blob: 32b71622575008652fc6380703f5bb2665b68c68 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
|
{ config, inputs, lib, outputs, pkgs, ... }:
{
imports = [
common/core
];
home.file = {
"bin/games-fw" = {
executable = true;
text = ''
#!${pkgs.zsh}/bin/zsh
# load module to parse command line arguments
zmodload zsh/zutil
zparseopts -D -E -A opts -- d h l x
# enable XTRACE shell option for full debugging output of scripts
if (( ''${+opts[-x]} )); then
set -x
fi
if ! (( ''${+opts[-l]} )) && [[ -z "''${1}" ]] || (( ''${+opts[-h]} )); then
echo "usage: ''${0:t} [ -h ] [ -x ] { -d handle | -l | cidr }" >&2
echo '
-d delete a rule by handle; handle must be specified ( nft -a list ruleset )
-h this message
-l list games chain
-x enable shell debugging
cidr IPv4 host or CIDR network address
' >&2
exit 1
fi
function list_games_chain {
nft -a list ruleset | sed -ne '/\tchain games {/,/\t}$/p'
}
if (( ''${+opts[-d]} )); then
handle="''${1}"
rule=$(nft -a list ruleset | grep ' # handle '"''${handle}"'$')
if [[ -z "''${rule}" ]]; then
echo 'no matching handle found!' >&2
exit 1
else
nft delete rule inet nixos-fw games handle ''${handle}
list_games_chain
fi
elif (( ''${+opts[-l]} )); then
list_games_chain
else
cidr="''${1}"
nft insert rule inet nixos-fw games 'ip saddr '"''${cidr}"' counter accept'
list_games_chain
fi
exit 0
'';
};
"bin/knock".source = ../common/scripts/knock;
"bin/vpnctl" = {
executable = true;
text = ''
#!${pkgs.zsh}/bin/zsh
function status_vpn {
ip netns exec vpn su -c 'curl -m 10 -s https://bitgnome.net/ip/ | grep REMOTE_ADDR' nipsy
ip netns exec vpn su -c 'curl -m 10 -s https://www.cloudflarestatus.com | grep "Cloudflare Status"' nipsy
}
function start_vpn {
ip netns add vpn
ip link add veth.host type veth peer veth.vpn
ip link set dev veth.host up
ip link set veth.vpn netns vpn up
ip -n vpn address add 192.168.1.3/24 dev veth.vpn
ip route add 192.168.1.3/32 dev veth.host
ip link add wg1 type wireguard
ip link set wg1 netns vpn
ip -n vpn -4 address add $(grep ^#Address /run/secrets/wireguard/wg1_conf | cut -d= -f2 | cut -d, -f1 | xargs) dev wg1
ip netns exec vpn wg setconf wg1 /run/secrets/wireguard/wg1_conf
ip -n vpn link set wg1 up
ip -n vpn route add default dev wg1
ip netns exec vpn nft -f /etc/nftables-vpn.conf
}
function stop_vpn {
systemctl stop prowlarr.service qbittorrent.service
if ip netns | grep -q '^vpn '; then
ip netns del vpn
fi
if ip link show veth.host > /dev/null; then
ip link del veth.host
fi
}
if [[ -z "''${1}" || "''${1}" == "status" ]]; then
status_vpn
elif [[ "''${1}" == "restart" ]]; then
stop_vpn
sleep 2
start_vpn
systemctl restart prowlarr.service qbittorrent.service
elif [[ "''${1}" == "restart_firewall" ]]; then
ip netns exec vpn nft -f /etc/nftables-vpn.conf
elif [[ "''${1}" == "start" ]]; then
if [[ ! -f /run/netns/vpn ]]; then
start_vpn
else
echo 'VPN service already appears to be running' >&2
fi
elif [[ "''${1}" == "stop" ]]; then
stop_vpn
fi
exit 0
'';
};
};
nix.extraOptions = ''
!include /run/secrets/nix-access-token-github
'';
}
|
