dev/nixfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

nixos/jackflix: Improve firewall

Browse Source
This commit is contained in:
Jack O'Sullivan 2022-06-12 14:03:44 +01:00
parent 46c9aa655a
commit 7e5c051bfc
2 changed files with 167 additions and 148 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

104
nixos/boxes/colony/vms/shill/containers/jackflix/default.nix
View File

@ -17,85 +17,65 @@
configuration = { lib, pkgs, config, ... }: configuration = { lib, pkgs, config, ... }:
let let
inherit (lib) mkMerge mkIf; inherit (lib);
in in
{ {
imports = [ ./networking.nix ]; imports = [ ./networking.nix ];
config = mkMerge [ config = {
{ my = {
my = { deploy.enable = false;
deploy.enable = false; server.enable = true;
server.enable = true;
secrets = { secrets = {
key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKzzAqa4821NlYfALYOlvR7YlOgxNuulTWo9Vm5L1mNU"; key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKzzAqa4821NlYfALYOlvR7YlOgxNuulTWo9Vm5L1mNU";
};
}; };
};
users = {
groups.media.gid = 2000;
users = { users = {
groups.media.gid = 2000; transmission.extraGroups = [ "media" ];
users = { radarr.extraGroups = [ "media" ];
transmission.extraGroups = [ "media" ];
radarr.extraGroups = [ "media" ];
};
};
systemd = {
services = {
jackett.bindsTo = [ "systemd-networkd-wait-online@vpn.service" ];
transmission.bindsTo = [ "systemd-networkd-wait-online@vpn.service" ];
radarr.serviceConfig.UMask = "0002";
};
}; };
};
systemd = {
services = { services = {
transmission = { jackett.bindsTo = [ "systemd-networkd-wait-online@vpn.service" ];
enable = true; transmission.bindsTo = [ "systemd-networkd-wait-online@vpn.service" ];
openPeerPorts = true;
openRPCPort = true;
downloadDirPermissions = null;
performanceNetParameters = true;
settings = {
download-dir = "/mnt/media/downloads/torrents";
incomplete-dir-enabled = true;
incomplete-dir = "/mnt/media/downloads/torrents/.incomplete";
umask = 002;
peer-port = 55471; radarr.serviceConfig.UMask = "0002";
utp-enabled = true; };
port-forwarding-enabled = false; };
ratio-limit = 2.0; services = {
ratio-limit-enabled = true; transmission = {
enable = true;
downloadDirPermissions = null;
performanceNetParameters = true;
settings = {
download-dir = "/mnt/media/downloads/torrents";
incomplete-dir-enabled = true;
incomplete-dir = "/mnt/media/downloads/torrents/.incomplete";
umask = 002;
rpc-bind-address = "::"; utp-enabled = true;
rpc-whitelist-enabled = false; port-forwarding-enabled = false;
rpc-host-whitelist-enabled = false;
};
};
jackett = { ratio-limit = 2.0;
enable = true; ratio-limit-enabled = true;
openFirewall = true;
}; rpc-bind-address = "::";
radarr = { rpc-whitelist-enabled = false;
enable = true; rpc-host-whitelist-enabled = false;
openFirewall = true;
}; };
}; };
}
(mkIf config.my.build.isDevVM { jackett.enable = true;
virtualisation = { radarr.enable = true;
forwardPorts = [ };
{ from = "host"; host.port = 9117; guest.port = 9117; } };
{ from = "host"; host.port = 7878; guest.port = 7878; }
{ from = "host"; host.port = 8989; guest.port = 8989; }
];
};
})
];
}; };
}; };
} }

