From 4aa17b4a027b96abf184b9a7833c7ae71a6fed64 Mon Sep 17 00:00:00 2001
From: Natsu Kagami <nki@nkagami.me>
Date: Wed, 9 Apr 2025 02:18:32 +0200
Subject: [PATCH] Run deluge with vpn

---
 nki-home/configuration.nix |  1 +
 nki-home/deluge.nix        | 96 ++++++++++++++++++++++++++++++++++++++
 nki-home/secrets.yaml      |  5 +-
 3 files changed, 100 insertions(+), 2 deletions(-)
 create mode 100644 nki-home/deluge.nix

diff --git a/nki-home/configuration.nix b/nki-home/configuration.nix
index 9fe4547..1304d3d 100644
--- a/nki-home/configuration.nix
+++ b/nki-home/configuration.nix
@@ -33,6 +33,7 @@ in
     # Other services
     ../modules/personal/u2f.nix
     ./peertube-runner.nix
+    ./deluge.nix
     openrazer
   ];
 
diff --git a/nki-home/deluge.nix b/nki-home/deluge.nix
new file mode 100644
index 0000000..a76739c
--- /dev/null
+++ b/nki-home/deluge.nix
@@ -0,0 +1,96 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  wg = "wgdeluge";
+  webui-port = "58846";
+in
+{
+  services.deluge = {
+    enable = true;
+    web.enable = true;
+  };
+
+  sops.secrets."wg-deluge.conf" = {
+    owner = "root";
+    mode = "0400";
+    reloadUnits = [ "${wg}.service" ];
+  };
+  # setting up wireguard interface within network namespace
+  systemd.services.${wg} =
+    let
+      ip = lib.getExe' pkgs.iproute2 "ip";
+      wireguard = lib.getExe pkgs.wireguard-tools;
+    in
+    {
+      description = "WireGuard network interface for Deluge";
+      bindsTo = [ "netns@${wg}.service" ];
+      requires = [ "network-online.target" ];
+      after = [ "netns@${wg}.service" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStart = pkgs.writers.writeBash "wg-up" ''
+          set -e
+          ${ip} link add ${wg} type wireguard
+          ${ip} link set ${wg} netns ${wg}
+          ${ip} -n ${wg} address add "100.123.50.189/32" dev ${wg}
+          ${ip} netns exec ${wg} \
+            ${wireguard} setconf ${wg} ${config.sops.secrets."wg-deluge.conf".path}
+          ${ip} -n ${wg} link set ${wg} up
+          # need to set lo up as network namespace is started with lo down
+          ${ip} -n ${wg} link set lo up
+          ${ip} -n ${wg} route add default dev ${wg}
+          # ${ip} -n ${wg} -6 route add default dev ${wg}
+        '';
+        ExecStop = pkgs.writers.writeBash "wg-down" ''
+          ${ip} -n ${wg} route del default dev ${wg}
+          # ${ip} -n ${wg} -6 route del default dev ${wg}
+          ${ip} -n ${wg} link del ${wg}
+          ${ip} link del ${wg}
+        '';
+      };
+    };
+
+  # binding deluged to network namespace
+  systemd.services.deluged.bindsTo = [ "netns@${wg}.service" ];
+  systemd.services.deluged.requires = [
+    "network-online.target"
+    "${wg}.service"
+  ];
+  systemd.services.deluged.serviceConfig.NetworkNamespacePath = [ "/var/run/netns/${wg}" ];
+
+  # allowing delugeweb to access deluged in network namespace, a socket is necesarry
+  systemd.sockets."proxy-to-deluged" = {
+    enable = true;
+    description = "Socket for Proxy to Deluge Daemon";
+    listenStreams = [ "${webui-port}" ];
+    wantedBy = [ "sockets.target" ];
+  };
+
+  # creating proxy service on socket, which forwards the same port from the root namespace to the isolated namespace
