Set up dl jail

15 files changed, 513 insertions, 2 deletions

diff --git a/.gitignore b/.gitignore
index b24fdbd..7ed2a4c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@
 secrets.yml
 vm/
 __pycache__/
+mullvad_wireguard_*.zip
diff --git a/roles/host/templates/etc_rc.conf.j2 b/roles/host/templates/etc_rc.conf.j2
index 7cdf65e..b343df0 100644
--- a/roles/host/templates/etc_rc.conf.j2
+++ b/roles/host/templates/etc_rc.conf.j2
@@ -46,5 +46,5 @@ vm_list="alpine0"
 vm_delay="5"
 kld_list="pf if_wg i915kms"
 {% else %}
-kld_list="pf"
+kld_list="pf if_wg"
 {% endif %}
diff --git a/roles/jails/16_dl/defaults/main.yml b/roles/jails/16_dl/defaults/main.yml
index c296953..481f414 100644
--- a/roles/jails/16_dl/defaults/main.yml
+++ b/roles/jails/16_dl/defaults/main.yml
@@ -1,6 +1,5 @@
 userland: "15.0-RELEASE"
 devfs_ruleset: 4
-no_default_route: true
 
 jail_conf_options:
   - "allow.raw_sockets"
@@ -9,3 +8,42 @@ jail_conf_options:
 nullfs:
   - src: /usr/local/jails/volumes/storage
     dst: /mnt/storage
+
+zfs:
+  - name: zroot/jails/volumes/dl_sonarr
+    mountpoint: /usr/local/sonarr
+  - name: zroot/jails/volumes/dl_radarr
+    mountpoint: /usr/local/radarr
+  - name: zroot/jails/volumes/dl_lidarr
+    mountpoint: /usr/local/lidarr
+  - name: zroot/jails/volumes/dl_prowlarr
+    mountpoint: /usr/local/prowlarr
+
+pkg:
+  - transmission-daemon
+  - transmission-web
+  - transmission-cli
+  - nzbget
+  - yt-dlp
+  - sonarr
+  - radarr
+  - lidarr
+  - prowlarr
+  - ffmpeg
+  - unrar
+  - wireguard-tools
+  - git
+  - bash
+  - shntool
+  - cuetools
+  - vorbisgain
+  - flac
+
+services:
+  - wg_random_tunnel
+  - transmission
+  - nzbget
+  - prowlarr
+  - sonarr
+  - radarr
+  - lidarr
diff --git a/roles/jails/16_dl/handlers/main.yml b/roles/jails/16_dl/handlers/main.yml
new file mode 100644
index 0000000..f977eb1
--- /dev/null
+++ b/roles/jails/16_dl/handlers/main.yml
@@ -0,0 +1,2 @@
+- name: Restart wireguard
+  shell: /usr/local/bin/wg_random_tunnel
diff --git a/roles/jails/16_dl/tasks/main.yml b/roles/jails/16_dl/tasks/main.yml
index 2abdaff..b187447 100644
--- a/roles/jails/16_dl/tasks/main.yml
+++ b/roles/jails/16_dl/tasks/main.yml
@@ -1,2 +1,107 @@
 - import_role:
     name: jail
+    tasks_from: jail_setup
+
+- name: Configure transmission download directory
+  community.general.sysrc:
+    name: transmission_download_dir
+    value: /mnt/storage/downloads/complete
+
+- name: Deploy initial transmission settings
+  template:
+    src: "{{ jail_role_dir }}/templates/transmission_settings.json.j2"
+    dest: /usr/local/etc/transmission/home/settings.json
+    owner: root
+    group: wheel
+    mode: "0644"
+    #force: false
+
+- name: Deploy initial nzbget config
+  template:
+    src: "{{ jail_role_dir }}/templates/nzbget.conf.j2"
+    dest: /usr/local/share/nzbget/nzbget.conf
