server-configuration/services/auto-torrent.nix

{
  config,
  pkgs,
  ...
}: let
  lib = pkgs.lib;
  host = "10.0.0.${toString vm-index}";
  port = 8989;
  vm-index = 1;
  vm-mac = "02:00:00:00:00:02";
  vm-name = "auto-torrent";
in {
  microvm.autostart = [vm-name];

  users.extraUsers.microvm.extraGroups = [
    "jellyfin" # access to media folder
  ];

  system.activationScripts."make-${vm-name}-data-dir" = lib.stringAfter ["var"] ''
    mkdir -p /var/lib/${vm-name}
    chmod -R 777 /var/lib/${vm-name}
    chown -R microvm /var/lib/${vm-name}
    chmod -R 777 /media
  '';

  microvm.vms.${vm-name} = {
    config = {...}: {
      system.stateVersion = "25.05";
      microvm.interfaces = [
        {
          id = "vm${toString vm-index}";
          type = "tap";
          mac = vm-mac;
        }
      ];

      # 1gb of memory
      microvm.mem = 1024;

      microvm.shares = [
        {
          tag = "ro-store";
          source = "/nix/store";
          mountPoint = "/nix/.ro-store";
        }
        {
          tag = "data-dir";
          source = "/var/lib/${vm-name}";
          mountPoint = "/mnt";
          proto = "virtiofs";
        }
        {
          tag = "media-dir";
          source = "/media";
          mountPoint = "/media";
          proto = "virtiofs";
        }
      ];

      networking.useNetworkd = true;
      networking.usePredictableInterfaceNames = false;
      systemd.network.networks."10-eth" = {
        matchConfig.MACAddress = vm-mac;
        address = [
          "10.0.0.${toString vm-index}/32"
        ];
        routes = [
          # Host Route
          {
            Destination = "10.0.0.0/32";
            GatewayOnLink = true;
          }
          # Default route
          {
            Destination = "0.0.0.0/0";
            Gateway = "10.0.0.0";
            GatewayOnLink = true;
          }
        ];
        networkConfig = {
          DNS = [
            "9.9.9.9"
            "8.8.8.8"
            "8.8.4.4"
          ];
        };
      };

      networking.useDHCP = false;
      networking.nameservers = [
        "10.0.101.1"
        "8.8.8.8"
        "8.8.4.4"
      ];

      systemd.services."wireguard-kill-switch" = {
        description = "Wireguard Kill Switch";
        after = ["network-online.target"];
        wants = ["network-online.target"];
        wantedBy = ["multi-user.target"];

        serviceConfig = {
          type = "oneshot";
          ExecStart = pkgs.writeShellScript "wgconf.sh" ''
            # Stay a while and listen
            # ${pkgs.toybox}/bin/sleep 5
            # Route local traffic through wg0 except local traffic
            ${pkgs.iproute2}/bin/ip route add 10.0.0.0/32 dev eth0 && \
            ${pkgs.iproute2}/bin/ip route add 0.0.0.0/1 dev wg0
            # Block all traffic that isnt local or through the vpn
            ${pkgs.iptables}/bin/iptables -I OUTPUT ! -o wg0 -m mark ! --mark 42 -m addrtype ! --dst-type LOCAL ! -d 10.0.0.0/32 -j REJECT
          '';
          RemainAfterExit = "yes";
        };
      };

      networking.wireguard.enable = true;
      systemd.network = {
        netdevs."10-wg0" = {
          netdevConfig = {
            Kind = "wireguard";
            Name = "wg0";
            MTUBytes = "1300";
          };
          wireguardConfig = {
            PrivateKeyFile = "${./wireguard-secret}";
            FirewallMark = 42;
            ListenPort = 51820;
          };
          wireguardPeers = [
            {
              PublicKey = "0qSP0VxoIhEhRK+fAHVvmfRdjPs2DmmpOCNLFP/7cGw=";
              AllowedIPs = ["0.0.0.0/0"];
              Endpoint = "193.32.248.66:51820";
              # PersistentKeepalive = 25;
            }
          ];
        };
        networks."wg0" = {
          matchConfig.Name = "wg0";
          address = [
            " 10.65.241.123/32"
          ];
          DHCP = "no";
          dns = ["10.64.0.1"];
          gateway = [
            "10.0.0.0"
          ];
        };
      };