+  systemd.services."proxy-to-deluged" = {
+    enable = true;
+    description = "Proxy to Deluge Daemon in Network Namespace";
+    requires = [
+      "deluged.service"
+      "proxy-to-deluged.socket"
+    ];
+    after = [
+      "deluged.service"
+      "proxy-to-deluged.socket"
+    ];
+    unitConfig = {
+      JoinsNamespaceOf = "deluged.service";
+    };
+    serviceConfig = {
+      User = "deluge";
+      Group = "deluge";
+      ExecStart = "${pkgs.systemd}/lib/systemd/systemd-socket-proxyd --exit-idle-time=5min 127.0.0.1:${webui-port}";
+      PrivateNetwork = "yes";
+    };
+  };
+}
diff --git a/nki-home/secrets.yaml b/nki-home/secrets.yaml
index 03845ac..648220d 100644
--- a/nki-home/secrets.yaml
+++ b/nki-home/secrets.yaml
@@ -17,6 +17,7 @@ nix-cache:
     private-key: ENC[AES256_GCM,data:4sbfIQb10Y50CrZbgjN+1iXEbXTpDqMbIB/yA3WlaAqhLtb8HKib5aZX3DLoxFbVihJcztQsvBBgEAhT9iMijoksaT9qzBQ5yIn4NGCfFem1DK8DQdjhTLMCVTyMFCT7hQHu/2Sd7w==,iv:zTSxuKOtOLekOBKBvl9MScD/Bo1Hviqq/n8Saa+1Cgo=,tag:fx73fCDPY9d07V3KKMw3DA==,type:str]
 nix-build-farm:
     private-key: ENC[AES256_GCM,data:m5neeWCEdaZ1MRhNwTptfDIgv3ABNlYyNil3oTD81Jbe/6WxWaS5Q++CRlHCjc2hOoHsWsZixw8iGZVTA+QXgH6B9C6A4oOAhgR9m92EGTEfFw0qxQbdzs7U98Yonx/N8SApUycZZB/EU81+MrDNY4GGzCiO6s00/vZLkDTYnqRFgbo+8KTG0BQTl4q+VYP2q3l0wy+Ivz5CWPmbz42Xdin/sBnjeFHKDuof4iZZnN3i8gUJ/mMw3lbdiHd6A8DL0G5Ut46ljzMC2aMsZOATCID3mPOPgI0xIetDofPJLDqVsNqptRHo8WB+KwDidvl222f5F7JqdSqgAMOJYPscrX0odufApiJfg5bbXBygvrDfAlPSruW7GsWGoKAhw0qC4NC/j+qYCwhS0qdorCLnIy3zzMtA6HkHtE675hy7/7oLj7k9Y8MhE4PxztjXTmDazaVCtKhnA/DpaxP2mH84gfCkJFD1YF9jtPm+P3e+46FwkW+WnHaA2L+H7Evava30DLEBhh5y9Gd1A3JN4isn,iv:7KUWg7+GWgmGJkbIvsy9gtccZBb+1Y5uDWhXQFk0obk=,tag:qJdM684XPHxecLVxVb5pgw==,type:str]
+wg-deluge.conf: ENC[AES256_GCM,data:CjCqgC1458C6odMtcWigE9tZwci4bJYyk+2fVTpP2OnHYwAp38bt0TbBLwgytMqKfB5EpJZLdbeTSoL33MhT2MD4gWBuDH1++p59l9213LS+9mF6gxG/RksrnnLvz9Pnk5J19qOz1PDxm6t8ZF2qu5qAHY83CF+k32G04/p2Nl04bDllAmMUlGGHJ5TXvXCSRcNU/2tWYv/sC4SwfUfpMjRbSKJUQSTEXnQsPaKsf+fq3mhj1a/xT6zJ6sxwDAGQ3PwIY8xTDf5ucS9ULPO9Zn27NUBoFmS1g0fJd+ZCJJYIWkG2uYDf+ldu/Ag95BduHX7Juf3GolhVd24hZzaIq3LeME99+T3SYA4LBkAaASnBvrVOXmFavHPKhFfbZ1DG0mO7S2M+Ticz+dUktjTXCh/Fe4uwf2R82PieuPhNng==,iv:AKleoSHG6qKEMJ7vIFsQ+X7d/jaXt+d0kg3LnbeWrRc=,tag:zrtqRIxEBbpSh9Ryj8cwqw==,type:str]
 sops:
     age:
         - recipient: age1tt0peqg8zdfh74m5sdgwsczcqh036nhgmwvkqnvywll88uvmm9xs433rhm
@@ -46,7 +47,7 @@ sops:
             bUhIT0Z2b1dVWGNyS1hRVFRyZTA4d00KchP7EhSOMwBl5vFuuskzosRoi8jUu1sw
             hVjJNF2a40ewgkQgVAoWEzirHbknbQORzmepDDRth7Bve3UQU64+GA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-04-08T22:40:34Z"
-    mac: ENC[AES256_GCM,data:gjSk/mb+u53YmkvCv+ISIyxtH3FRVltAMkhnE4JDp61BG+Bhy+wGRYNi/W3OTGWIlyWQlAIgej8jPbWY8hXfOioB/VOLqpRJVSDLZ93zelJXCmNoJLaTW8xz7fWE9QUEYDeNpSlbDBotxBMSNriqtCPgtb6ze7qsWuws8OpxspU=,iv:n2pBBRoEsuJStBlD2dsYNP7DgukRJEf9FnuG39AwbjU=,tag:4Rg1oEjIU541Y9yBpAYssw==,type:str]
+    lastmodified: "2025-04-08T23:20:49Z"
+    mac: ENC[AES256_GCM,data:4RANoPaf4TCLkkTkY/UyOCLWKVL6o5N+bSXbNCoQLoI5hI5oW6zgPnvEKtERhJiKNttEoPStb68dt8/DRZ6enpi6h/DP+kNm7wCCT0atMnfKUXz1Hco6ixub9cyT1wpRxjU0O5EPmYSDRYTayOBOqvXzns+OpVFGMcskUAeroL8=,iv:JHMW8tsydX2k39SPqbFfyash4k8juTCi8DtufA8lL/s=,tag:lTQc62Y4nDEErT/TbL+Hbg==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.10.1