104 lines
3.6 KiB
Nix
104 lines
3.6 KiB
Nix
{
|
|
inputs,
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}: let
|
|
webUiPort = "8100";
|
|
namespace = "pvpn";
|
|
interface-name = "pvpn0";
|
|
dnsIP = "DNS = 10.2.0.1";
|
|
privateIP = "10.2.0.2/32";
|
|
port = 8112;
|
|
user = config.host.details.user;
|
|
group = "users";
|
|
in {
|
|
sops.secrets = lib.mkIf (inputs ? nix-secrets) {
|
|
wg-config = {
|
|
sopsFile = "${inputs.nix-secrets}/cirrostratus-protonvpn.conf";
|
|
format = "binary";
|
|
owner = config.host.details.user;
|
|
};
|
|
};
|
|
# Id really like to setup the wg network with systemd,
|
|
# but its not possible until systemd-networkd can manage network namespaces as well.
|
|
systemd.services."netns@" = {
|
|
description = "%I network namespace";
|
|
before = ["network.target"];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
ExecStart = "${pkgs.iproute2}/bin/ip netns add %I";
|
|
ExecStop = "${pkgs.iproute2}/bin/ip netns del %I";
|
|
};
|
|
};
|
|
environment.etc."netns/${namespace}/resolv.conf".text = "nameserver ${dnsIP}";
|
|
|
|
systemd.services.${namespace} = {
|
|
description = "${namespace} network interface";
|
|
bindsTo = ["netns@${namespace}.service"];
|
|
requires = ["network-online.target"];
|
|
after = ["netns@${namespace}.service"];
|
|
wantedBy = ["multi-user.target"];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
ExecStart = with pkgs;
|
|
writers.writeBash "wg-up" ''
|
|
set -e
|
|
${iproute2}/bin/ip link add ${interface-name} type wireguard
|
|
${iproute2}/bin/ip link set ${interface-name} netns ${namespace}
|
|
${iproute2}/bin/ip -n ${namespace} address add ${privateIP} dev ${interface-name}
|
|
${iproute2}/bin/ip netns exec ${namespace} \
|
|
${pkgs.wireguard-tools}/bin/wg setconf ${interface-name} ${config.sops.secrets.wg-config.path}
|
|
${iproute2}/bin/ip -n ${namespace} link set ${interface-name} up
|
|
${iproute2}/bin/ip -n ${namespace} link set lo up
|
|
${iproute2}/bin/ip -n ${namespace} route add default dev ${interface-name}
|
|
'';
|
|
ExecStop = with pkgs;
|
|
writers.writeBash "wg-down" ''
|
|
set -e
|
|
${iproute2}/bin/ip -n ${namespace} route del default dev ${interface-name}
|
|
${iproute2}/bin/ip -n ${namespace} link del ${interface-name}
|
|
'';
|
|
};
|
|
};
|
|
# now we get to the deluge stuff.
|
|
services.deluge = {
|
|
enable = true;
|
|
user = user;
|
|
group = group;
|
|
web = {
|
|
enable = true;
|
|
port = port;
|
|
};
|
|
};
|
|
# binding deluged to network namespace
|
|
systemd.services.deluged.bindsTo = ["netns@${namespace}.service"];
|
|
systemd.services.deluged.requires = ["network-online.target" "${namespace}.service"];
|
|
systemd.services.deluged.serviceConfig.NetworkNamespacePath = ["/var/run/netns/${namespace}"];
|
|
|
|
# allowing delugeweb to access deluged in network namespace, a socket is necesarry
|
|
systemd.sockets."proxy-to-deluged" = {
|
|
enable = true;
|
|
description = "Socket for Proxy to Deluge Daemon";
|
|
listenStreams = ["58846"];
|
|
wantedBy = ["sockets.target"];
|
|
};
|
|
|
|
# creating proxy service on socket, which forwards the same port from the root namespace to the isolated namespace
|
|
systemd.services."proxy-to-deluged" = {
|
|
enable = true;
|
|
description = "Proxy to Deluge Daemon in Network Namespace";
|
|
requires = ["deluged.service" "proxy-to-deluged.socket"];
|
|
after = ["deluged.service" "proxy-to-deluged.socket"];
|
|
unitConfig = {JoinsNamespaceOf = "deluged.service";};
|
|
serviceConfig = {
|
|
User = user;
|
|
Group = group;
|
|
ExecStart = "${pkgs.systemd}/lib/systemd/systemd-socket-proxyd --exit-idle-time=5min 127.0.0.1:58846";
|
|
PrivateNetwork = "yes";
|
|
};
|
|
};
|
|
}
|