211
nixos/boxes/colony/vms/shill/containers/jackflix/networking.nix
View File

@ -1,6 +1,6 @@
{ lib, pkgs, config, assignments, ... }: { lib, pkgs, config, assignments, ... }:
let let
inherit (lib) mkMerge; inherit (lib) mkMerge mkIf;
inherit (lib.my) networkdAssignment; inherit (lib.my) networkdAssignment;
wg = { wg = {
@ -8,102 +8,141 @@ let
fwMark = 42; fwMark = 42;
routeTable = 51820; routeTable = 51820;
}; };
# Forwarded in Mullvad config
transmissionPeerPort = 55471;
in in
{ {
config = { config = mkMerge [
my = { {
secrets = { my = {
files."${wg.keyFile}" = { secrets = {
group = "systemd-network"; files."${wg.keyFile}" = {
mode = "440"; group = "systemd-network";
mode = "440";
};
};
firewall = {
extraRules = ''
# Make sure that VPN connections are dropped (except for the Transmission port)
table inet filter {
chain tcp-ext {
tcp dport ${toString transmissionPeerPort} accept
iifname vpn return
tcp dport { 9091, 9117, 7878, 8989, 8096 } accept
return
}
chain input {
tcp flags & (fin|syn|rst|ack) == syn ct state new jump tcp-ext
}
}
'';
}; };
}; };
firewall = { environment.systemPackages = with pkgs; [
tcp.allowed = [ ]; wireguard-tools
];
services = {
transmission.settings.peer-port = transmissionPeerPort;
}; };
};
environment.systemPackages = with pkgs; [ systemd = {
wireguard-tools network = {
]; netdevs."30-vpn" = with wg; {
netdevConfig = {
systemd = { Name = "vpn";
network = { Kind = "wireguard";
netdevs."30-vpn" = with wg; { };
netdevConfig = { wireguardConfig = {
Name = "vpn"; PrivateKeyFile = config.age.secrets."${keyFile}".path;
Kind = "wireguard"; FirewallMark = fwMark;
}; RouteTable = routeTable;
wireguardConfig = { };
PrivateKeyFile = config.age.secrets."${keyFile}".path; wireguardPeers = [
FirewallMark = fwMark;
RouteTable = routeTable;
};
wireguardPeers = [
{
# mlvd-de32
wireguardPeerConfig = {
Endpoint = "146.70.107.194:51820";
PublicKey = "uKTC5oP/zfn6SSjayiXDDR9L82X0tGYJd5LVn5kzyCc=";
AllowedIPs = [ "0.0.0.0/0" "::/0" ];
};
}
];
};
networks = {
"80-container-host0" = mkMerge [
(networkdAssignment "host0" assignments.internal)
{
networkConfig.DNSDefaultRoute = false;
}
];
"90-vpn" = with wg; {
matchConfig.Name = "vpn";
address = [ "10.68.19.11/32" "fc00:bbbb:bbbb:bb01::5:130a/128" ];
dns = [ "10.64.0.1" ];
routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
{ {
Family = "both"; # mlvd-de32
SuppressPrefixLength = 0; wireguardPeerConfig = {
Table = "main"; Endpoint = "146.70.107.194:51820";
Priority = 100; PublicKey = "uKTC5oP/zfn6SSjayiXDDR9L82X0tGYJd5LVn5kzyCc=";
} AllowedIPs = [ "0.0.0.0/0" "::/0" ];
};
{
From = lib.my.colony.prefixes.all.v4;
Table = "main";
Priority = 100;
}
{
To = lib.my.colony.prefixes.all.v4;
Table = "main";
Priority = 100;
}
{
From = lib.my.colony.prefixes.all.v6;
Table = "main";
Priority = 100;
}
{
To = lib.my.colony.prefixes.all.v6;
Table = "main";
Priority = 100;
}
{
Family = "both";
InvertRule = true;
FirewallMark = fwMark;
Table = routeTable;
Priority = 110;
} }
]; ];
}; };
networks = {
"80-container-host0" = mkMerge [
(networkdAssignment "host0" assignments.internal)
{
networkConfig.DNSDefaultRoute = false;
}
];
"90-vpn" = with wg; {
matchConfig.Name = "vpn";
address = [ "10.68.19.11/32" "fc00:bbbb:bbbb:bb01::5:130a/128" ];
dns = [ "10.64.0.1" ];
routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
{
Family = "both";
SuppressPrefixLength = 0;
Table = "main";
Priority = 100;
}
{
From = lib.my.colony.prefixes.all.v4;
Table = "main";
Priority = 100;
}
{
To = lib.my.colony.prefixes.all.v4;
Table = "main";
Priority = 100;
}
{
From = lib.my.colony.prefixes.all.v6;
Table = "main";
Priority = 100;
}
{
To = lib.my.colony.prefixes.all.v6;
Table = "main";
Priority = 100;
}
{
Family = "both";
InvertRule = true;
FirewallMark = fwMark;
Table = routeTable;
Priority = 110;
}
];
};
};
}; };
}; };
}; }
}; (mkIf config.my.build.isDevVM {
virtualisation = {
forwardPorts = [
# Transmission
{ from = "host"; host.port = 9091; guest.port = 9091; }
# Jackett
{ from = "host"; host.port = 9117; guest.port = 9117; }
# Radarr
{ from = "host"; host.port = 7878; guest.port = 7878; }
# Sonarr
{ from = "host"; host.port = 8989; guest.port = 8989; }
# Jellyfin
{ from = "host"; host.port = 8096; guest.port = 8096; }
];
};
})
];
} }