From 9e2d1213b8aa0ea3d7b4dcd6d21a87d26bfca679 Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 17 Nov 2022 12:58:43 +0100 Subject: l yellow.r: rotate endpoint, restart after timeout --- lass/1systems/yellow/config.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'lass/1systems/yellow/config.nix') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index 554882bf3..309be4ec8 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -164,7 +164,7 @@ with import ; client dev tun proto udp - remote 196.240.57.43 1194 + remote 194.110.84.106 1194 resolv-retry infinite remote-random nobind @@ -174,7 +174,7 @@ with import ; persist-key persist-tun ping 15 - ping-restart 0 + ping-restart 15 ping-timer-rem reneg-sec 0 comp-lzo no -- cgit v1.2.3 From 417439de5c5a7e455f977a50276821bbfa3fa65b Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 17 Nov 2022 12:59:24 +0100 Subject: l yellow.r: use magnetico --- lass/1systems/yellow/config.nix | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'lass/1systems/yellow/config.nix') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index 309be4ec8..365ffdba5 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -154,6 +154,7 @@ with import ; tables.filter.INPUT.rules = [ { predicate = "-p tcp --dport 80"; target = "ACCEPT"; } # nginx web dir { predicate = "-p tcp --dport 9091"; target = "ACCEPT"; } # transmission-web + { predicate = "-p tcp --dport 9092"; target = "ACCEPT"; } # magnetico webinterface { predicate = "-p tcp --dport 51413"; target = "ACCEPT"; } # transmission-traffic { predicate = "-p udp --dport 51413"; target = "ACCEPT"; } # transmission-traffic { predicate = "-p tcp --dport 8096"; target = "ACCEPT"; } # jellyfin @@ -271,4 +272,10 @@ with import ; enable = true; group = "download"; }; + + services.magnetico = { + enable = true; + web.address = "0.0.0.0"; + web.port = 9092; + }; } -- cgit v1.2.3 From 3d87ba04777bd92fac8894af385ab5120c081408 Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 17 Nov 2022 12:59:44 +0100 Subject: l yellow.r: inotifyTools -> inotify-tools --- lass/1systems/yellow/config.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lass/1systems/yellow/config.nix') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index 365ffdba5..f5071c4b7 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -251,7 +251,7 @@ with import ; path = [ pkgs.coreutils pkgs.findutils - pkgs.inotifyTools + pkgs.inotify-tools ]; serviceConfig = { Restart = "always"; -- cgit v1.2.3 From 85c76178209c506149b17c01218b89cc34a78966 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 11 Dec 2022 19:07:58 +0100 Subject: l yellow.r: allow traffic only through vpn --- lass/1systems/yellow/config.nix | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) (limited to 'lass/1systems/yellow/config.nix') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index f5071c4b7..519665a3d 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -1,6 +1,6 @@ -with import ; -{ config, lib, pkgs, ... }: -{ +{ config, lib, pkgs, ... }: let + vpnIp = "85.202.81.161"; +in { imports = [ @@ -11,6 +11,8 @@ with import ; users.groups.download.members = [ "transmission" ]; + networking.useHostResolvConf = false; + networking.useNetworkd = true; systemd.services.transmission.bindsTo = [ "openvpn-nordvpn.service" ]; systemd.services.transmission.after = [ "openvpn-nordvpn.service" ]; services.transmission = { @@ -159,13 +161,22 @@ with import ; { predicate = "-p udp --dport 51413"; target = "ACCEPT"; } # transmission-traffic { predicate = "-p tcp --dport 8096"; target = "ACCEPT"; } # jellyfin ]; + tables.filter.OUTPUT = { + policy = "DROP"; + rules = [ + { v6 = false; predicate = "-d ${vpnIp}/32"; target = "ACCEPT"; } + { predicate = "-o tun0"; target = "ACCEPT"; } + { predicate = "-o retiolum"; target = "ACCEPT"; } + { v6 = false; predicate = "-o eth0 -d 10.233.0.0/24"; target = "ACCEPT"; } + ]; + }; }; services.openvpn.servers.nordvpn.config = '' client dev tun proto udp - remote 194.110.84.106 1194 + remote ${vpnIp} 1194 resolv-retry infinite remote-random nobind -- cgit v1.2.3 From 03ec5460b2bd2c74fdcab023d114f9997b71b15c Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 11 Dec 2022 20:08:03 +0100 Subject: l yellow.r: allow internal traffic & dns --- lass/1systems/yellow/config.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'lass/1systems/yellow/config.nix') diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index 519665a3d..c8077e5ea 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -167,7 +167,9 @@ in { { v6 = false; predicate = "-d ${vpnIp}/32"; target = "ACCEPT"; } { predicate = "-o tun0"; target = "ACCEPT"; } { predicate = "-o retiolum"; target = "ACCEPT"; } - { v6 = false; predicate = "-o eth0 -d 10.233.0.0/24"; target = "ACCEPT"; } + { v6 = false; predicate = "-d 1.1.1.1/32"; target = "ACCEPT"; } + { v6 = false; predicate = "-d 1.0.0.1/32"; target = "ACCEPT"; } + { v6 = false; predicate = "-o eth0 -d 10.233.2.0/24"; target = "ACCEPT"; } ]; }; }; -- cgit v1.2.3