aboutsummaryrefslogtreecommitdiffstats
path: root/roles/jails
diff options
context:
space:
mode:
Diffstat (limited to 'roles/jails')
-rw-r--r--roles/jails/16_dl/defaults/main.yml40
-rw-r--r--roles/jails/16_dl/handlers/main.yml2
-rw-r--r--roles/jails/16_dl/tasks/main.yml105
-rw-r--r--roles/jails/16_dl/templates/etc_crontab.j25
-rw-r--r--roles/jails/16_dl/templates/lidarr_config.xml.j217
-rw-r--r--roles/jails/16_dl/templates/nzbget.conf.j210
-rw-r--r--roles/jails/16_dl/templates/prowlarr_config.xml.j217
-rw-r--r--roles/jails/16_dl/templates/radarr_config.xml.j217
-rw-r--r--roles/jails/16_dl/templates/sonarr_config.xml.j217
-rw-r--r--roles/jails/16_dl/templates/transmission_settings.json.j280
-rw-r--r--roles/jails/16_dl/templates/usr_local_etc_rc.d_wg_random_tunnel37
-rw-r--r--roles/jails/16_dl/templates/usr_local_share_nzbget_nzbget.conf.j2148
-rw-r--r--roles/jails/16_dl/templates/wg_random_tunnel.j217
13 files changed, 511 insertions, 1 deletions
diff --git a/roles/jails/16_dl/defaults/main.yml b/roles/jails/16_dl/defaults/main.yml
index c296953..481f414 100644
--- a/roles/jails/16_dl/defaults/main.yml
+++ b/roles/jails/16_dl/defaults/main.yml
@@ -1,6 +1,5 @@
userland: "15.0-RELEASE"
devfs_ruleset: 4
-no_default_route: true
jail_conf_options:
- "allow.raw_sockets"
@@ -9,3 +8,42 @@ jail_conf_options:
nullfs:
- src: /usr/local/jails/volumes/storage
dst: /mnt/storage
+
+zfs:
+ - name: zroot/jails/volumes/dl_sonarr
+ mountpoint: /usr/local/sonarr
+ - name: zroot/jails/volumes/dl_radarr
+ mountpoint: /usr/local/radarr
+ - name: zroot/jails/volumes/dl_lidarr
+ mountpoint: /usr/local/lidarr
+ - name: zroot/jails/volumes/dl_prowlarr
+ mountpoint: /usr/local/prowlarr
+
+pkg:
+ - transmission-daemon
+ - transmission-web
+ - transmission-cli
+ - nzbget
+ - yt-dlp
+ - sonarr
+ - radarr
+ - lidarr
+ - prowlarr
+ - ffmpeg
+ - unrar
+ - wireguard-tools
+ - git
+ - bash
+ - shntool
+ - cuetools
+ - vorbisgain
+ - flac
+
+services:
+ - wg_random_tunnel
+ - transmission
+ - nzbget
+ - prowlarr
+ - sonarr
+ - radarr
+ - lidarr
diff --git a/roles/jails/16_dl/handlers/main.yml b/roles/jails/16_dl/handlers/main.yml
new file mode 100644
index 0000000..f977eb1
--- /dev/null
+++ b/roles/jails/16_dl/handlers/main.yml
@@ -0,0 +1,2 @@
+- name: Restart wireguard
+ shell: /usr/local/bin/wg_random_tunnel
diff --git a/roles/jails/16_dl/tasks/main.yml b/roles/jails/16_dl/tasks/main.yml
index 2abdaff..b187447 100644
--- a/roles/jails/16_dl/tasks/main.yml
+++ b/roles/jails/16_dl/tasks/main.yml
@@ -1,2 +1,107 @@
- import_role:
name: jail
+ tasks_from: jail_setup
+
+- name: Configure transmission download directory
+ community.general.sysrc:
+ name: transmission_download_dir
+ value: /mnt/storage/downloads/complete
+
+- name: Deploy initial transmission settings
+ template:
+ src: "{{ jail_role_dir }}/templates/transmission_settings.json.j2"
