1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

diff --git a/flake.lock b/flake.lock
index cce191d0fe35655bac5ad422283f287c04997178..6c12b81f9d23b1bedc5a2201d6aeb10113b9ced3 100644
--- a/flake.lock
+++ b/flake.lock
@@ -654,6 +654,7 @@         "resume": "resume",
         "tailproxy": "tailproxy",
         "tclip": "tclip",
         "ugit": "ugit",
+        "vpn-confinement": "vpn-confinement",
         "website": "website"
       }
     },
@@ -852,6 +853,21 @@       },
       "original": {
         "owner": "numtide",
         "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "vpn-confinement": {
+      "locked": {
+        "lastModified": 1788035501,
+        "narHash": "sha256-3Xs9lCMwjvFURU7/fPEGDR5kCKvcdX2l5Fah1nZoaGQ=",
+        "owner": "Maroka-chan",
+        "repo": "VPN-Confinement",
+        "rev": "ce8949125b698406810ea71a8bd7b567d9a0b09f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Maroka-chan",
+        "repo": "VPN-Confinement",
         "type": "github"
       }
     },

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

diff --git a/flake.nix b/flake.nix
index 6a1dc175e59ba0c6330a24f378a0885a905e11a1..d6857e274ab6e3df388467de5bd21ea648d0208d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -29,6 +29,7 @@     foundry.url = "github:reckenrode/nix-foundryvtt";
     tailproxy.url = "git+https://git.jolheiser.com/tailroute.git";
     forge-lines.url = "git+https://code.winston.sh/winston/forge-lines.git";
     mazanoke.url = "github:jolheiser/mazanoke-nix";
+    vpn-confinement.url = "github:Maroka-chan/VPN-Confinement";
   };
 
   outputs =
@@ -72,6 +73,7 @@         ];
         gunpowder.imports = [
           inputs.agenix.nixosModules.default
           inputs.tailproxy.nixosModules.default
+          inputs.vpn-confinement.nixosModules.default
           ./common
           ./gunpowder
         ];

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

diff --git a/gunpowder/services/mullvad.nix b/gunpowder/services/mullvad.nix
deleted file mode 100644
index c3699a7b3e7dc861eb365c995dbd15ebec2abe60..0000000000000000000000000000000000000000
--- a/gunpowder/services/mullvad.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{ lib, config, ... }:
-let
-  enable = true;
-in
-lib.mkIf enable {
-  age.secrets.mullvad.file = ../../secrets/mullvad.age;
-
-  services.mullvad-vpn.enable = true;
-
-  systemd.services.mullvad-provision = {
-    description = "Log in to Mullvad and keep it connected";
-    wantedBy = [ "multi-user.target" ];
-    after = [ "mullvad-daemon.service" ];
-    requires = [ "mullvad-daemon.service" ];
-    path = [ config.services.mullvad-vpn.package ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-    };
-    script = ''
-      until mullvad status >/dev/null 2>&1; do sleep 1; done
-      mullvad account login "$(cat ${config.age.secrets.mullvad.path})"
-      mullvad auto-connect set on
-      mullvad connect
-    '';
-  };
-}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76

diff --git a/gunpowder/services/qbittorrent.nix b/gunpowder/services/qbittorrent.nix
index e4b74bfbb2615624cadcc1d8995227c01d7cd2b1..bdf08393b9902166621c90bb3879ae79fddcf444 100644
--- a/gunpowder/services/qbittorrent.nix
+++ b/gunpowder/services/qbittorrent.nix
@@ -1,51 +1,38 @@
-{ lib, pkgs, ... }:
+{ lib, config, ... }:
 let
   enable = true;
   port = 7248;
+in
+lib.mkIf enable {
+  age.secrets.mullvad.file = ../../secrets/mullvad.age;
 
-  mullvadBypassMark = "0x6d6f6c65";
-  mullvadBypassCtMark = "0x00000f41";
+  vpnNamespaces.mullvad = {
+    enable = true;
+    wireguardConfigFile = config.age.secrets.mullvad.path;
+    portMappings = [
+      {
+        from = port;
+        to = port;
+      }
+    ];
+  };
+
+  systemd.services.qbittorrent.vpnConfinement = {
+    enable = true;
+    vpnNamespace = "mullvad";
+  };
 
-  ruleset = pkgs.writeText "qbittorrent-mullvad-scope.nft" ''
-    table inet qbittorrent_mullvad_scope {
-      chain output {
-        type route hook output priority 0; policy accept;
-        meta skuid != "qbittorrent" meta mark set ${mullvadBypassMark} ct mark set ${mullvadBypassCtMark}
-        meta skuid "qbittorrent" oifname != "wg-mullvad" oifname != "lo" drop
-      }
-    }
-  '';
-in
-lib.mkIf enable {
   services = {
     qbittorrent = {
       enable = true;
-      openFirewall = true;
       webuiPort = port;
     };
     tailproxy.qbittorrent = {
       enable = true;
       hostname = "qbittorrent";
+      host = config.vpnNamespaces.mullvad.namespaceAddress;
       inherit port;
       authKey = "tskey-auth-kV7j5FHHHh11CNTRL-wPSNdNQqza8kXxzpnZXha8B7JCvdwCAy"; # One-time key
-    };
-  };
-
-  systemd.services.qbittorrent-mullvad-scope = {
-    description = "Scope the Mullvad tunnel to qBittorrent only";
-    wantedBy = [ "multi-user.target" ];
-    after = [ "network-pre.target" ];
-    before = [
-      "qbittorrent.service"
-      "mullvad-daemon.service"
-    ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      ExecStart = pkgs.writeShellScript "qbittorrent-mullvad-scope-start" ''
-        ${pkgs.nftables}/bin/nft delete table inet qbittorrent_mullvad_scope 2>/dev/null || true
-        ${pkgs.nftables}/bin/nft -f ${ruleset}
-      '';
     };
   };
 }

1
2
3

diff --git a/secrets/mullvad.age b/secrets/mullvad.age
index 0ba002c8108c920fc79e250873a2ea897028a7c5..04dbeebcad3662a22caa44e2b281ef09b4be9119 100644
Binary files a/secrets/mullvad.age and b/secrets/mullvad.age differ