+    owner: root
+    group: wheel
+    mode: "0644"
+    force: false
+
+- name: Deploy initial prowlarr config
+  template:
+    src: "{{ jail_role_dir }}/templates/prowlarr_config.xml.j2"
+    dest: /usr/local/prowlarr/config.xml
+    owner: root
+    group: wheel
+    mode: "0644"
+    force: false
+
+- name: Deploy initial sonarr config
+  template:
+    src: "{{ jail_role_dir }}/templates/sonarr_config.xml.j2"
+    dest: /usr/local/sonarr/config.xml
+    owner: root
+    group: wheel
+    mode: "0644"
+    force: false
+
+- name: Deploy initial radarr config
+  template:
+    src: "{{ jail_role_dir }}/templates/radarr_config.xml.j2"
+    dest: /usr/local/radarr/config.xml
+    owner: root
+    group: wheel
+    mode: "0644"
+    force: false
+
+- name: Deploy initial lidarr config
+  template:
+    src: "{{ jail_role_dir }}/templates/lidarr_config.xml.j2"
+    dest: /usr/local/lidarr/config.xml
+    owner: root
+    group: wheel
+    mode: "0644"
+    force: false
+
+- name: Create wireguard config directory
+  file:
+    path: /usr/local/etc/wireguard
+    state: directory
+    owner: root
+    group: wheel
+    mode: "0700"
+
+- name: Deploy wireguard configs
+  unarchive:
+    src: "{{ jail_role_dir }}/files/mullvad_wireguard_linux_all_all.zip"
+    dest: /usr/local/etc/wireguard
+    owner: root
+    group: wheel
+    mode: "0600"
+    creates: /usr/local/etc/wireguard/mullvad-fi1.conf
+
+- name: Deploy wg_random_tunnel script
+  template:
+    src: "{{ jail_role_dir }}/templates/wg_random_tunnel.j2"
+    dest: /usr/local/bin/wg_random_tunnel
+    owner: root
+    group: wheel
+    mode: "0755"
+
+- name: Deploy wg_random_tunnel rc.d script
+  template:
+    src: "{{ jail_role_dir }}/templates/usr_local_etc_rc.d_wg_random_tunnel"
+    dest: /usr/local/etc/rc.d/wg_random_tunnel
+    owner: root
+    group: wheel
+    mode: "0755"
+
+- name: Deploy crontab
+  template:
+    src: "{{ jail_role_dir }}/templates/etc_crontab.j2"
+    dest: /etc/crontab
+    owner: root
+    group: wheel
+    mode: "0644"
+
+- import_role:
+    name: jail
+    tasks_from: jail_launch
diff --git a/roles/jails/16_dl/templates/etc_crontab.j2 b/roles/jails/16_dl/templates/etc_crontab.j2
new file mode 100644
index 0000000..1faae3d
--- /dev/null
+++ b/roles/jails/16_dl/templates/etc_crontab.j2
@@ -0,0 +1,5 @@
+SHELL=/bin/sh
+PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
+
+# Change tunnel every hour
+0	*	*	*	*	root	/usr/local/bin/wg_random_tunnel >> /var/log/random_tunnel.log 2>&1
diff --git a/roles/jails/16_dl/templates/lidarr_config.xml.j2 b/roles/jails/16_dl/templates/lidarr_config.xml.j2
new file mode 100644
index 0000000..a0d89ea
--- /dev/null
+++ b/roles/jails/16_dl/templates/lidarr_config.xml.j2
@@ -0,0 +1,17 @@
+<Config>
+  <BindAddress>0.0.0.0</BindAddress>
+  <Port>8686</Port>
+  <SslPort>6868</SslPort>
