From 4c2d824402c89639b6347fd7904fb296b060890e Mon Sep 17 00:00:00 2001
From: Tim Keller <tjk@tjkeller.xyz>
Date: Fri, 30 Oct 2026 19:16:25 -0500
Subject: separate openvpn from transmission to its own vpn-router container

---
 hosts/poweredge/transmission.nix | 89 +++++++++-------------------------------
 1 file changed, 19 insertions(+), 70 deletions(-)

(limited to 'hosts/poweredge/transmission.nix')

diff --git a/hosts/poweredge/transmission.nix b/hosts/poweredge/transmission.nix
index f221f77..047a3ab 100644
--- a/hosts/poweredge/transmission.nix
+++ b/hosts/poweredge/transmission.nix
@@ -1,8 +1,4 @@
-{ config, pkgs, ... }: {
-	# Secrets
-	sops.secrets.transmission-ovpn-config = { sopsFile = ./resources/secrets/transmission.yaml; key = "ovpn-config"; };
-	sops.secrets.transmission-ovpn-auth   = { sopsFile = ./resources/secrets/transmission.yaml; key = "ovpn-auth"; };
-
+{
 	# Container
 	containers.transmission = let
 		home = "/var/lib/transmission";
@@ -11,47 +7,40 @@
 	in {
 		autoStart = true;
 		privateNetwork = true;
-		enableTun = true;  # OpenVPN requires
 		hostBridge = "br-lan0";
-		localMacAddress = "02:00:00:00:00:07";
+		localMacAddress = "02:00:00:00:01:47";
 
 		# Download dirs
 		bindMounts = {
 			"${download-dir}" = {
-				hostPath = "/media/ingens/media/.complete";
+				hostPath = "/media/ingens/media/dls/transmission/complete";
 				isReadOnly = false;
 			};
 			"${incomplete-dir}" = {
-				hostPath = "/media/ingens/media/.incomplete";
+				hostPath = "/media/ingens/media/dls/transmission/incomplete";
 				isReadOnly = false;
 			};
-			"${home}/media" = {
+			"/media/ingens/media" = {
 				hostPath = "/media/ingens/media";
 				isReadOnly = false;
 			};
 		};
 
-		# Bind secrets
-		bindMounts."/run/secrets/ovpn-config.ovpn" = {
-			hostPath = config.sops.secrets.transmission-ovpn-config.path;
-			isReadOnly = true;
-		};
-		bindMounts."/run/secrets/ovpn-auth" = {
-			hostPath = config.sops.secrets.transmission-ovpn-auth.path;
-			isReadOnly = true;
-		};
-
-		config = { lib, config, ... }: {
+		config = { lib, ... }: {
 			# Network
-			networking.enableIPv6 = false;  # Prevent ip leaks
-			networking.interfaces.eth0.useDHCP = true;
-			networking.firewall.interfaces = {
-				eth0.allowedTCPPorts = [ 80 ];  # RPC interface
-				# Torrent ports
-				tun0 = {
-					allowedTCPPorts = [ 51413 ];
-					allowedUDPPorts = [ 51413 ];
-				};
+			networking = {
+				enableIPv6 = false;  # Prevent ip leaks
+				firewall.allowedTCPPorts = [ 80 51413 ];  # RPC interface + transmission tcp
+				firewall.allowedUDPPorts = [ 51413 ];  # transmission udp
+				# Override dhcp server settings for default route and dns servers with static settings
+				interfaces.eth0.useDHCP = true;
+				dhcpcd.extraConfig = ''
+					interface eth0
+					static routers=192.168.1.9
+					static domain_name_servers=9.9.9.9 1.1.1.1
+				'';
+				#defaultGateway = "192.168.1.9";  # Doesn't work, see above
+				#nameservers = [ "9.9.9.9" "1.1.1.1" ];  # Does work, above prevents using dhcp default nameserver
 			};
 
 			# Transmission
@@ -66,9 +55,6 @@
 				};
 			};
 
-			# Allow transmission to write to bound mounts
-			users.users.transmission.extraGroups = [ "root" ];
-
 			# TODO remove (#258793)
 			systemd.services.transmission.serviceConfig = {
 				RootDirectoryStartOnly = lib.mkForce null;
@@ -83,43 +69,6 @@
 				'';
 			};
 
-			# OpenVPN
-			services.openvpn.servers.main = {
-				config = ''
-					config /run/secrets/ovpn-config.ovpn
-					auth-user-pass /run/secrets/ovpn-auth
-				'';
-				autoStart = true;
-				updateResolvConf = true;
-			};
-
-			# VPN "killswitch"
-			networking.firewall.extraCommands = ''
-				# Get domain name host and port from ovpn config
-				SERVER_HOST=$(${pkgs.gawk}/bin/awk '/^remote /{print $2;exit}' /run/secrets/ovpn-config.ovpn)
-				SERVER_PORT=$(${pkgs.gawk}/bin/awk '/^remote /{print $3;exit}' /run/secrets/ovpn-config.ovpn)
-				# Resolve server ip from host
-				while [ -z "$SERVER_IP" ]; do
-					sleep 3
-					SERVER_IP=$(${pkgs.getent}/bin/getent hosts "$SERVER_HOST" 2>/dev/null | ${pkgs.gawk}/bin/awk '{print $1}')
-					echo "SERVER_IP: $SERVER_IP"
-				done
-
-				# Only allow out traffic from tun0
-				${pkgs.iptables}/bin/iptables -P OUTPUT DROP
-				${pkgs.iptables}/bin/iptables -A OUTPUT -o lo -j ACCEPT
-				${pkgs.iptables}/bin/iptables -A OUTPUT -o tun0 -j ACCEPT
-				${pkgs.iptables}/bin/iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT  # Exception: allow established connections
-				${pkgs.iptables}/bin/iptables -A OUTPUT -p udp -d "$SERVER_IP" --dport "$SERVER_PORT" -j ACCEPT
-
-				# Get dns ip from resolv.conf
-				DNS_IP=$(${pkgs.gawk}/bin/awk '/^nameserver /{print $2; exit}' /etc/resolv.conf)
-
-				# Allow dns
-				${pkgs.iptables}/bin/iptables -A OUTPUT -o eth0 -p udp -d "$DNS_IP" --dport 53 -j ACCEPT
-				${pkgs.iptables}/bin/iptables -A OUTPUT -o eth0 -p tcp -d "$DNS_IP" --dport 53 -j ACCEPT
-			'';
-
 			system.stateVersion = "26.05";
 		};
 	};
-- 
cgit v1.3.1