From b69c9dbbbf165f1aadbfb83706be6f13db60ee54 Mon Sep 17 00:00:00 2001
From: Jimbo <jimjam4real@gmail.com>
Date: Wed, 4 Sep 2024 20:22:13 -0400
Subject: [PATCH] Move more things into their 'correct' place

---
 nixos/server.nix                            |   1 +
 nixos/server/firewall.nix                   |  14 ---
 nixos/server/gitea.nix                      |   3 +
 nixos/server/minecraft/servers/johnside.nix |  92 ++++++++++++--------
 nixos/server/minecraft/servers/velocity.nix |  10 +++
 nixos/server/nginx.nix                      |  17 ++--
 nixos/server/synapse.nix                    |  10 +++
 nixos/server/transmission.nix               |  20 +++++
 secrets.nix                                 | Bin 1742 -> 1900 bytes
 9 files changed, 109 insertions(+), 58 deletions(-)
 create mode 100644 nixos/server/transmission.nix

diff --git a/nixos/server.nix b/nixos/server.nix
index b7419ca1..ec583dce 100644
--- a/nixos/server.nix
+++ b/nixos/server.nix
@@ -35,6 +35,7 @@
     ./server/minecraft
     ./server/tandoor.nix
     ./server/vaultwarden.nix
+    ./server/transmission.nix
     ./server/misc.nix
 
     # Matrix
diff --git a/nixos/server/firewall.nix b/nixos/server/firewall.nix
index a28ee4af..c78d44ec 100644
--- a/nixos/server/firewall.nix
+++ b/nixos/server/firewall.nix
@@ -8,27 +8,13 @@
   in {
     firewall = {
       allowPing = false;
-      allowedTCPPorts = [
-        80 443 # Nginx
-        25565 19132 5657 # Pufferpanel
-        2299 # Gitea SSH
-        3478 5349 # Coturn
-      ];
       allowedTCPPortRanges = [
         { from = 8100; to = 8150; } # Azuracast
       ];
-      allowedUDPPorts = [
-        25565 19132 # Minecraft Voicechat and Bedrock
-        3478 5349 # Coturn UDP
-      ];
-      allowedUDPPortRanges = [
-        { from = 49000; to = 50000; } # Coturn range
-      ];
   
       # Add extra input rules using nftables
       extraInputRules = ''
         ip saddr ${ips.localSpan}.0/24 tcp dport 2049 accept comment "Accept NFS"
-        ip saddr ${ips.localSpan}.0/24 udp dport 53 accept comment "Accept DNS"
         ip saddr { ${ips.pc}, ${outputs.secrets.lunaIP}, ${outputs.secrets.cornIP}, ${outputs.secrets.vertIP} } tcp dport { 1935, 1945 } accept comment "Accept RTMP"
       '';
     };
diff --git a/nixos/server/gitea.nix b/nixos/server/gitea.nix
index 323801f6..962ce9c8 100644
--- a/nixos/server/gitea.nix
+++ b/nixos/server/gitea.nix
@@ -30,4 +30,7 @@
       };
     };
   };
+
