ooks/ooknet
0
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

media-server: add vpn module

Browse source
This commit is contained in:
ooks-io 2024-11-27 22:26:55 +11:00
parent 54469932ca
commit 33e5d8fbea
3 changed files with 46 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
modules/nixos/base/secrets.nix
View file

@ -8,7 +8,7 @@
inherit (config.ooknet) host;
inherit (host) admin;
inherit (config.services) tailscale;
inherit (config.services) tailscale transmission;
in {
age.identityPaths = [
"/home/${admin.name}/.ssh/id_ed25519"
@ -36,5 +36,8 @@ in {
owner = "${admin.name}";
group = "users";
};
mullvad_wg = mkIf transmission.enable {
file = "${self}/secrets/mullvad_wg.age";
};
};
}

3
modules/nixos/server/services/media-server/default.nix
View file

@ -1,6 +1,7 @@
{
lib,
config,
inputs,
...
}: let
inherit (lib) mkIf elem;
@ -13,6 +14,8 @@ in {
./jellyfin.nix
./transmission.nix
./file-permissions.nix
./vpn.nix
inputs.vpn-confinement.nixosModules.default
];
# short cut for enabling all media-server modules

39
modules/nixos/server/services/media-server/vpn.nix Normal file
View file

@ -0,0 +1,39 @@
{
config,
lib,
...
}: let
inherit (lib) mkIf;
inherit (config.ooknet.server.media-server) ports transmission;
inherit (config.age) secrets;
in {
config = mkIf transmission.enable {
vpnNamespaces.wg = {
enable = true;
wireguardConfigFile = secrets.mullvad_wg.path;
accessibleFrom = [
"192.168.0.1/24"
"127.0.0.1"
"10.0.0.0/8"
];
openVPNPorts = [
# Transmission
{
port = ports.transmission.peer;
protocol = "both";
}
];
portMappings = [
# Transmission
{
from = ports.transmission.web;
to = ports.transmission.web;
}
];
};
systemd.services.transmission.vpnConfinement = {
enable = true;
vpnNamespace = "wg";
};
};
}