+  <EnableSsl>False</EnableSsl>
+  <LaunchBrowser>False</LaunchBrowser>
+  <ApiKey>{{ dl.lidarr_api_key }}</ApiKey>
+  <AuthenticationMethod>Forms</AuthenticationMethod>
+  <AuthenticationRequired>DisabledForLocalAddresses</AuthenticationRequired>
+  <Branch>master</Branch>
+  <LogLevel>info</LogLevel>
+  <SslCertPath></SslCertPath>
+  <SslCertPassword></SslCertPassword>
+  <UrlBase></UrlBase>
+  <InstanceName>Lidarr</InstanceName>
+  <UpdateMechanism>External</UpdateMechanism>
+</Config>
diff --git a/roles/jails/16_dl/templates/nzbget.conf.j2 b/roles/jails/16_dl/templates/nzbget.conf.j2
new file mode 100644
index 0000000..754e56f
--- /dev/null
+++ b/roles/jails/16_dl/templates/nzbget.conf.j2
@@ -0,0 +1,10 @@
+MainDir=/var/db/nzbget
+DestDir=/mnt/storage/downloads
+InterDir=/var/db/nzbget/tmp
+WebDir=/usr/local/share/nzbget/webui
+ConfigTemplate=/usr/local/share/nzbget/nzbget.template.conf
+LockFile=/var/db/nzbget/nzbget.lock
+LogFile=/var/db/nzbget/nzbget.log
+ControlIP=0.0.0.0
+ControlPort=6789
+AuthorizedIP=10.0.0.0/8,192.168.0.0/16
diff --git a/roles/jails/16_dl/templates/prowlarr_config.xml.j2 b/roles/jails/16_dl/templates/prowlarr_config.xml.j2
new file mode 100644
index 0000000..391dbf2
--- /dev/null
+++ b/roles/jails/16_dl/templates/prowlarr_config.xml.j2
@@ -0,0 +1,17 @@
+<Config>
+  <BindAddress>0.0.0.0</BindAddress>
+  <Port>9696</Port>
+  <SslPort>6969</SslPort>
+  <EnableSsl>False</EnableSsl>
+  <LaunchBrowser>False</LaunchBrowser>
+  <ApiKey>{{ dl.prowlarr_api_key }}</ApiKey>
+  <AuthenticationMethod>Forms</AuthenticationMethod>
+  <AuthenticationRequired>DisabledForLocalAddresses</AuthenticationRequired>
+  <Branch>master</Branch>
+  <LogLevel>info</LogLevel>
+  <SslCertPath></SslCertPath>
+  <SslCertPassword></SslCertPassword>
+  <UrlBase></UrlBase>
+  <InstanceName>Prowlarr</InstanceName>
+  <UpdateMechanism>External</UpdateMechanism>
+</Config>
diff --git a/roles/jails/16_dl/templates/radarr_config.xml.j2 b/roles/jails/16_dl/templates/radarr_config.xml.j2
new file mode 100644
index 0000000..d336ea2
--- /dev/null
+++ b/roles/jails/16_dl/templates/radarr_config.xml.j2
@@ -0,0 +1,17 @@
+<Config>
+  <BindAddress>0.0.0.0</BindAddress>
+  <Port>7878</Port>
+  <SslPort>9898</SslPort>
+  <EnableSsl>False</EnableSsl>
+  <LaunchBrowser>False</LaunchBrowser>
+  <ApiKey>{{ dl.radarr_api_key }}</ApiKey>
+  <AuthenticationMethod>Forms</AuthenticationMethod>
+  <AuthenticationRequired>DisabledForLocalAddresses</AuthenticationRequired>
+  <Branch>master</Branch>
+  <LogLevel>info</LogLevel>
+  <SslCertPath></SslCertPath>
+  <SslCertPassword></SslCertPassword>
+  <UrlBase></UrlBase>
+  <InstanceName>Radarr</InstanceName>
+  <UpdateMechanism>External</UpdateMechanism>
+</Config>
diff --git a/roles/jails/16_dl/templates/sonarr_config.xml.j2 b/roles/jails/16_dl/templates/sonarr_config.xml.j2