+  # Allow Gitea SSH to work
+  networking.firewall.allowedTCPPorts = [ 2299 ];
 }
diff --git a/nixos/server/minecraft/servers/johnside.nix b/nixos/server/minecraft/servers/johnside.nix
index baed0648..c85528c6 100644
--- a/nixos/server/minecraft/servers/johnside.nix
+++ b/nixos/server/minecraft/servers/johnside.nix
@@ -1,41 +1,65 @@
-{pkgs, ...}: let
+{pkgs, outputs, ...}: let
   common = import ../common.nix { inherit pkgs; };
 in {
-  services.minecraft-servers.servers.johnside = {
-    enable = true;
-    package = pkgs.paperServers.paper-1_20_6;
-    jvmOpts = "-Xmx4084M";
-    serverProperties = common.serverProperties // {
-      difficulty = 2;
-      server-port = 30009;
-      motd = "§l§9Johnside SMP§r §l§fworld for §4John lovers only.";
+  services = {
+    minecraft-servers.servers.johnside = {
+      enable = true;
+      package = pkgs.paperServers.paper-1_20_6;
+      jvmOpts = "-Xmx4084M";
+      serverProperties = common.serverProperties // {
+        difficulty = 2;
+        server-port = 30009;
+        motd = "§l§9Johnside SMP§r §l§fworld for §4John lovers only.";
+      };
+      whitelist = common.whitelist;
+      symlinks = common.symlinks // {
+        "plugins/BlueMap.jar" = builtins.fetchurl {
+          url = "https://cdn.modrinth.com/data/swbUV1cr/versions/TL5ElRWX/BlueMap-5.3-spigot.jar";
+          sha256 = "08ls3wk0333vjg49kcmri884pcgm2xk9xdhwcxyffbh4ra0xrlbw";
+        };
+        "plugins/BlueMapOfflinePlayers.jar" = builtins.fetchurl {
+          url = "https://github.com/TechnicJelle/BlueMapOfflinePlayerMarkers/releases/download/v3.0/BlueMapOfflinePlayerMarkers-3.0.jar";
+          sha256 = "1f07w53q7yr4mvph7013d7ajxmp4lnsv6b1ab14y2x0bmqv39nwr";
+        };
+        "plugins/BlueMapMarkerManager.jar" = builtins.fetchurl {
+          url = "https://cdn.modrinth.com/data/a8UoyV2h/versions/E0XoPfJV/BMM-2.1.5.jar";
+          sha256 = "1vpnqglybysxnqyzkjnwbwg000dqkbk516apzvhmg39wlfaysl9d";
+        };
+        "plugins/CustomDiscs.jar" = builtins.fetchurl {
+          url = "https://github.com/Navoei/CustomDiscs/releases/download/v3.0/custom-discs-3.0.jar";
+          sha256 = "0xv0zrkdmjx0d7l34nqag8j004pm9zqivc12d3zy9pdrkv7pz87d";
+        };
+        "plugins/NotTooExpensive.jar" = builtins.fetchurl {
+          url = "https://github.com/Mrredstone5230/Not-Too-Expensive/releases/download/1.1/not-too-expensive-1.1.jar";
+          sha256 = "0da4v5l7iwry3wc21292lkmjprgmign4vdshzmhp7qc9hx26pj2d";
