dedupe

common/network/pia-vpn/default.nix

@@ -51,6 +51,15 @@ let
       receiveForwardedPort = mkOption {
         type = types.nullOr (types.submodule {
           options = {
+            port = mkOption {
+              type = types.nullOr types.port;
+              default = null;
+              description = ''
+                Target port to forward to. If null, forwards to the same PIA-assigned port.
+                PIA-assigned ports below 10000 are rejected to avoid accidentally
+                forwarding traffic to other services.
+              '';
+            };
             protocol = mkOption {
               type = types.enum [ "tcp" "udp" "both" ];
               default = "both";

common/network/pia-vpn/scripts.nix

@@ -135,6 +135,17 @@ in
       echo "Loaded server info from $serverFile: $WG_HOSTNAME ($WG_SERVER_IP:$WG_SERVER_PORT)"
     }
 
+    # Reset WG interface and tear down NAT/forwarding rules.
+    # Called on startup (clear stale state) and on exit via trap.
+    cleanupVpn() {
+      local interfaceName=$1
+      wg set "$interfaceName" listen-port 0 2>/dev/null || true
+      ip -4 address flush dev "$interfaceName" 2>/dev/null || true
+      ip route del default dev "$interfaceName" 2>/dev/null || true
+      iptables -t nat -F 2>/dev/null || true
+      iptables -F FORWARD 2>/dev/null || true
+    }
+
     connectToServer() {
       local wgFile=$1
       local interfaceName=$2

common/network/pia-vpn/vpn-container.nix

@@ -24,15 +24,17 @@ let
     let
       fwd = forwardingContainer.receiveForwardedPort;
       targetIp = forwardingContainer.ip;
+      dnatTarget = if fwd.port != null then "${targetIp}:${toString fwd.port}" else targetIp;
+      targetPort = if fwd.port != null then toString fwd.port else "$PORT";
       tcpRules = optionalString (fwd.protocol == "tcp" || fwd.protocol == "both") ''
-        echo "Setting up TCP DNAT: port $PORT → ${targetIp}:$PORT"
-        iptables -t nat -A PREROUTING -i ${cfg.interfaceName} -p tcp --dport $PORT -j DNAT --to ${targetIp}
-        iptables -A FORWARD -i ${cfg.interfaceName} -d ${targetIp} -p tcp --dport $PORT -j ACCEPT
+        echo "Setting up TCP DNAT: port $PORT → ${targetIp}:${targetPort}"
+        iptables -t nat -A PREROUTING -i ${cfg.interfaceName} -p tcp --dport $PORT -j DNAT --to ${dnatTarget}
+        iptables -A FORWARD -i ${cfg.interfaceName} -d ${targetIp} -p tcp --dport ${targetPort} -j ACCEPT
       '';
       udpRules = optionalString (fwd.protocol == "udp" || fwd.protocol == "both") ''
-        echo "Setting up UDP DNAT: port $PORT → ${targetIp}:$PORT"
-        iptables -t nat -A PREROUTING -i ${cfg.interfaceName} -p udp --dport $PORT -j DNAT --to ${targetIp}
-        iptables -A FORWARD -i ${cfg.interfaceName} -d ${targetIp} -p udp --dport $PORT -j ACCEPT
+        echo "Setting up UDP DNAT: port $PORT → ${targetIp}:${targetPort}"
+        iptables -t nat -A PREROUTING -i ${cfg.interfaceName} -p udp --dport $PORT -j DNAT --to ${dnatTarget}
+        iptables -A FORWARD -i ${cfg.interfaceName} -d ${targetIp} -p udp --dport ${targetPort} -j ACCEPT
       '';
       onPortForwarded = optionalString (forwardingContainer.onPortForwarded != null) ''
         TARGET_IP="${targetIp}"
@@ -42,8 +44,8 @@ let
       '';
     in
     ''
-      if [ "$PORT" -lt 1000 ]; then
-        echo "ERROR: PIA assigned privileged port $PORT (< 1000), refusing to set up DNAT" >&2
+      if [ "$PORT" -lt 10000 ]; then
+        echo "ERROR: PIA assigned low port $PORT (< 10000), refusing to set up DNAT" >&2
       else
         ${tcpRules}
         ${udpRules}
@@ -139,12 +141,8 @@ in
               set -euo pipefail
               ${scripts.scriptCommon}
 