+ dest: /usr/local/etc/transmission/home/settings.json
+ owner: root
+ group: wheel
+ mode: "0644"
+ #force: false
+
+- name: Deploy initial nzbget config
+ template:
+ src: "{{ jail_role_dir }}/templates/nzbget.conf.j2"
+ dest: /usr/local/share/nzbget/nzbget.conf
+ owner: root
+ group: wheel
+ mode: "0644"
+ force: false
+
+- name: Deploy initial prowlarr config
+ template:
+ src: "{{ jail_role_dir }}/templates/prowlarr_config.xml.j2"
+ dest: /usr/local/prowlarr/config.xml
+ owner: root
+ group: wheel
+ mode: "0644"
+ force: false
+
+- name: Deploy initial sonarr config
+ template:
+ src: "{{ jail_role_dir }}/templates/sonarr_config.xml.j2"
+ dest: /usr/local/sonarr/config.xml
+ owner: root
+ group: wheel
+ mode: "0644"
+ force: false
+
+- name: Deploy initial radarr config
+ template:
+ src: "{{ jail_role_dir }}/templates/radarr_config.xml.j2"
+ dest: /usr/local/radarr/config.xml
+ owner: root
+ group: wheel
+ mode: "0644"
+ force: false
+
+- name: Deploy initial lidarr config
+ template:
+ src: "{{ jail_role_dir }}/templates/lidarr_config.xml.j2"
+ dest: /usr/local/lidarr/config.xml
+ owner: root
+ group: wheel
+ mode: "0644"
+ force: false
+
+- name: Create wireguard config directory
+ file:
+ path: /usr/local/etc/wireguard
+ state: directory
+ owner: root
+ group: wheel
+ mode: "0700"
+
+- name: Deploy wireguard configs
+ unarchive:
+ src: "{{ jail_role_dir }}/files/mullvad_wireguard_linux_all_all.zip"
+ dest: /usr/local/etc/wireguard
+ owner: root
+ group: wheel
+ mode: "0600"
+ creates: /usr/local/etc/wireguard/mullvad-fi1.conf
+
+- name: Deploy wg_random_tunnel script
+ template:
+ src: "{{ jail_role_dir }}/templates/wg_random_tunnel.j2"
+ dest: /usr/local/bin/wg_random_tunnel
+ owner: root
+ group: wheel
+ mode: "0755"
+
+- name: Deploy wg_random_tunnel rc.d script
+ template:
+ src: "{{ jail_role_dir }}/templates/usr_local_etc_rc.d_wg_random_tunnel"
+ dest: /usr/local/etc/rc.d/wg_random_tunnel
+ owner: root
+ group: wheel
+ mode: "0755"
+
+- name: Deploy crontab
+ template:
+ src: "{{ jail_role_dir }}/templates/etc_crontab.j2"
+ dest: /etc/crontab
+ owner: root
+ group: wheel
+ mode: "0644"
+
+- import_role:
+ name: jail
+ tasks_from: jail_launch
diff --git a/roles/jails/16_dl/templates/etc_crontab.j2 b/roles/jails/16_dl/templates/etc_crontab.j2
new file mode 100644
index 0000000..1faae3d
--- /dev/null
+++ b/roles/jails/16_dl/templates/etc_crontab.j2
@@ -0,0 +1,5 @@
+SHELL=/bin/sh
+PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
+
+# Change tunnel every hour
+0 * * * * root /usr/local/bin/wg_random_tunnel >> /var/log/random_tunnel.log 2>&1
diff --git a/roles/jails/16_dl/templates/lidarr_config.xml.j2 b/roles/jails/16_dl/templates/lidarr_config.xml.j2
new file mode 100644
index 0000000..a0d89ea
--- /dev/null
+++ b/roles/jails/16_dl/templates/lidarr_config.xml.j2
