From 82db9dd9cf63af5a15157147c8ab2d550349d2af Mon Sep 17 00:00:00 2001
From: nicknase27 <nick@nicknase27.com>
Date: Sun, 26 Jul 2026 14:26:19 +0200
Subject: [PATCH] add vpn and transmission

---
 flake.lock                        |  18 ++++++++-
 flake.nix                         |   3 ++
 modules/services/default.nix      |   1 +
 modules/services/transmission.nix |  59 ++++++++++++++++++++++++++++++
 secrets/secrets.nix               |   1 +
 secrets/wg0.age                   | Bin 0 -> 612 bytes
 6 files changed, 81 insertions(+), 1 deletion(-)
 create mode 100644 modules/services/transmission.nix
 create mode 100644 secrets/wg0.age

diff --git a/flake.lock b/flake.lock
index f6f57d3..1a27e68 100644
--- a/flake.lock
+++ b/flake.lock
@@ -138,7 +138,8 @@
       "inputs": {
         "agenix": "agenix",
         "nixpkgs": "nixpkgs_2",
-        "unifi-os-server": "unifi-os-server"
+        "unifi-os-server": "unifi-os-server",
+        "vpn-confinement": "vpn-confinement"
       }
     },
     "systems": {
@@ -189,6 +190,21 @@
         "repo": "unifi-os-server",
         "type": "github"
       }
+    },
+    "vpn-confinement": {
+      "locked": {
+        "lastModified": 1784582736,
+        "narHash": "sha256-a3V/LkUvwbN30QlCwPjNQq88TGOXiqXAzcYTSWgYIp4=",
+        "owner": "Maroka-chan",
+        "repo": "VPN-Confinement",
+        "rev": "bd17046da0262f3a93524845982825fa2ed23f40",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Maroka-chan",
+        "repo": "VPN-Confinement",
+        "type": "github"
+      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index 6b1c958..df40e15 100644
--- a/flake.nix
+++ b/flake.nix
@@ -5,6 +5,7 @@
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
     agenix.url = "github:ryantm/agenix";
     unifi-os-server.url = "github:rcambrj/unifi-os-server";
+    vpn-confinement.url = "github:Maroka-chan/VPN-Confinement";
   };
 
   outputs = {
@@ -12,6 +13,7 @@
     nixpkgs,
     agenix,
     unifi-os-server,
+    vpn-confinement,
     ...
   } @ inputs: {
     nixosConfigurations.Hermes = nixpkgs.lib.nixosSystem {
@@ -24,6 +26,7 @@
         ./modules/system
         agenix.nixosModules.default
         unifi-os-server.nixosModules.unifi-os-server
+        vpn-confinement.nixosModules.default
       ];
     };
   };
diff --git a/modules/services/default.nix b/modules/services/default.nix
index da5d7f5..44bd10d 100644
--- a/modules/services/default.nix
+++ b/modules/services/default.nix
@@ -4,6 +4,7 @@
   ...
 }: {
   imports = [
+    ./transmission.nix
     ./vaultwarden.nix
     ./navidrome.nix
     ./caddy.nix
diff --git a/modules/services/transmission.nix b/modules/services/transmission.nix
new file mode 100644
index 0000000..129088b
--- /dev/null
+++ b/modules/services/transmission.nix
@@ -0,0 +1,59 @@
+{
+  pkgs,
+  lib,
+  config,
+  inputs,
+  ...
+}: {
+  # Define VPN network namespace
+  vpnNamespaces.wg0 = {
+    enable = true;
+    wireguardConfigFile = "${config.age.secrets.wg0.path}";
+    accessibleFrom = [
+      "10.0.0.0/24"
+    ];
+    portMappings = [
+      {
+        from = 9091;
+        to = 9091;
+      }
+    ];
+    openVPNPorts = [
+      {
+        port = 51413;
+        protocol = "both";
+      }
+    ];
+  };
+
+  systemd.services.transmission = {
+    vpnConfinement = {
+      enable = true;
+      vpnNamespace = "wg0";
+    };
+
+    wants = ["wg0.service"];
+    after = ["wg0.service"];
+    partOf = ["wg0.service"];
+    serviceConfig = {
+      Restart = "always";
+      RestartSec = 5;
+    };
+  };
+
+  services.transmission = {
+    enable = true;
+    settings = {
+      "rpc-bind-address" = "0.0.0.0"; # Bind RPC/WebUI to VPN network namespace address
+      "rpc-whitelist-enabled" = false;
+      "rpc-whitelist" = "10.0.0.*,127.0.0.1";
+      download-dir = "/mnt/media/downloads";
+      incomplete-dir-enabled = false;
+    };
+  };
+
+  age.secrets.wg0 = {
+    file = ../../secrets/wg0.age;
+    path = "/run/secrets/wg0.conf";
+  };
+}
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 83cfa0b..ae81f40 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -11,4 +11,5 @@ in {
   "gitea-runner.age".publicKeys = systems;
   "navidrome.age".publicKeys = systems;
   "vaultwarden.age".publicKeys = systems;
+  "wg0.age".publicKeys = systems;
 }
diff --git a/secrets/wg0.age b/secrets/wg0.age
new file mode 100644
index 0000000000000000000000000000000000000000..9b0e956395acc01802265c395b4ea35a7b47b088
GIT binary patch
literal 612
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSnDKtq9PFDy{a;@+Q
zb9Z+taCQ$h^@zwZi7<%@jI4BWDGN^3*DeiDH!UcrC@Bca@a6LLE(<pcOV2gRjmpmn
zDJb#ua?H-uk8;Wm%1I7NF^Wp_O>!|0^9nak^hCF<!Y4F0Do~-w(yctxsl?K>+|etq
z$SBv<NIO5w$S>H;+uyswBB?6UtuV7Px3bK_DVxhI-!0cW%CN{kJJ2;LGsi!q!pS+p
z**_z<Dm6GL*Dxd^G&H-)!?47=AfHQDS69K+FFa7&G}GP5FSE>}IMBSRD$hKqsxZ&h
zz#z!9BsbDG-`LP3JG;WA#Dr^3qS*B?>*IY^99F`$d!{Yiv}Q%mj`vFv;+?p9&T1~w
zdHF<GCPPY2uJy^DfB%+5o#Cx+PZcSjef_KR#JfCwpQqi-?&#``dk~zf{Z4qH<Ko?y
zc6p!FQu9CCWpVr2ZvPWkE(Zk96R7)rO3l5jY>sfo6-F!1uUgd`SMrBiaf+zKpD;_b
zGpUg`kI#E{PAoA_@7#7qqofNvy-MxBbWQuJ*?hlYL!T}8mA{@F-G8jrE0~jVc=?4F
znr@!H;af!KE?Q|c>-L4|=2L|h%RIfTV6JB&njBhMEn*vcW5q+GC$TpSuYXH5GK!69
z>C<ADb~|#p&PsXu^V+ngE$?O}$_po^2tK&hRkYjSd4%TYFM94z*o|_Y{_=@_J$HNQ
xi-gyGPcB<eY}#m)uF7z*NXa&1UW|ra%ciIAWXx|gUr@W@;^r>MCaZmx4FG8O_%Hwf

literal 0
HcmV?d00001