search

edgd1er / nordlynx-transmission

use nordvpn client or wireguard to secure connection, then start sock/http proxy and transmission
4 stars 2 forks source link

readme

lint nordlynx transmission dockerfile build multi-arch images

Docker Size Docker Pulls Docker Stars ImageLayers

nordlynx-transmission

Nordvpn client's version or changelog: 3.18.4 (24/08/20)

30/03/2024: --privileged required for client >= 3.17.0. problem stopping container with client 3.17.x. 26/06/2023: moving to debian bookworm.

/!\ please consider this project as a work in progress especially concerning iptables/leak management when not using nordvpn client (ie: NORDVPN_PRIVKEY found).

/!\ since v4 for transmission, building package takes too long for github, gen_image_buildx.sh -ap generates debian packages for different architecture arm64, amd64, arm v7, then deb files are uploaded to not rebuild transmission at each image build.

purpose: compare wireguard and nordlynx speed transmisssion.

This is a docker container that connects to the recommended NordVPN servers through nordvpn client or wireguard, and starts a SOCKS5 proxy (dante), an http proxy (tinyproxy) and torrent client (transmission). plain wireguard and nordlynx's wireguard technology are available.

this container is build for amd64, arm64, arm/v7, arm/v6, two tags are available. As of 08/04/22, V3/v4 will be built regularly, as v4 is the version I use. I stopped the automatic launch for latest's workflow building. v3: transmission v3 + latest nordvpn client. v4: transmission v4 + latest nordvpn client. latest: transmission v3 + latest nordvpn client.

Whenever the connection is lost, nordvpn client has a killswitch to obliterate the connection.

check IP, DNS, Torrent or another torrent leaks or torrent check guard

What is this?

This image is a variation of nordlynx-proxy and has two ways to run.

you can then expose ports

To sum up, this container:

The main advantages are:

please note, that to avoid dns problem when the dns service is on the same server, /etc/resolv.conf is set to google DNS (1.1.1.1). That DNS is used only during startup (check latest nordvpn version)

Limitations

AS of 22/03/29, not all nordvpn client's features are implemented in plain wireguard:

Usage

The container may use environment variable to select a server, otherwise the best recommended server is selected: see environment variables to get all available options or nordVpn support.

adding 

sysclts:
 - net.ipv6.conf.all.disable_ipv6=1 # disable ipv6

might be needed, if nordvpn cannot change the settings itself.

Container variables

see haugene's poject for transsmission's variables.

Secrets

Nordvpn, wireguard private key, transmission rpc and tinyproxy credentials may be available throught secrets (/run/secrets/nordvpn_creds, /run/secrets/tiny_creds) In the setup scripts, secrets values override any env values. Secrets names are fixed values: NORDVPN_CREDS, NORDVPN_PRIVKEY, RPC_CREDS, TINY_CREDS.

file: ./nordvpn_creds #file with username/token in 1st line, passwd in 2nd line. file: ./tiny_creds #file with username/password in 1st line, passwd in 2nd line. these credentials can also be set with secrets.

docker run -it --rm --cap-add NET_ADMIN -p 1081:1080 -p 8888:8888 -p 9091:9091
 --device /dev/net/tun -e NORDVPN_LOGIN=<email> -e NORDVPN_PASS='<pass>' -e COUNTRY=Poland
 -e edgd1er/nordlynx-transmission
version: '3.8'
services:
  transmission:
    image: edgd1er/nordlynx-transmission:latest
    restart: unless-stopped
    ports:
      - "1080:1080"
      - "8888:8888"
      - "9091:9091"
    devices:
      - /dev/net/tun
    sysctls:
        - net.ipv4.conf.all.src_valid_mark=1 # remove need to have privilegied
        - net.ipv4.ip_forward=1
        - net.ipv4.conf.all.rp_filter=2 # Loose Reverse Path: https://access.redhat.com/solutions/53031
        - net.ipv6.conf.all.disable_ipv6=1 # disable ipv6
        - net.ipv6.conf.all.forwarding=1
      #      - net.ipv4.conf.all.rp_filter=2 # Loose Reverse Path: https://access.redhat.com/solutions/53031
    cap_add:
      - NET_ADMIN               # Required
#      - SYS_MODULE              # Required for TECHNOLOGY=NordLynx
    environment:
      - TZ=America/Chicago
      - CONNECT=uk
      - TECHNOLOGY=NordLynx
      - DEBUG=
      - NORDVPN_LOGIN=<email> #Not required if using secrets
      - NORDVPN_PASS=<pass> #Not required if using secrets
      - TRANSMISSION_RPC_USERNAME=<username> # not required if using secrets
      - TRANSMISSION_RPC_PASSWORD=<password> # not required if using secrets
      #- TINYUSER: optional, enforces authentication over tinyproxy when set with TINYPASS. set dante password also
      #- TINYPASS: optional, enforces authentication over tinyproxy when set with TINYUSER. set dante password also. add authorization with danteuser:${TINYPASS} to socks proxy
    secrets:
      - NORDVPN_CREDS
      - NORDVPN_PRIVKEY
      - RPC_CREDS
      - TINY_CREDS

secrets:
    NORDVPN_CREDS:
        file: ./nordvpn_creds # login and password on two separate lines, or token in oneline.
    NORDVPN_PRIVKEY:
        file: ./nordvpn_privkey # wireguard extracted private key
    RPC_CREDS:
        file: ./rpc_creds # login and password on two separate lines for transmission auth.
    TINY_CREDS:
        file: ./tiny_creds # login and password on two separate lines for tinyproxy and dante auth.