@@ -0,0 +1,17 @@
+<Config>
+ <BindAddress>0.0.0.0</BindAddress>
+ <Port>8686</Port>
+ <SslPort>6868</SslPort>
+ <EnableSsl>False</EnableSsl>
+ <LaunchBrowser>False</LaunchBrowser>
+ <ApiKey>{{ dl.lidarr_api_key }}</ApiKey>
+ <AuthenticationMethod>Forms</AuthenticationMethod>
+ <AuthenticationRequired>DisabledForLocalAddresses</AuthenticationRequired>
+ <Branch>master</Branch>
+ <LogLevel>info</LogLevel>
+ <SslCertPath></SslCertPath>
+ <SslCertPassword></SslCertPassword>
+ <UrlBase></UrlBase>
+ <InstanceName>Lidarr</InstanceName>
+ <UpdateMechanism>External</UpdateMechanism>
+</Config>
diff --git a/roles/jails/16_dl/templates/nzbget.conf.j2 b/roles/jails/16_dl/templates/nzbget.conf.j2
new file mode 100644
index 0000000..754e56f
--- /dev/null
+++ b/roles/jails/16_dl/templates/nzbget.conf.j2
@@ -0,0 +1,10 @@
+MainDir=/var/db/nzbget
+DestDir=/mnt/storage/downloads
+InterDir=/var/db/nzbget/tmp
+WebDir=/usr/local/share/nzbget/webui
+ConfigTemplate=/usr/local/share/nzbget/nzbget.template.conf
+LockFile=/var/db/nzbget/nzbget.lock
+LogFile=/var/db/nzbget/nzbget.log
+ControlIP=0.0.0.0
+ControlPort=6789
+AuthorizedIP=10.0.0.0/8,192.168.0.0/16
diff --git a/roles/jails/16_dl/templates/prowlarr_config.xml.j2 b/roles/jails/16_dl/templates/prowlarr_config.xml.j2
new file mode 100644
index 0000000..391dbf2
--- /dev/null
+++ b/roles/jails/16_dl/templates/prowlarr_config.xml.j2
@@ -0,0 +1,17 @@
+<Config>
+ <BindAddress>0.0.0.0</BindAddress>
+ <Port>9696</Port>
+ <SslPort>6969</SslPort>
+ <EnableSsl>False</EnableSsl>
+ <LaunchBrowser>False</LaunchBrowser>
+ <ApiKey>{{ dl.prowlarr_api_key }}</ApiKey>
+ <AuthenticationMethod>Forms</AuthenticationMethod>
+ <AuthenticationRequired>DisabledForLocalAddresses</AuthenticationRequired>
+ <Branch>master</Branch>
+ <LogLevel>info</LogLevel>
+ <SslCertPath></SslCertPath>
+ <SslCertPassword></SslCertPassword>
+ <UrlBase></UrlBase>
+ <InstanceName>Prowlarr</InstanceName>
+ <UpdateMechanism>External</UpdateMechanism>
+</Config>
diff --git a/roles/jails/16_dl/templates/radarr_config.xml.j2 b/roles/jails/16_dl/templates/radarr_config.xml.j2
new file mode 100644
index 0000000..d336ea2
--- /dev/null
+++ b/roles/jails/16_dl/templates/radarr_config.xml.j2
@@ -0,0 +1,17 @@
+<Config>
+ <BindAddress>0.0.0.0</BindAddress>
+ <Port>7878</Port>
+ <SslPort>9898</SslPort>
+ <EnableSsl>False</EnableSsl>
+ <LaunchBrowser>False</LaunchBrowser>
+ <ApiKey>{{ dl.radarr_api_key }}</ApiKey>
+ <AuthenticationMethod>Forms</AuthenticationMethod>
+ <AuthenticationRequired>DisabledForLocalAddresses</AuthenticationRequired>
+ <Branch>master</Branch>
+ <LogLevel>info</LogLevel>
+ <SslCertPath></SslCertPath>
+ <SslCertPassword></SslCertPassword>
+ <UrlBase></UrlBase>
+ <InstanceName>Radarr</InstanceName>
+ <UpdateMechanism>External</UpdateMechanism>
+</Config>