new file mode 100644
index 0000000..a1b35e1
--- /dev/null
+++ b/roles/jails/16_dl/templates/sonarr_config.xml.j2
@@ -0,0 +1,17 @@
+<Config>
+  <BindAddress>0.0.0.0</BindAddress>
+  <Port>8989</Port>
+  <SslPort>9898</SslPort>
+  <EnableSsl>False</EnableSsl>
+  <LaunchBrowser>False</LaunchBrowser>
+  <ApiKey>{{ dl.sonarr_api_key }}</ApiKey>
+  <AuthenticationMethod>Forms</AuthenticationMethod>
+  <AuthenticationRequired>DisabledForLocalAddresses</AuthenticationRequired>
+  <Branch>main</Branch>
+  <LogLevel>info</LogLevel>
+  <SslCertPath></SslCertPath>
+  <SslCertPassword></SslCertPassword>
+  <UrlBase></UrlBase>
+  <InstanceName>Sonarr</InstanceName>
+  <UpdateMechanism>External</UpdateMechanism>
+</Config>
diff --git a/roles/jails/16_dl/templates/transmission_settings.json.j2 b/roles/jails/16_dl/templates/transmission_settings.json.j2
new file mode 100644
index 0000000..72b396e
--- /dev/null
+++ b/roles/jails/16_dl/templates/transmission_settings.json.j2
@@ -0,0 +1,80 @@
+{
+    "alt-speed-down": 50,
+    "alt-speed-enabled": false,
+    "alt-speed-time-begin": 540,
+    "alt-speed-time-day": 127,
+    "alt-speed-time-enabled": false,
+    "alt-speed-time-end": 1020,
+    "alt-speed-up": 50,
+    "announce-ip": "",
+    "announce-ip-enabled": false,
+    "anti-brute-force-enabled": false,
+    "anti-brute-force-threshold": 100,
+    "bind-address-ipv4": "0.0.0.0",
+    "bind-address-ipv6": "::",
+    "blocklist-enabled": false,
+    "blocklist-url": "http://www.example.com/blocklist",
+    "cache-size-mb": 4,
+    "default-trackers": "",
+    "dht-enabled": true,
+    "download-dir": "/mnt/storage/downloads/complete",
+    "download-queue-enabled": true,
+    "download-queue-size": 5,
+    "encryption": 1,
+    "idle-seeding-limit": 30,
+    "idle-seeding-limit-enabled": false,
+    "incomplete-dir": "/mnt/storage/downloads/incomplete",
+    "incomplete-dir-enabled": true,
+    "lpd-enabled": true,
+    "message-level": 4,
+    "peer-congestion-algorithm": "",
+    "peer-limit-global": 200,
+    "peer-limit-per-torrent": 50,
+    "peer-port": 51413,
+    "peer-port-random-high": 65535,
+    "peer-port-random-low": 49152,
+    "peer-port-random-on-start": false,
+    "peer-socket-tos": "le",
+    "pex-enabled": true,
+    "pidfile": "/var/run/transmission/daemon.pid",
+    "port-forwarding-enabled": false,
+    "preallocation": 1,
+    "prefetch-enabled": true,
+    "queue-stalled-enabled": true,
+    "queue-stalled-minutes": 30,
+    "ratio-limit": 2,
+    "ratio-limit-enabled": false,
+    "rename-partial-files": false,
+    "rpc-authentication-required": false,
+    "rpc-bind-address": "0.0.0.0",
+    "rpc-enabled": true,
+    "rpc-host-whitelist": "",
+    "rpc-host-whitelist-enabled": false,
+    "rpc-password": "{{ dl.transmission_rpc_password }}",
+    "rpc-port": 9091,
+    "rpc-socket-mode": "0750",
