Refactor nftables, vpn and transmission configuration

vars/jellyfin.yml

@@ -1,3 +0,0 @@
-jellyfin_http_port: 8096
-jellyfin_service_port: 1900
-jellyfin_client_port: 7359

vars/network.yml

@@ -4,31 +4,61 @@ network_mac: '00:1b:21:3b:50:e2'
 lan_ip: '192.168.2.1'
 lan_gateway: '192.168.2.254'
 lan_dns: '192.168.2.254'
+lan_prefix: 24
 domain_name: 'fudiggity.nl'
 
 http_port: 80
 https_port: 443
 ssh_port: 39901
 
+vpn_listen_address: '10.0.0.1'
+vpn_prefix: 24
+vpn_subnet: '10.0.0.0/{{ vpn_prefix }}'
+vpn_port: 51902
+vpn_interface: 'wg0'
+vpn_domain: 'vpn.{{ domain_name }}'
+
+vpn_media_listen_address: '10.0.1.1'
+vpn_media_prefix: 24
+vpn_media_subnet: '10.0.1.0/{{ vpn_media_prefix }}'
+vpn_media_port: 51903
+vpn_media_interface: 'wg1'
+vpn_media_domain: 'media-vpn.{{ domain_name }}'
+
 mpd_port: 21000
 mpd_http_stream_port: 8000
 mpd_http_mobile_stream_port: 8001
 
 forgejo_ip: '127.0.0.1'
-forgejo_port: '3000'
-forgejo_ssh_port: '22'
+forgejo_port: 3000
+forgejo_ssh_port: 22
+forgejo_domain: 'forgejo.fudiggity.nl'
 
 woodpecker_ip: '127.0.0.1'
-woodpecker_port: '7000'
+woodpecker_port: 7000
+woodpecker_domain: 'woodpecker.fudiggity.nl'
 
 newsreader_ip: '127.0.0.1'
-newsreader_port: '5000'
+newsreader_port: 5000
+newsreader_domain: 'rss.fudiggity.nl'
 
 glitchtip_ip: '127.0.0.1'
-glitchtip_port: '7200'
+glitchtip_port: 7200
+glitchtip_domain: 'glitchtip.fudiggity.nl'
 
 syncthing_gui_port: 8384
 syncthing_protocol_port: 22000
 
 radicale_listen_addres: '127.0.0.1'
 radicale_port: 5232
+
+transmission_domain: 'transmission.{{ domain_name }}'
+transmission_prefix: 24
+transmission_subnet: '172.16.238.0/{{ transmission_prefix }}'
+transmission_web_port: 9091
+transmission_peer_port: 51413
+transmission_nginx_ip: '172.16.238.10'
+
+jellyfin_http_port: 8096
+jellyfin_service_port: 1900
+jellyfin_client_port: 7359

vars/nginx.yml

@@ -1,4 +0,0 @@
-forgejo_domain: 'forgejo.fudiggity.nl'
-woodpecker_domain: 'woodpecker.fudiggity.nl'
-glitchtip_domain: 'glitchtip.fudiggity.nl'
-newsreader_domain: 'rss.fudiggity.nl'

vars/transmission.yml

@@ -1,5 +1,5 @@
-transmission_port: 50409
-transmission_web_port: 9091
-transmission_download_folder: '/home/sonny/downloads'
-transmission_incomplete_folder: '/home/sonny/downloads/Incompleet'
+transmission_app_dir: '/srv/docker/tranmission'
+transmission_download_dir: '/home/sonny/downloads'
+transmission_incomplete_dir: '/home/sonny/downloads/incomplete_downloads'
+
 transmission_ratelimit_ratio: 2