+        };
+        "plugins/SilkTouchHands.jar" = builtins.fetchurl {
+          url = "https://github.com/5U55/SilkTouchSpigot/releases/download/v1.1/SilkTouchv1.1.jar";
+          sha256 = "0mbp73xclr7f5m2lbdfz6is1j8vvyv1qwpl28sm089zrpm73qn6w";
+        };
+      };
     };
-    whitelist = common.whitelist;
-    symlinks = common.symlinks // {
-      "plugins/BlueMap.jar" = builtins.fetchurl {
-        url = "https://cdn.modrinth.com/data/swbUV1cr/versions/TL5ElRWX/BlueMap-5.3-spigot.jar";
-        sha256 = "08ls3wk0333vjg49kcmri884pcgm2xk9xdhwcxyffbh4ra0xrlbw";
-      };
-      "plugins/BlueMapOfflinePlayers.jar" = builtins.fetchurl {
-        url = "https://github.com/TechnicJelle/BlueMapOfflinePlayerMarkers/releases/download/v3.0/BlueMapOfflinePlayerMarkers-3.0.jar";
-        sha256 = "1f07w53q7yr4mvph7013d7ajxmp4lnsv6b1ab14y2x0bmqv39nwr";
-      };
-      "plugins/BlueMapMarkerManager.jar" = builtins.fetchurl {
-        url = "https://cdn.modrinth.com/data/a8UoyV2h/versions/E0XoPfJV/BMM-2.1.5.jar";
-        sha256 = "1vpnqglybysxnqyzkjnwbwg000dqkbk516apzvhmg39wlfaysl9d";
-      };
-      "plugins/CustomDiscs.jar" = builtins.fetchurl {
-        url = "https://github.com/Navoei/CustomDiscs/releases/download/v3.0/custom-discs-3.0.jar";
-        sha256 = "0xv0zrkdmjx0d7l34nqag8j004pm9zqivc12d3zy9pdrkv7pz87d";
-      };
-      "plugins/NotTooExpensive.jar" = builtins.fetchurl {
-        url = "https://github.com/Mrredstone5230/Not-Too-Expensive/releases/download/1.1/not-too-expensive-1.1.jar";
-        sha256 = "0da4v5l7iwry3wc21292lkmjprgmign4vdshzmhp7qc9hx26pj2d";
-      };
-      "plugins/SilkTouchHands.jar" = builtins.fetchurl {
-        url = "https://github.com/5U55/SilkTouchSpigot/releases/download/v1.1/SilkTouchv1.1.jar";
-        sha256 = "0mbp73xclr7f5m2lbdfz6is1j8vvyv1qwpl28sm089zrpm73qn6w";
+
+    # BlueMap webhost
+    nginx.virtualHosts."john.${outputs.secrets.jimDomain}" = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:31010";
+        proxyWebsockets = true;
       };
     };
   };
+
+  # Allow Nginx to read and write to paths
+  systemd.services.nginx.serviceConfig = {
+    ReadWritePaths = [ "/var/www/Jimbo-Landing-Page/streams/hls/" ];
+  };
+
+  # Open HTTP and HTTPs ports
+  networking.firewall = {
+    allowedTCPPorts = [
+      80 443 # Nginx
+    ];
+  };
 }
diff --git a/nixos/server/minecraft/servers/velocity.nix b/nixos/server/minecraft/servers/velocity.nix