+    "rpc-url": "/transmission/",
+    "rpc-username": "",
+    "rpc-whitelist": "127.0.0.1,::1",
+    "rpc-whitelist-enabled": false,
+    "scrape-paused-torrents-enabled": true,
+    "script-torrent-added-enabled": false,
+    "script-torrent-added-filename": "",
+    "script-torrent-done-enabled": false,
+    "script-torrent-done-filename": "",
+    "script-torrent-done-seeding-enabled": false,
+    "script-torrent-done-seeding-filename": "",
+    "seed-queue-enabled": false,
+    "seed-queue-size": 10,
+    "speed-limit-down": 100,
+    "speed-limit-down-enabled": false,
+    "speed-limit-up": 100,
+    "speed-limit-up-enabled": false,
+    "start-added-torrents": true,
+    "tcp-enabled": true,
+    "torrent-added-verify-mode": "fast",
+    "trash-original-torrent-files": false,
+    "umask": "002",
+    "upload-slots-per-torrent": 8,
+    "utp-enabled": true
+}
diff --git a/roles/jails/16_dl/templates/usr_local_etc_rc.d_wg_random_tunnel b/roles/jails/16_dl/templates/usr_local_etc_rc.d_wg_random_tunnel
new file mode 100644
index 0000000..d092d26
--- /dev/null
+++ b/roles/jails/16_dl/templates/usr_local_etc_rc.d_wg_random_tunnel
@@ -0,0 +1,37 @@
+#!/bin/sh
+
+# PROVIDE: wg_random_tunnel
+# REQUIRE: NETWORKING
+# KEYWORD: shutdown
+
+. /etc/rc.subr
+
+name="wg_random_tunnel"
+rcvar="wg_random_tunnel_enable"
+command="/usr/local/bin/wg_random_tunnel"
+
+start_cmd="${name}_start"
+stop_cmd="${name}_stop"
+status_cmd="${name}_status"
+
+wg_random_tunnel_start()
+{
+    export PATH=$PATH:/usr/local/bin/
+    echo "Starting wg_random_tunnel..."
+    ${command}
+}
+
+wg_random_tunnel_stop()
+{
+    echo "wg_random_tunnel is a one off script"
+    exit 1
+}
+
+wg_random_tunnel_status()
+{
+    echo "wg_random_tunnel is a one off script"
+    exit 1
+}
+
+load_rc_config $name
+run_rc_command "$1"
diff --git a/roles/jails/16_dl/templates/usr_local_share_nzbget_nzbget.conf.j2 b/roles/jails/16_dl/templates/usr_local_share_nzbget_nzbget.conf.j2
new file mode 100644
index 0000000..f231c87
--- /dev/null
+++ b/roles/jails/16_dl/templates/usr_local_share_nzbget_nzbget.conf.j2
@@ -0,0 +1,148 @@
+MainDir=/var/db/nzbget
+DestDir=/mnt/storage/downloads/complete
+InterDir=/mnt/storage/downloads/incomplete
+NzbDir=${MainDir}/nzb
+QueueDir=${MainDir}/queue
+TempDir=${MainDir}/tmp
+WebDir=/usr/local/share/nzbget/webui
+ScriptDir=${MainDir}/scripts
+LockFile=${MainDir}/nzbget.lock
+LogFile=${MainDir}/nzbget.log
+ConfigTemplate=/usr/local/share/nzbget/nzbget.template.conf
+RequiredDir=
+CertStore=
+
+Server1.Active=yes
+Server1.Name={{ dl.nzbget_server_name }}
+Server1.Level=0
+Server1.Optional=no
+Server1.Group=0
+Server1.Host={{ dl.nzbget_server_host }}
+Server1.Encryption=yes
+Server1.Port={{ dl.nzbget_server_port | default(443) }}
+Server1.Username={{ dl.nzbget_server_username }}