-              # Clean up stale state from previous attempts
-              wg set ${cfg.interfaceName} listen-port 0 2>/dev/null || true
-              ip -4 address flush dev ${cfg.interfaceName} 2>/dev/null || true
-              ip route del default dev ${cfg.interfaceName} 2>/dev/null || true
-              iptables -t nat -F 2>/dev/null || true
-              iptables -F FORWARD 2>/dev/null || true
+              trap 'cleanupVpn ${cfg.interfaceName}' EXIT
+              cleanupVpn ${cfg.interfaceName}
 
               proxy="${proxy}"
 
@@ -198,16 +196,6 @@ in
               exec sleep infinity
             '';
 
-            preStop = ''
-              echo "Tearing down PIA VPN..."
-              ip -4 address flush dev ${cfg.interfaceName} 2>/dev/null || true
-              ip route del default dev ${cfg.interfaceName} 2>/dev/null || true
-              iptables -t nat -F POSTROUTING 2>/dev/null || true
-              iptables -F FORWARD 2>/dev/null || true
-              ${optionalString portForwarding ''
-                iptables -t nat -F PREROUTING 2>/dev/null || true
-              ''}
-            '';
           };
 
           # Port refresh timer (every 10 min) — keeps PIA port forwarding alive

machines/storage/s0/default.nix

@@ -67,13 +67,13 @@
       onPortForwarded = ''
         # Notify Transmission of the PIA-assigned peer port via RPC
         for i in $(seq 1 30); do
-          curlout=$(curl -s "http://$TARGET_IP:80/transmission/rpc" 2>/dev/null) && break
+          curlout=$(curl -s "http://transmission.containers:8080/transmission/rpc" 2>/dev/null) && break
           sleep 2
         done
         regex='X-Transmission-Session-Id: (\w*)'
         if [[ $curlout =~ $regex ]]; then
           sessionId=''${BASH_REMATCH[1]}
-          curl -s "http://$TARGET_IP:80/transmission/rpc" \
+          curl -s "http://transmission.containers:8080/transmission/rpc" \
             -d "{\"method\":\"session-set\",\"arguments\":{\"peer-port\":$PORT}}" \
             -H "X-Transmission-Session-Id: $sessionId"
         fi
@@ -91,7 +91,7 @@
             "incomplete-dir-enabled" = true;
 
             "rpc-enabled" = true;
-            "rpc-port" = 80;
+            "rpc-port" = 8080;
             "rpc-bind-address" = "0.0.0.0";
             "rpc-whitelist" = "127.0.0.1,10.100.*.*,192.168.*.*";
             "rpc-host-whitelist-enabled" = false;
@@ -232,7 +232,7 @@
         (mkVirtualHost "lidarr.s0.neet.dev" "http://servarr.containers:8686")
         (mkVirtualHost "sonarr.s0.neet.dev" "http://servarr.containers:8989")
         (mkVirtualHost "prowlarr.s0.neet.dev" "http://servarr.containers:9696")
-        (mkVirtualHost "transmission.s0.neet.dev" "http://transmission.containers:80")
+        (mkVirtualHost "transmission.s0.neet.dev" "http://transmission.containers:8080")
         (mkVirtualHost "unifi.s0.neet.dev" "https://localhost:8443")
         (mkVirtualHost "music.s0.neet.dev" "http://localhost:4533")
         (mkVirtualHost "jellyfin.s0.neet.dev" "http://localhost:8096")