index 732428ea..ee86d800 100644
--- a/nixos/server/minecraft/servers/velocity.nix
+++ b/nixos/server/minecraft/servers/velocity.nix
@@ -36,4 +36,14 @@ in {
       };
     };
   };
+
+  # Open ports for proxy
+  networking.firewall = {
+    allowedTCPPorts = [
+      25565 19132 5657 # Minecraft server info
+    ];
+    allowedUDPPorts = [
+      25565 19132 # Minecraft server, VC, and Bedrock
+    ];
+  };
 }
diff --git a/nixos/server/nginx.nix b/nixos/server/nginx.nix
index c867a580..53066ba3 100644
--- a/nixos/server/nginx.nix
+++ b/nixos/server/nginx.nix
@@ -40,16 +40,6 @@
           };
         };
       };
-
-      # Bluemap Proxy, TODO, move this into the nix-minecraft flake configs
-      "john.${outputs.secrets.jimDomain}" =  {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:31010";
-          proxyWebsockets = true;
-        };
-      };
     };
     appendConfig = ''
       rtmp {
@@ -76,4 +66,11 @@
   systemd.services.nginx.serviceConfig = {
     ReadWritePaths = [ "/var/www/Jimbo-Landing-Page/streams/hls/" ];
   };
+
+  # Open HTTP and HTTPs ports
+  networking.firewall = {
+    allowedTCPPorts = [
+      80 443 # Nginx
+    ];
+  };
 }
diff --git a/nixos/server/synapse.nix b/nixos/server/synapse.nix
index ea266724..81ed2e34 100644
--- a/nixos/server/synapse.nix
+++ b/nixos/server/synapse.nix
@@ -121,4 +121,14 @@
       };
     };
   };
+
+  # Open coturn ports
+  networking.firewall = {
+    allowedUDPPorts = [
+      3478 5349 # Coturn UDP
+    ];
+    allowedUDPPortRanges = [
+      { from = 49000; to = 50000; } # Coturn range
+    ];
+  };
 }
diff --git a/nixos/server/transmission.nix b/nixos/server/transmission.nix
new file mode 100644
index 00000000..7b149f9c
--- /dev/null
+++ b/nixos/server/transmission.nix
@@ -0,0 +1,20 @@
+{pkgs, outputs, ...}: {
+  services = {
+    transmission = {
+      enable = true;
+      credentialsFile = pkgs.writeText "credentials" outputs.secrets.transmissionCredFile;
+      openPeerPorts = true;
+      settings = {
+        rpc-authentication-required = true;
+      };
+    };
+    nginx.virtualHosts."torrent.${outputs.secrets.jimDomain}" = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:9091";
+        proxyWebsockets = true;
+      };
+    };
+  };
+}
diff --git a/secrets.nix b/secrets.nix
index 83e6cfd3d5f5c4240dd98318c6f6801c6ddcc8b3..dea9ce7de973c0752e71152e8bf6b4c44997097a 100644
GIT binary patch
literal 1900
zcmZQ@_Y83kiVO&0$lHEY@|KE^wWr_Zy=6-CO^^2)70s6FSrd`h;#z&>_K*1&|L)OJ