+Server1.Password={{ dl.nzbget_server_password }}
+Server1.JoinGroup=no
+Server1.Cipher=
+Server1.Connections={{ dl.nzbget_server_connections | default(10) }}
+Server1.Retention=0
+Server1.CertVerification=strict
+Server1.IpVersion=ipv4
+Server1.Notes=
+
+ControlIP=0.0.0.0
+ControlPort=6789
+ControlUsername=nzbget
+ControlPassword={{ dl.nzbget_control_password }}
+RestrictedUsername=
+RestrictedPassword=
+AddUsername=
+AddPassword=
+FormAuth=yes
+SecureControl=no
+SecurePort=6791
+SecureCert=
+SecureKey=
+AuthorizedIP=192.168.*.*
+CertCheck=no
+UpdateCheck=stable
+DaemonUsername=root
+UMask=0002
+
+Category1.Name=movies
+Category1.DestDir=
+Category1.Unpack=yes
+Category1.Extensions=
+Category1.Aliases=
+
+Category2.Name=anime
+Category3.Name=music
+
+AppendCategoryDir=yes
+NzbDirInterval=5
+NzbDirFileAge=60
+DupeCheck=yes
+
+FlushQueue=yes
+ContinuePartial=yes
+PropagationDelay=0
+ArticleCache=0
+DirectWrite=yes
+WriteBuffer=0
+FileNaming=auto
+RenameAfterUnpack=yes
+RenameIgnoreExt=.zip, .7z, .rar, .par2
+ReorderFiles=yes
+PostStrategy=balanced
+DiskSpace=250
+NzbCleanupDisk=yes
+KeepHistory=30
+FeedHistory=7
+SkipWrite=no
+RawArticle=no
+
+ArticleRetries=3
+ArticleInterval=10
+ArticleTimeout=60
+ArticleReadChunkSize=4
+UrlRetries=3
+UrlInterval=10
+UrlTimeout=60
+RemoteTimeout=90
+DownloadRate=0
+UrlConnections=4
+UrlForce=yes
+MonthlyQuota=0
+QuotaStartDay=1
+DailyQuota=0
+
+WriteLog=append
+RotateLog=3
+ErrorTarget=both
+WarningTarget=both
+InfoTarget=both
+DetailTarget=log
+DebugTarget=log
+LogBuffer=1000
+NzbLog=yes
+CrashTrace=yes
+CrashDump=no
+TimeCorrection=0
+
+OutputMode=curses
+CursesNzbName=yes
+CursesGroup=no
+CursesTime=no
+UpdateInterval=200
+
+CrcCheck=yes
+ParCheck=auto
+ParRepair=yes
+ParScan=extended
+ParQuick=yes
+ParBuffer=16
+ParThreads=0
+ParIgnoreExt=.sfv, .nzb, .nfo
+ParRename=yes
+RarRename=yes
+DirectRename=no
+HealthCheck=park
+ParTimeLimit=0
+ParPauseQueue=no
+
+Unpack=yes
+DirectUnpack=no
+UseTempUnpackDir=yes
+UnpackPauseQueue=no
+UnpackCleanupDisk=yes
+UnrarCmd=unrar
+SevenZipCmd=7z
+ExtCleanupDisk=.par2, .sfv
+UnpackIgnoreExt=.cbr
+UnpackPassFile=
+
+Extensions=
+ScriptOrder=
+ScriptPauseQueue=no
+ShellOverride=
+EventInterval=0
diff --git a/roles/jails/16_dl/templates/wg_random_tunnel.j2 b/roles/jails/16_dl/templates/wg_random_tunnel.j2
new file mode 100644
index 0000000..3cc9492
--- /dev/null
+++ b/roles/jails/16_dl/templates/wg_random_tunnel.j2
@@ -0,0 +1,17 @@
+#!/bin/sh
+
+set -eux
+
+CONF=$(ls /usr/local/etc/wireguard/ | sort -R | head -n1)
+GATEWAY={{ ingress_ip }}
+
+# Shut down current tunnel
+wg-quick down $(wg show interfaces) || true
+
+wg-quick up "/usr/local/etc/wireguard/${CONF}"
+
+TUNNEL_IF=$(wg show interfaces)
+TUNNEL_IP=$(wg show $TUNNEL_IF endpoints | awk '{print $2}' | tr ':' ' ' | awk '{print $1}')
+
+route delete $TUNNEL_IP
+route add $TUNNEL_IP $GATEWAY