upRootNutrition/dotfiles
upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-12-06 21:17:14 -06:00
Code Issues Projects 1 Releases Packages Wiki Activity Actions

feat: tweaking torrent vm

Browse source
This commit is contained in:
Nick 2025-11-27 14:49:31 -06:00
parent cb11da0008
commit 7107fb77a1
3 changed files with 171 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

134
modules/nixos/guests/torrent/default.nix
View file

@ -125,9 +125,109 @@ in
"d ${serviceCfg.varPaths.path0}/downloads 755 ${serviceCfg.name} ${serviceCfg.name} -"
];
services.qbittorrent = {
after = [ "wg-quick-wg0.service" ];
requires = [ "wg-quick-wg0.service" ];
services = {
qbittorrent = {
after = [ "wg-quick-wg0.service" ];
requires = [ "wg-quick-wg0.service" ];
};
natpmp-portforward = {
description = "NAT-PMP Port Forwarding for VPN";
after = [
"wg-quick-wg0.service"
"qbittorrent.service"
];
requires = [
"wg-quick-wg0.service"
"qbittorrent.service"
];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
Restart = "always";
RestartSec = "10s";
};
script = ''
PASSWORD=$(cat /run/secrets/qbittorrent-pass)
# Wait for qBittorrent to be ready
echo "Waiting for qBittorrent to start..."
sleep 10
# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
while true; do
echo "Requesting port forwarding from VPN..."
# Get the forwarded port for UDP
UDP_OUTPUT=$(${pkgs.libnatpmp}/bin/natpmpc -a 1 0 udp 60 -g 10.2.0.1 2>&1)
UDP_PORT=$(echo "$UDP_OUTPUT" | ${pkgs.gnugrep}/bin/grep "Mapped public port" | ${pkgs.gawk}/bin/awk '{print $4}' | head -1)
# Get the forwarded port for TCP
TCP_OUTPUT=$(${pkgs.libnatpmp}/bin/natpmpc -a 1 0 tcp 60 -g 10.2.0.1 2>&1)
TCP_PORT=$(echo "$TCP_OUTPUT" | ${pkgs.gnugrep}/bin/grep "Mapped public port" | ${pkgs.gawk}/bin/awk '{print $4}' | head -1)
if [ -n "$UDP_PORT" ] && [ -n "$TCP_PORT" ]; then
echo "Port forwarding successful: UDP=$UDP_PORT, TCP=$TCP_PORT"
# Clear old PREROUTING rules to avoid duplicates
${pkgs.iptables}/bin/iptables -t nat -D PREROUTING -i enp0s5 -p tcp -j DNAT --to-destination 10.2.0.2 2>/dev/null || true
${pkgs.iptables}/bin/iptables -t nat -D PREROUTING -i enp0s5 -p udp -j DNAT --to-destination 10.2.0.2 2>/dev/null || true
# Forward traffic from enp0s5 (VM's main interface) to wg0 (WireGuard interface)
${pkgs.iptables}/bin/iptables -t nat -A PREROUTING -i enp0s5 -p tcp --dport "$TCP_PORT" -j DNAT --to-destination 10.2.0.2:$TCP_PORT
${pkgs.iptables}/bin/iptables -t nat -A PREROUTING -i enp0s5 -p udp --dport "$UDP_PORT" -j DNAT --to-destination 10.2.0.2:$UDP_PORT
# Enable masquerading for responses
${pkgs.iptables}/bin/iptables -t nat -C POSTROUTING -o wg0 -j MASQUERADE 2>/dev/null || \
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
# Allow forwarding between interfaces
${pkgs.iptables}/bin/iptables -C FORWARD -i enp0s5 -o wg0 -j ACCEPT 2>/dev/null || \
${pkgs.iptables}/bin/iptables -A FORWARD -i enp0s5 -o wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -C FORWARD -i wg0 -o enp0s5 -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || \
${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -o enp0s5 -m state --state RELATED,ESTABLISHED -j ACCEPT
echo "Firewall forwarding rules updated for ports: UDP=$UDP_PORT, TCP=$TCP_PORT"
# Open the ports in the firewall dynamically (INPUT chain)
${pkgs.iptables}/bin/iptables -C INPUT -p udp --dport "$UDP_PORT" -j ACCEPT 2>/dev/null || \
${pkgs.iptables}/bin/iptables -A INPUT -p udp --dport "$UDP_PORT" -j ACCEPT
${pkgs.iptables}/bin/iptables -C INPUT -p tcp --dport "$TCP_PORT" -j ACCEPT 2>/dev/null || \
${pkgs.iptables}/bin/iptables -A INPUT -p tcp --dport "$TCP_PORT" -j ACCEPT
echo "Firewall INPUT rules updated for ports: UDP=$UDP_PORT, TCP=$TCP_PORT"
# Update qBittorrent listening port via API
echo "Logging into qBittorrent API..."
COOKIE=$(${pkgs.curl}/bin/curl -s -i \
--header "Referer: http://localhost:${toString serviceCfg.ports.port0}" \
--data "username=user&password=$PASSWORD" \
"http://localhost:${toString serviceCfg.ports.port0}/api/v2/auth/login" | \
${pkgs.gnugrep}/bin/grep -i "set-cookie" | ${pkgs.gawk}/bin/awk -F'SID=|;' '{print $2}')
if [ -n "$COOKIE" ]; then
echo "Authentication successful, updating port..."
${pkgs.curl}/bin/curl -s \
--cookie "SID=$COOKIE" \
--data "json={\"listen_port\":$UDP_PORT}" \
"http://localhost:${toString serviceCfg.ports.port0}/api/v2/app/setPreferences"
echo "Updated qBittorrent listening port to $UDP_PORT"
else
echo "WARNING: Failed to authenticate with qBittorrent API"
fi
else
echo "ERROR: Failed to get forwarded ports"
echo "UDP output: $UDP_OUTPUT"
echo "TCP output: $TCP_OUTPUT"
exit 1
fi
sleep 45
done
'';
};
};
};
@ -173,7 +273,7 @@ in
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/run/secrets/proton";
source = "/run/secrets/torrent";
tag = "host_secrets";
}
];
@ -181,9 +281,12 @@ in
environment.systemPackages = builtins.attrValues {
inherit (pkgs)
wireguard-tools
speedtest-go
bottom
gawk
iptables
libnatpmp
speedtest-go
wireguard-tools
;
};
};
@ -214,10 +317,15 @@ in
group = "caddy";
mode = "0400";
};
"proton/wireguard-pass" = {
"torrent/wireguard-pass" = {
owner = "root";
mode = "0400";
};
"torrent/qbittorrent-pass" = {
owner = "root";
mode = "0400";
};
};
security.acme.certs."${host}" = {
@ -240,4 +348,16 @@ in
"d /var/log/caddy 755 caddy caddy -"
];
};
networking.firewall = {
allowedTCPPorts = [
38834
torrentPort
];
allowedUDPPorts = [
38834
torrentPort
];
};
}