diff --git a/roles/jails/16_dl/templates/sonarr_config.xml.j2 b/roles/jails/16_dl/templates/sonarr_config.xml.j2
new file mode 100644
index 0000000..a1b35e1
--- /dev/null
+++ b/roles/jails/16_dl/templates/sonarr_config.xml.j2
@@ -0,0 +1,17 @@
+<Config>
+ <BindAddress>0.0.0.0</BindAddress>
+ <Port>8989</Port>
+ <SslPort>9898</SslPort>
+ <EnableSsl>False</EnableSsl>
+ <LaunchBrowser>False</LaunchBrowser>
+ <ApiKey>{{ dl.sonarr_api_key }}</ApiKey>
+ <AuthenticationMethod>Forms</AuthenticationMethod>
+ <AuthenticationRequired>DisabledForLocalAddresses</AuthenticationRequired>
+ <Branch>main</Branch>
+ <LogLevel>info</LogLevel>
+ <SslCertPath></SslCertPath>
+ <SslCertPassword></SslCertPassword>
+ <UrlBase></UrlBase>
+ <InstanceName>Sonarr</InstanceName>
+ <UpdateMechanism>External</UpdateMechanism>
+</Config>
diff --git a/roles/jails/16_dl/templates/transmission_settings.json.j2 b/roles/jails/16_dl/templates/transmission_settings.json.j2
new file mode 100644
index 0000000..72b396e
--- /dev/null
+++ b/roles/jails/16_dl/templates/transmission_settings.json.j2
@@ -0,0 +1,80 @@
+{
+ "alt-speed-down": 50,
+ "alt-speed-enabled": false,
+ "alt-speed-time-begin": 540,
+ "alt-speed-time-day": 127,
+ "alt-speed-time-enabled": false,
+ "alt-speed-time-end": 1020,
+ "alt-speed-up": 50,
+ "announce-ip": "",
+ "announce-ip-enabled": false,
+ "anti-brute-force-enabled": false,
+ "anti-brute-force-threshold": 100,
+ "bind-address-ipv4": "0.0.0.0",
+ "bind-address-ipv6": "::",
+ "blocklist-enabled": false,
+ "blocklist-url": "http://www.example.com/blocklist",
+ "cache-size-mb": 4,
+ "default-trackers": "",
+ "dht-enabled": true,
+ "download-dir": "/mnt/storage/downloads/complete",
+ "download-queue-enabled": true,
+ "download-queue-size": 5,
+ "encryption": 1,
+ "idle-seeding-limit": 30,
+ "idle-seeding-limit-enabled": false,
+ "incomplete-dir": "/mnt/storage/downloads/incomplete",
+ "incomplete-dir-enabled": true,
+ "lpd-enabled": true,
+ "message-level": 4,
+ "peer-congestion-algorithm": "",
+ "peer-limit-global": 200,
+ "peer-limit-per-torrent": 50,
+ "peer-port": 51413,
+ "peer-port-random-high": 65535,
+ "peer-port-random-low": 49152,
+ "peer-port-random-on-start": false,
+ "peer-socket-tos": "le",
+ "pex-enabled": true,
+ "pidfile": "/var/run/transmission/daemon.pid",
+ "port-forwarding-enabled": false,
+ "preallocation": 1,
+ "prefetch-enabled": true,
+ "queue-stalled-enabled": true,
+ "queue-stalled-minutes": 30,
+ "ratio-limit": 2,
+ "ratio-limit-enabled": false,
+ "rename-partial-files": false,
+ "rpc-authentication-required": false,
+ "rpc-bind-address": "0.0.0.0",
+ "rpc-enabled": true,
+ "rpc-host-whitelist": "",
+ "rpc-host-whitelist-enabled": false,
+ "rpc-password": "{{ dl.transmission_rpc_password }}",
+ "rpc-port": 9091,
+ "rpc-socket-mode": "0750",
+ "rpc-url": "/transmission/",
+ "rpc-username": "",
