From d8167b3bc14d8658a39e7eb0855bdbfe95200a03 Mon Sep 17 00:00:00 2001 From: David Crompton Date: Mon, 21 Jul 2025 19:01:53 -0400 Subject: [PATCH] hippocampus: fix oci wireguard vpn --- .../hippocampus/oci/Wireguard.ContainerFile | 2 +- machines/hippocampus/oci/jelly.nix | 24 ++++++++++++++----- machines/hippocampus/secrets/pass.yaml | 13 ++++------ 3 files changed, 23 insertions(+), 16 deletions(-) diff --git a/machines/hippocampus/oci/Wireguard.ContainerFile b/machines/hippocampus/oci/Wireguard.ContainerFile index 79c88ee..7add9a4 100644 --- a/machines/hippocampus/oci/Wireguard.ContainerFile +++ b/machines/hippocampus/oci/Wireguard.ContainerFile @@ -2,4 +2,4 @@ FROM alpine:3.16 RUN apk add --no-cache bash wireguard-tools jq curl git ncurses RUN git clone https://github.com/pia-foss/manual-connections /manual-connections WORKDIR /manual-connections -ENTRYPOINT /manual-connections/run_setup.sh +CMD bash -c "/manual-connections/run_setup.sh && watch -n 60 curl ip.me" diff --git a/machines/hippocampus/oci/jelly.nix b/machines/hippocampus/oci/jelly.nix index 12689ee..73447a5 100644 --- a/machines/hippocampus/oci/jelly.nix +++ b/machines/hippocampus/oci/jelly.nix @@ -18,10 +18,12 @@ in { containers = { wireguard = { - image = "thrnz/docker-wireguard-pia"; + # Derived from the pia-wg.tar.gz + # which was built from the containerfile + image = "localhost/pia-wg:latest"; volumes = [ # "${configDir}/wireguard:/config" - "${configDir}/wireguard_pia:/pia" + # "${configDir}/wireguard_pia:/pia" ]; ports = getPorts [ "deluge" @@ -34,13 +36,23 @@ ]; environment = { TZ = "America/Toronto"; - LOC = "ca"; + LOC = "ca"; + PIA_DNS = "false"; # - true/false + PIA_PF = "false"; # - true/false + PIA_CONNECT = "true"; # - true/false; connect to VPN after configuration has been created. Set to false to only create configuration file. Only effective for wireguard protocol. Default true. + MAX_LATENCY = "0.2"; # - numeric value, in seconds + AUTOCONNECT = "true"; # - true/false; this will test for and select the server with the lowest latency, it will override PREFERRED_REGION + # PREFERRED_REGION = ""; # - the region ID for a PIA server + DIP_TOKEN = "n"; + VPN_PROTOCOL = "wireguard"; # - wireguard or openvpn; openvpn will default to openvpn_udp_standard, but can also specify openvpn_tcp/udp_standad/strong + DISABLE_IPV6 = "no"; # - yes/no }; extraOptions = [ - "--cap-add=ALL" - "--pull=newer" - "--dns=1.1.1.1" + "--privileged" "--dns=1.1.1.1" "--env-file=${config.sops.secrets.jellyfin-pia.path}" + "--cap-add=NET_ADMIN,NET_RAW,SYS_MODULE" + "--cap-drop=MKNOD,AUDIT_WRITE" + "--sysctl=net.ipv4.ip_forward=1" "--sysctl=net.ipv4.conf.all.src_valid_mark=1" "--sysctl=net.ipv6.conf.lo.disable_ipv6=1" "--sysctl=net.ipv6.conf.all.disable_ipv6=1" diff --git a/machines/hippocampus/secrets/pass.yaml b/machines/hippocampus/secrets/pass.yaml index 6ee8598..c8b2d5c 