      # Sleep them for a while to make sure everything is set up
      systemd.services.sonarr.serviceConfig.ExecStartPre = "/run/current-system/sw/bin/sleep 1";
      systemd.services.radarr.serviceConfig.ExecStartPre = "/run/current-system/sw/bin/sleep 1";
      systemd.services.jackett.serviceConfig.ExecStartPre = "/run/current-system/sw/bin/sleep 1";
      systemd.services.rutorrent.serviceConfig.ExecStartPre = "/run/current-system/sw/bin/sleep 1";

      # fuck nano
      programs.nano.enable = lib.mkForce false;
      programs.vim.enable = true;

      # Services
      services.sonarr = {
        enable = true;
        openFirewall = true;
        dataDir = "/mnt/sonarr";
      };
      services.radarr = {
        enable = true;
        openFirewall = true;
        dataDir = "/mnt/radarr";
      };
      # services.prowlarr = {
      #   enable = true;
      #   openFirewall = true;
      # };
      # Prowlarr doesnt have a dataDir option
      # systemd.services.prowlarr.serviceConfig.ExecStart = pkgs.lib.mkForce "${lib.getExe pkgs.prowlarr} -nobrowser -data=/mnt/prowlarr";

      services.jackett = {
        enable = true;
        dataDir = "/mnt/jackett";
        openFirewall = true;
      };

      services.transmission = {
        enable = true;
        openFirewall = false;
        home = "/mnt/transmission";
        settings.download-dir = "/mnt/transmission";
        settings.incomplete-dir = "/mnt/transmission/.incomplete";
        downloadDirPermissions = "775";
      };

      # debugging
      users.users.root = {
        password = "supersecretpassword";
      };

      services.openssh = {
        enable = true;
        settings = {
          PermitRootLogin = "yes";
          AllowUsers = null;
          PasswordAuthentication = true;
          KbdInteractiveAuthentication = true;
        };
      };
    };
  };

  # Sonarr
  services.nginx.virtualHosts."sonarr.spoodythe.one" = {
    addSSL = true;
    enableACME = true;
    listen = [
      {
        inherit port;
        addr = "0.0.0.0";
        ssl = false;
      }
      {
        port = 443;
        addr = "0.0.0.0";
        ssl = true;
      }
    ];
    locations."/" = {
      proxyPass = "http://${host}:${toString port}";
    };
  };

  # Radarr
  services.nginx.virtualHosts."radarr.spoodythe.one" = let
    port = 7878;
  in {
    addSSL = true;
    enableACME = true;
    listen = [
      {
        inherit port;
        addr = "0.0.0.0";
        ssl = false;
      }
      {
        port = 443;
        addr = "0.0.0.0";
        ssl = true;
      }
    ];
    locations."/" = {
      proxyPass = "http://${host}:${toString port}";
    };
  };

  # Jackett
  services.nginx.virtualHosts."jackett.spoodythe.one" = let
    port = 9117;
  in {
    addSSL = true;
    enableACME = true;
    listen = [
      {
        inherit port;
        addr = "0.0.0.0";
        ssl = false;
      }
      {
        port = 443;
        addr = "0.0.0.0";
        ssl = true;
      }
    ];
    locations."/" = {
      proxyPass = "http://${host}:${toString port}";
    };
  };

  networking.firewall.allowedTCPPorts = [port 9117 7878 9696 80 433];
  networking.firewall.allowedUDPPorts = [port 9117 7878 9696 80 433];
}