+ "rpc-whitelist": "127.0.0.1,::1",
+ "rpc-whitelist-enabled": false,
+ "scrape-paused-torrents-enabled": true,
+ "script-torrent-added-enabled": false,
+ "script-torrent-added-filename": "",
+ "script-torrent-done-enabled": false,
+ "script-torrent-done-filename": "",
+ "script-torrent-done-seeding-enabled": false,
+ "script-torrent-done-seeding-filename": "",
+ "seed-queue-enabled": false,
+ "seed-queue-size": 10,
+ "speed-limit-down": 100,
+ "speed-limit-down-enabled": false,
+ "speed-limit-up": 100,
+ "speed-limit-up-enabled": false,
+ "start-added-torrents": true,
+ "tcp-enabled": true,
+ "torrent-added-verify-mode": "fast",
+ "trash-original-torrent-files": false,
+ "umask": "002",
+ "upload-slots-per-torrent": 8,
+ "utp-enabled": true
+}
diff --git a/roles/jails/16_dl/templates/usr_local_etc_rc.d_wg_random_tunnel b/roles/jails/16_dl/templates/usr_local_etc_rc.d_wg_random_tunnel
new file mode 100644
index 0000000..d092d26
--- /dev/null
+++ b/roles/jails/16_dl/templates/usr_local_etc_rc.d_wg_random_tunnel
@@ -0,0 +1,37 @@
+#!/bin/sh
+
+# PROVIDE: wg_random_tunnel
+# REQUIRE: NETWORKING
+# KEYWORD: shutdown
+
+. /etc/rc.subr
+
+name="wg_random_tunnel"
+rcvar="wg_random_tunnel_enable"
+command="/usr/local/bin/wg_random_tunnel"
+
+start_cmd="${name}_start"
+stop_cmd="${name}_stop"
+status_cmd="${name}_status"
+
+wg_random_tunnel_start()
+{
+ export PATH=$PATH:/usr/local/bin/
+ echo "Starting wg_random_tunnel..."
+ ${command}
+}
+
+wg_random_tunnel_stop()
+{
+ echo "wg_random_tunnel is a one off script"
+ exit 1
+}
+
+wg_random_tunnel_status()
+{
+ echo "wg_random_tunnel is a one off script"
+ exit 1
+}
+
+load_rc_config $name
+run_rc_command "$1"
diff --git a/roles/jails/16_dl/templates/usr_local_share_nzbget_nzbget.conf.j2 b/roles/jails/16_dl/templates/usr_local_share_nzbget_nzbget.conf.j2
new file mode 100644
index 0000000..f231c87
--- /dev/null
+++ b/roles/jails/16_dl/templates/usr_local_share_nzbget_nzbget.conf.j2
@@ -0,0 +1,148 @@
+MainDir=/var/db/nzbget
+DestDir=/mnt/storage/downloads/complete
+InterDir=/mnt/storage/downloads/incomplete
+NzbDir=${MainDir}/nzb
+QueueDir=${MainDir}/queue
+TempDir=${MainDir}/tmp
+WebDir=/usr/local/share/nzbget/webui
+ScriptDir=${MainDir}/scripts
+LockFile=${MainDir}/nzbget.lock
+LogFile=${MainDir}/nzbget.log
+ConfigTemplate=/usr/local/share/nzbget/nzbget.template.conf
+RequiredDir=
+CertStore=
+
+Server1.Active=yes
+Server1.Name={{ dl.nzbget_server_name }}
+Server1.Level=0
+Server1.Optional=no
+Server1.Group=0
+Server1.Host={{ dl.nzbget_server_host }}
+Server1.Encryption=yes
+Server1.Port={{ dl.nzbget_server_port | default(443) }}
+Server1.Username={{ dl.nzbget_server_username }}
+Server1.Password={{ dl.nzbget_server_password }}
+Server1.JoinGroup=no
+Server1.Cipher=
+Server1.Connections={{ dl.nzbget_server_connections | default(10) }}
+Server1.Retention=0