100644 --- a/machines/hippocampus/secrets/pass.yaml +++ b/machines/hippocampus/secrets/pass.yaml @@ -1,7 +1,7 @@ nextcloud: adminPass: ENC[AES256_GCM,data:D2SAD/Somvw8abIm0KX4fWRfuQ==,iv:Y7K14yZZFcu97KVBd0219hwnGY4LEX2DNxxulSegr/8=,tag:aRJAlz1xvQxWodcE2bZLdQ==,type:str] s3secret: ENC[AES256_GCM,data:lIVuiZMh376MSuu13UPCu49Q64bVbk+WM/CUEIGzV0Q=,iv:J2vHalppWEupWK07zXsMoiH6avmpsgg0Cqcc7EkZVV4=,tag:pxKwiaH5SZa8Vh71gLGQWw==,type:str] -jellyfin-pia: ENC[AES256_GCM,data:rbqpmm2EtxcMeJfjlGaJOwPCn4UAZaKsH8Zeztk7A6QiSw==,iv:8A6NHVHgKIL6iwLKgRrT6T3k0pgDI5lL5rDMN5/Egrw=,tag:P6Kh9cOnrB23Z7S72xBK7g==,type:str] +jellyfin-pia: ENC[AES256_GCM,data:hOgUAr47FMd2QgzgXBeqv41Paqy6zn6tyWVDbF1JtqcTog/zZC4=,iv:opnxrycFszAhuMARcP48gKF6eL1ERNgWS68wO+s4CIM=,tag:fqimxKdTAh55ANKD3bp46w==,type:str] ddclient: ENC[AES256_GCM,data:a31MKnoEZXrj/s8z3+MP9jhQ5/sBjljZphXBJsWj5GU=,iv:YHKCartadDQa59aUf9Fw/KgdgMgsqsVLDAIh/KeqehQ=,tag:hUaUqjcX75xw6eC9axtQmw==,type:str] anki: ENC[AES256_GCM,data:hUBKr/s1DDorlmbHDUvHtVSumw==,iv:Ekjt6dsncinHhM+dV/mxOjErBQpgKtPOVbmwGRy9XOE=,tag:zvfV9z3QROgsk4eznmxqDw==,type:str] tandoor-secret: ENC[AES256_GCM,data:/clEIU38M7lJ6+JbFSKWb5kKSUvxdGYPq2Hl9TjgijZtYIYFOleJQ9PiT+d/osmY/r0=,iv:Nulu93V+s9RBmEDRs2LXJXy7l0O/AeU0CwwtTNLGw2c=,tag:brRyVaWeUGLx1nt0MtcIEw==,type:str] @@ -14,10 +14,6 @@ restic: passwd: ENC[AES256_GCM,data:vUsAP5+iZo7U55xnUP7Cnk1OxnrO+paHKmT2cuc=,iv:GF7fybEQZIxHPm1Z6Sj5dn/zOR5dRVgikH8LILsTMIs=,tag:Mh61boRPsfHeiSfXmrEx5Q==,type:str] backblaze: ENC[AES256_GCM,data:IfWzuIYUrCGYpP68CPFi2vLqq9NVmiVyCE+Z8yi+cnaQwgwNL40lJEPL/U3d0lgsmrsV4GheNJ0oQ9tnrrJeBgZgwMl/CwXMctuUHo+cvVot/cNRd1vCdjRr7WUnw8737uxyW45OaaYbkZRa3NWEGDll1iFDWB2w4n5DTsomyO03tFZB5gckwQYmpjYmK4DcIWyTaEiDrznmkyM+sxoWv9pcTHZIIN7TCHHkzmlMzXXqJnoRfCpdVm/QF9jbrAYs,iv:tOa1FFyggm0ScoRdFk6tACOnQVcZMYaDqeJyX5SMKXc=,tag:EY5jQhZnLP6IzqY9garoEQ==,type:str] sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] age: - recipient: age1crymppz88etsdjpckmtdhr397x5xg5wv8jt6tcj23gt2snq73pzs04fuve enc: | @@ -28,8 +24,7 @@ sops: RVUzMlFya3Z0amdTUTJ5YjFRck5kZzQKoWZzExqzPRpQPL4CdqBalc1/dYtjBH6J LGR0oImfOWlIJwcaJLv/fc470UvXHHwIji9v/pbV7xMkgMjlJthaYg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-11-26T02:45:21Z" - mac: ENC[AES256_GCM,data:t5+2iRUJprwwW8GRiQx/h8IOYjjhsq+954GDL2ujXiZVM3oBhESdeBi6aMMwsqABCr+PjP4gb4qHHbduxWlGSZlAh4HSiVwwizI8XV8HZqUqPKBJEqRThzcwznCk4DOGpf1PMbktBX/r50pDeoDcgShKka1bMY8kD385SVklgNE=,iv:EXFXz12HNTMRoW0gIrTEZPHhdTG2cxaWf65uTgT7nZ4=,tag:5XweTiLnO9N8eZb4EPkh6g==,type:str] - pgp: [] + lastmodified: "2025-07-19T19:15:37Z" + mac: ENC[AES256_GCM,data:RPGKe5f+5GUnGK3zybRrTnd8N4TprLWBEWLI2HI68Acf1MlJ1AMOWOhpi5xa0Hkxpah8D/d0CEH2ymaO5EBSUamPdYThI4g/4cxNBXboKnALSf91ZUty86/1+14TbI6vFCZ5ghjB4THxszGf47ajIDa/TjHx0yHFWDi7rpApmcw=,iv:ep/NlJfkIkQe5RJ4U2YfZ7/0S4vWqxjg+xrLLnJwfwI=,tag:c01jey2juzoPKux7n/0rug==,type:str] unencrypted_suffix: _unencrypted - version: 3.9.0 + version: 3.10.2