 @@
 { lib, pkgs, config, assignments, ... }:
 let
-  inherit (lib) mkMerge;
+  inherit (lib) mkMerge mkIf;
   inherit (lib.my) networkdAssignment;
 
   wg = {
@@ -8,9 +8,13 @@ let
     fwMark = 42;
     routeTable = 51820;
   };
+
+  # Forwarded in Mullvad config
+  transmissionPeerPort = 55471;
 in
 {
-  config = {
+  config = mkMerge [
+    {
       my = {
         secrets = {
           files."${wg.keyFile}" = {
@@ -20,7 +24,21 @@ in
         };
 
         firewall = {
-        tcp.allowed = [ ];
+          extraRules = ''
+            # Make sure that VPN connections are dropped (except for the Transmission port)
+            table inet filter {
+              chain tcp-ext {
+                tcp dport ${toString transmissionPeerPort} accept
+                iifname vpn return
+
+                tcp dport { 9091, 9117, 7878, 8989, 8096 } accept
+                return
+              }
+              chain input {
+                tcp flags & (fin|syn|rst|ack) == syn ct state new jump tcp-ext
+              }
+            }
+          '';
         };
       };
 
@@ -28,6 +46,10 @@ in
         wireguard-tools
       ];
 
+      services = {
+        transmission.settings.peer-port = transmissionPeerPort;
+      };
+
       systemd = {
         network = {
           netdevs."30-vpn" = with wg; {
@@ -105,5 +127,22 @@ in
           };
         };
       };
+    }
+    (mkIf config.my.build.isDevVM {
+      virtualisation = {
+        forwardPorts = [
+          # Transmission
+          { from = "host"; host.port = 9091; guest.port = 9091; }
+          # Jackett
+          { from = "host"; host.port = 9117; guest.port = 9117; }
+          # Radarr
+          { from = "host"; host.port = 7878; guest.port = 7878; }
+          # Sonarr
+          { from = "host"; host.port = 8989; guest.port = 8989; }
+          # Jellyfin
+          { from = "host"; host.port = 8096; guest.port = 8096; }
+        ];
       };
+    })
+  ];
 }