vars/vpn.yml

@@ -1,12 +1,3 @@
-vpn_listen_address: '10.0.0.1'
-vpn_domain: 'vpn.{{ domain_name }}'
-vpn_subnet: '24'
-vpn_port: '51902'
-vpn_interface: 'wg0'
-
-vpn_source_range: '10.0.0.0/24'
-vpn_destination_range: '10.0.0.1/32'
-
 vpn_server_public_key_path: '{{ vpn_config_dir }}/keys/public/server.pub'
 vpn_server_public_key_source_path: 'files/wireguard/default/server.pub'
 vpn_server_key_path: '{{ vpn_config_dir }}/keys/private/server.key'
@@ -19,13 +10,19 @@ vpn_peers:
     public_key: 'EbWLf2+7x/RymeeiVuX72nZOBqPvdhu2V9pYhszpQEw='
     preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-laptop.psk'
     preshared_key_source_path: 'files/wireguard/default/preshared-laptop.psk'
+
   desktop:
     ip: '10.0.0.3'
     public_key: 'izHzmRwh2yzICps6pFI2Bg3TnmTD66/8uH4loJpkuD4='
     preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-desktop.psk'
     preshared_key_source_path: 'files/wireguard/default/preshared-desktop.psk'
+
+  # has extra key to generate mobile configuration file
   mobile:
     ip: '10.0.0.4'
+    allowed_ips:
+      - '{{ vpn_subnet }}'
+      - '{{ transmission_subnet }}'
     public_key: '4aBHRiglCOE7qEDLqeFgQ5PMMsKczpPoL4bx4jyAEDY='
     preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-mobile.psk'
     preshared_key_source_path: 'files/wireguard/default/preshared-mobile.psk'

vars/vpn_media.yml

@@ -1,12 +1,3 @@
-vpn_media_listen_address: '10.0.1.1'
-vpn_media_domain: 'media-vpn.{{ domain_name }}'
-vpn_media_subnet: '24'
-vpn_media_port: '51903'
-vpn_media_interface: 'wg1'
-
-vpn_media_source_range: '10.0.1.0/24'
-vpn_media_destination_range: '10.0.1.1/32'
-
 vpn_media_server_public_key_path: '{{ vpn_config_dir }}/keys/public/media_server.pub'
 vpn_media_server_public_key_source_path: 'files/wireguard/media/server.pub'
 vpn_media_server_key_path: '{{ vpn_config_dir }}/keys/private/media_server.key'
@@ -19,25 +10,35 @@ vpn_media_peers:
     public_key: 'hI4rqlv2afs4RJkt5xR+dYxQODSd6lR0OqWJRlnQdjM='
     preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-media-laptop.psk'
     preshared_key_source_path: 'files/wireguard/media/preshared-laptop.psk'
+
   desktop:
     ip: '10.0.1.3'
     public_key: 'YDH5lZcxUHM4AU2ZxQrFqjDIV2Z7PSUQKMcYXLExV0E='
     preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-media-desktop.psk'
     preshared_key_source_path: 'files/wireguard/media/preshared-desktop.psk'
+
   mobile_peer_1:
     ip: '10.0.1.4'
+    allowed_ips:
+      - '{{ vpn_media_subnet }}'
     public_key: '6fj8FXvzT0IUlZLJjQ/+FhwwRDsJeQsUFHqKQcyXdwQ='
     preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-media-mobile-1.psk'
     preshared_key_source_path: 'files/wireguard/media/preshared-mobile-1.psk'
     private_key_source_path: 'files/wireguard/media/mobile-1.key'
+
   mobile_peer_2:
     ip: '10.0.1.5'
+    allowed_ips:
+      - '{{ vpn_media_subnet }}'
     public_key: 'w/pswNrAYFdEUoaLk3zSqOu4gg2s41BBCN02E//ai1c='
     preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-media-mobile-2.psk'
     preshared_key_source_path: 'files/wireguard/media/preshared-mobile-2.psk'
     private_key_source_path: 'files/wireguard/media/mobile-2.key'
+
   tv:
     ip: '10.0.1.6'
+    allowed_ips:
+      - '{{ vpn_media_subnet }}'
     public_key: '5+yz9C9PhaLhsvAZ1e3mDsTQpMZVrPZnSQa6ERJIKU0='
     preshared_key_path: '{{ vpn_config_dir }}/keys/private/preshared-media-tv.psk'
     preshared_key_source_path: 'files/wireguard/media/preshared-tv.psk'