zpZ_b=q~)t@uF2ddmw%Z5{SkZk*_QIz_ZO|}Q?FZnI{!8Mf^|ucnuBxIQV(tX<Ir$S
z@|xz0rv=Y;bh>nkE!z4rtmsOZ-lU=`8QCdnqF25s8t$0N<Gz>sUuHq7@+75e7F7ma
z93c!{fBxDPCM?g>i^<;gZqK~n<kbf+v&<+{k#Js6p{&$!B{|AwhpCU{dUvUMN8y}*
zhcf&ls-qh-`pZ6+t&8~Jt}PO-W_oDCop8klJKqJDpKQ^Iymui=_*8h;AEgU{NylU3
zuf|uG1s}Q4TDdg(-u1gI_kLEkYnr~^Q#e84Y6$PX$MZ{b7O@K?uUHvS^*>~Ks9Ux1
z>bQs>liE%<{Z-5H?LQv!c;lw-|4J*)E9MF;Ik)&UV+?1(H3w}8-r%`^mo2iKx#v@H
zQD~R^=lRQh<QE)NeO>0Orlhd&(ZP<GX@ygRTk<4J?*(l;_$J}-&P`<=hF6QEJL2ZZ
zYdkHxyXx<hyq@iaiC4LTuD@^AkNtW}bB#_+p&}Pg(T^><;xSXUp3dD?8C<+qk}Y@k
zWtNz}ecNCB5BGTRS%8JFUuRB3BLmOtM4f$p4Q;FRyY9NJ3tw6y`BZuTye!UShV_$#
zjx}>U(=VMX^QU);|NN=qQaU|TMCQ$WdFI_}$6e{~<%KKdj~#k^bgPNV^NH?hJRw)k
zK6qwy<%jUxRtb3qm)-rD6Anh%?mngRTD7kHhK=+_^%?GRCtrU|n-JIckpF8D+d=LJ
zo%<esGClmt*SFG!?aHEH_Uet7(-%zeSbaQE_QvVSr@WfX9__jCYU^*83$^P~o1Gn}
zt@^p4v@fbB!Zz4`^3$xPp2w5zFIO!6s5NPqP0sxlXKwvroBlGP@LA=pj@UZhxVq@Y
zGd45ynb#E`Tr1L{6SVK)`NR#b>t#=cnh01_%Ln>be$!(UZhkgzMenS8h6bN(r^jUd
z>Fi2=>mMLJv9VO1!=U4X%)gCaKOGi*U|Z<YY38zcrpd#~nQNyeCuiPBYP8DDF{$RO
z+c%T#u=i%Sw`-rTv}TK)_2cUIR<ZTL&z3yxP=71_l4W0mO>Ihu-^vFzmh)USI1*=E
zb=2W&E3r_pKe%Duir@q09>+Q=Ew3)T^!0XzRs7R0`MlqHt3SQua4cVvq7t#ZUa4f~
z!i<lZh3Qdo*H{0#Z0HczzU=NM0XKjCgbMd9@*AGFDuu0JZ~R*^!D|2W|L*5Y+~-L-
z3R|waoc>(OE??bq)gw=r$y>foee>t}<FG)ZA6a#4uW?>^ADbhWu;yl?vbu9sgR)!s
ziiNjD!d6X7k}bW`zomEgr}w@GzUZ#rF;!OR&^ghkGP@$WpJYGZ=lt**Q|$4;)`GCe
z@SWFR&)F7ivgFsYbj8^prthDBU~ih6hvlsO0kRV(?b)l)%T%hYkj3+Iazx$T91-qa
zMV}<2C$!$3Xs$l3@s_7-<yGOQj$5tXXUO@ly4<i-FpT}JcJB*|XRLAyC;$E9-+$Ju
z$dIKjvh;Q1ntw{0jHU?tU7fq~`O`g(hbPo;GJd_d-gnnE&V%>2tnNyFy!g|tf2Atb
z+nLSl3jFVGYAn+8msz|`cq+FQx0z$lJfX)%`&M60Y>Wt37I%5T()CtHQLl+HztyxU
zefPz8l?uH&Yi}yc#pO?wy8C(F-TnvjuPlEr`Zav|EVD<UoDakAy}deDP5Tb_S;jBx
zouxb;_PE{*+G!Y2k~HH%bN1pArx^-trIrtPBz9c(c3S(qJc@1Yb>-;|x|iB5uf9^-
z6vesFM>g+$ij82{+9@qU_P*NRcSdg6$bMydd&ImL5052Y&#&HUIN$%TJ!aSAOx^WM
zerNNZs?M?68JSgk+<Iy5iMF1(l^57;bk;upA+qpKUsqz+!F4O|HaIO}{J}8OLHAFH
zcz{OWv>1g6`lqTJ&z)z{T>aW(VL})4=j6x#Uu!S4iP@{5-p&>E&7|sUSRzLi`}5W9
zyfLpd(h{q!|1aOT>idR0|5vFL{%|=gA`sg!C8X`Y&;1fjDf?wQAtf@lA2VkZo4m5R
zwX(8i>c0F8m$PRlFnsCx#rI<!%Z^!Z*J+#$Sk9`Vm;Ee5^WM*0A1B!EiT?YmHEVl!
zKHC}PoW)MRrMh(0CT}m8VBquQSZ$y~gp8f;BSW>wnE}lq2OU>sIe%e@3shbAamI&O
zeuF7D6AHr0EjV^xZB;XA?~L`@++v<$GwVd3h|!1RJXWb;J~fwa$j<3f_U1mp+BP#T
zXeFE3hg{E}m4{j^8v|cI-7{rJm3!9X39k;uFhu>I#Z$0zPsO&$b&Ji;21`vo|HCQa
z^!yp6hK(6pN*->u_#hp<ZC$Yfv(Nj&nJR5%VoxM5-VI&)=<$^adAcg!I;>eL=Gk(_
zaCG-Y@1M5tcH;}12DRY$>)Zc3c)MPVY2n~_skXvGV@mnUrzMK3`ku&|t55zCdr55`
z>%?x6>}m7d&%4_P&YctM-%xdZZb;YP`^&kG9Oz#ht?Y2L@^+#_`Cqr6O5gHqe#Mx?