+Server1.CertVerification=strict
+Server1.IpVersion=ipv4
+Server1.Notes=
+
+ControlIP=0.0.0.0
+ControlPort=6789
+ControlUsername=nzbget
+ControlPassword={{ dl.nzbget_control_password }}
+RestrictedUsername=
+RestrictedPassword=
+AddUsername=
+AddPassword=
+FormAuth=yes
+SecureControl=no
+SecurePort=6791
+SecureCert=
+SecureKey=
+AuthorizedIP=192.168.*.*
+CertCheck=no
+UpdateCheck=stable
+DaemonUsername=root
+UMask=0002
+
+Category1.Name=movies
+Category1.DestDir=
+Category1.Unpack=yes
+Category1.Extensions=
+Category1.Aliases=
+
+Category2.Name=anime
+Category3.Name=music
+
+AppendCategoryDir=yes
+NzbDirInterval=5
+NzbDirFileAge=60
+DupeCheck=yes
+
+FlushQueue=yes
+ContinuePartial=yes
+PropagationDelay=0
+ArticleCache=0
+DirectWrite=yes
+WriteBuffer=0
+FileNaming=auto
+RenameAfterUnpack=yes
+RenameIgnoreExt=.zip, .7z, .rar, .par2
+ReorderFiles=yes
+PostStrategy=balanced
+DiskSpace=250
+NzbCleanupDisk=yes
+KeepHistory=30
+FeedHistory=7
+SkipWrite=no
+RawArticle=no
+
+ArticleRetries=3
+ArticleInterval=10
+ArticleTimeout=60
+ArticleReadChunkSize=4
+UrlRetries=3
+UrlInterval=10
+UrlTimeout=60
+RemoteTimeout=90
+DownloadRate=0
+UrlConnections=4
+UrlForce=yes
+MonthlyQuota=0
+QuotaStartDay=1
+DailyQuota=0
+
+WriteLog=append
+RotateLog=3
+ErrorTarget=both
+WarningTarget=both
+InfoTarget=both
+DetailTarget=log
+DebugTarget=log
+LogBuffer=1000
+NzbLog=yes
+CrashTrace=yes
+CrashDump=no
+TimeCorrection=0
+
+OutputMode=curses
+CursesNzbName=yes
+CursesGroup=no
+CursesTime=no
+UpdateInterval=200
+
+CrcCheck=yes
+ParCheck=auto
+ParRepair=yes
+ParScan=extended
+ParQuick=yes
+ParBuffer=16
+ParThreads=0
+ParIgnoreExt=.sfv, .nzb, .nfo
+ParRename=yes
+RarRename=yes
+DirectRename=no
+HealthCheck=park
+ParTimeLimit=0
+ParPauseQueue=no
+
+Unpack=yes
+DirectUnpack=no
+UseTempUnpackDir=yes
+UnpackPauseQueue=no
+UnpackCleanupDisk=yes
+UnrarCmd=unrar
+SevenZipCmd=7z
+ExtCleanupDisk=.par2, .sfv
+UnpackIgnoreExt=.cbr
+UnpackPassFile=
+
+Extensions=
+ScriptOrder=
+ScriptPauseQueue=no
+ShellOverride=
+EventInterval=0
diff --git a/roles/jails/16_dl/templates/wg_random_tunnel.j2 b/roles/jails/16_dl/templates/wg_random_tunnel.j2
new file mode 100644
index 0000000..3cc9492
--- /dev/null
+++ b/roles/jails/16_dl/templates/wg_random_tunnel.j2
@@ -0,0 +1,17 @@
+#!/bin/sh
+
+set -eux
+
+CONF=$(ls /usr/local/etc/wireguard/ | sort -R | head -n1)
+GATEWAY={{ ingress_ip }}
+
+# Shut down current tunnel
+wg-quick down $(wg show interfaces) || true
+
+wg-quick up "/usr/local/etc/wireguard/${CONF}"
+
+TUNNEL_IF=$(wg show interfaces)
+TUNNEL_IP=$(wg show $TUNNEL_IF endpoints | awk '{print $2}' | tr ':' ' ' | awk '{print $1}')
+
+route delete $TUNNEL_IP
+route add $TUNNEL_IP $GATEWAY

Want to contribute? Host your changes somewhere and send me the link: jan (at) sydanviita.fi. Also, check out my website.


forge.jan.systems — powered by cgit