fhRzT^erAH8QETju-CQj`TgzKQ-+Yo~_u2~p)q$^4

literal 1742
zcmZQ@_Y83kiVO&0IMvgwAiOO{Lh8$nRUr>g^i9afEJ|$g<hK2|o|*R!`?HJ>;Z-@&
zx916bSZv3c*yQje@9V5HyO#9U&Qf`+c5}nwt!zCPYVN;hm~L4%dqeOdx5(fXPPW^X
z6BWV_@$$<a+^e6o-PXG**5cq4&Wkxue>%qKztmB=xx9XjRr;yGv@017|0`})?=RXW
zb#nfTzQU7%Dps-oUotXJHks%#k5P_cr)kxK+%FD2z0K3tU!E)~?P+DSG-a~Nk7V0z
zOU|!0Fc6a2zI}>k@ZzpDR*6>km>p*nH!Hto+H~-UvU2sJ<B8L{;>Ehk7pQnW@Ll@Z
z?quYuo(-2ybFz4cSzJk*Ui^Q8wxHnra{iXOE{ArhTPqtToRiomE@!p>v{ZonboH5&
zPt{!!*5Bu#{yFZv%>KeE!^FNB9EE9LScJ@N`)n7u+RJn6zYDqRV17x;nqB|wtp)uL
z_gp{sXVUK-GJ&qaFY?c@an`(X)nD`Gue`V8{jMo{X6!1z`1<P7@^hKJ(zzdc?tgzj
zgFEqm&ZaA-y;J|~-aI4erT2`oVq;HTR{a|<tR2p!W-3;#nZND(ga@{BCLH>G+&wo~
zp{nvy)9UckJr_3B&eAoo-xT(8df}GTd8fZ6Mqk^>cO~|;uj<RoAvY_-WHJITE$LDY
zpOfre<Kr*+?|%6H0Fx&Vg+!JMZV}T^uXy2B{bKP+XQhvJQhPr6E_`0a`8sKP!4}3N
zYIU>J=PpcA$aU;c$WE5_nX09wo^fgVs(;<)sW*HRUa~k&@woi>ZKaUXs`lqqGr!sL
z%klJfzWm7gbern#;0TLjH|ETnwajT@)w-7wPEON0S&rV4n<tcKda&PQ?Ym{dN7ph~
z?K)Txz_9Xn<K1<~_8(r#`r-$R)la`=H*P&roqXV^vD4(2Vs)<^I*(nq_{9-3`JwNr
zy|(jh_C?+Ejz2NQ#wh1Q_>M;tcMB;r^Y4vnp1skc?7fn*{@hnrKF7IO88ZI4yXd9J
zrt3HNN2&`4Z4JDy#-h?$C%VOyS@A$|YOGgigM_5ueNX;SC-E!g4yv~{_g`^d6eW4r
zMosOWh{!ULzSmP+=T=_I+oyevM@8LgKd+kZx})1Bi%YlnSMFq$zTg~m#^Q8w`ZUMp
z|LYjjKOOYZW)x~jUcjSd<NEVY`D@8+m5DWn0v~giZtkvebbNoABYVZ#4)t!G?e-C2
z(%M-CEb^+;St|;QnP$Wpf8C>a(b9*_UF)o?WWaVkrwN&b%RZ|wO-~SgRmND?z4|Wi
zQQO>yFKo0<pZ^#8Qg*7=msG<(iGQsoZ-WZzu7z|pc&_@{75PVyb&IWXvQMsX)0rRT
z_os&?R3sF*p3rsnnyoT#_0gEm$3&h!ExWtLI_c!h3grV=Y?}l!jtgx%>9NWqo$uZS
zQP#M=usJPJCvRtkEd3{>-m&-Wm4m^CO^<cYUeGE&BE<PjzkQW)b<rPrZ8nX5S^23c
z3uWI&re{WNT$=fTXGV_6@z|A`_pUx$%XQ?-vjr1WUmu&kCx4!O+j_Itvx0=`I^;}i
z?)Q{5O>W@4Hv5i&Syy)1eCtIsPqNxfI^^B>t?Sd>Ir2Rj&n`z#5pj6B&mv^5OBT<?
zt_z;p#aXMb%B8D>ZqYcue&Y=OOyzB>v(MhXHUG%BJKq%9uOwz2QBHAc{T9^nQgwAh
z#e;1OtA&r<6}T_@$-r3e(hnv+Ev|lzT?@Y|SZxeS5RQ)h^tt2B($=6q6Q>%_R-GNT
zy!#*5g-sdmXIGXwJa7BQH|cIn_WNySizVlL*PP2V^~_xf{pg1lQ>r@sXVss*x|~mJ
z`K$VKzdG{{r`FtD`}W*!<`Xv2l~=tVWw|iUnf&Y6rbvduljfNd)a?>aq;|A&K0Gv!
z!RWfFtCUsFf!_`P%#T?qF5%QVsFmjNSb6q+iHIcGocK!*3?0?CAN}uia9bI#?@XmG
z8GgNKM?bvbN#HH*KeEE_Xzr_({9Z>BBx0N5=dR*S)ZNbdSuF3_mkXs1udG^U>}jcb
zZrJ?fT}0OQ8QPzlR+i3Rd8E4Vthb2h!%ul3Zb8eEFYoyq{)vI5u{T#-YF9z>w<~8%
zugag?plJT(Q@E_B{U4s#_PGpoy%Li-^OWB1d6V>Ujmpe^*SPOSv1;k_^wJ(@tZg@%
z?s@20`{Kt5`$Ns<a+c=?@jYeJEcht8?Rwy+6E@twi*+-8PUG2EoxNM5aG^)4a+I6N
zMt=?MDE{@kzV2K!QPAOW5{I8&n#7(tL8lM-HOq*I?{(R^yE)1Eea4f2igPPnO&5O4
zd-2h)DE{c{*`JqfE-akf`&aUs!9tf=Lcx6Rc81AwR15OfoRkxs&6@JDKF~h5a;0R3
U|I*^y=KK4M{vY^#!1;p=03~Qm3;+NC