{ lib, pkgs, config, components, inputs, ... }: let uiPort = 9091; in { containers.torrent2 = { autoStart = true; privateNetwork = false; # mount host folders bindMounts = { media = { hostPath = "/media"; mountPoint = "/media"; # must be here otherwise transmission can't see the folder isReadOnly = false; }; lib = { hostPath = "/media/torrent/torrent2_config"; mountPoint = "/var/lib/transmission/.config"; isReadOnly = false; }; }; config = { config, lib, ... }: { nixpkgs.pkgs = pkgs; imports = [ "${components}/monitor/container.nix" inputs.nix-topology.nixosModules.default ]; system.stateVersion = "21.05"; services.logrotate.checkConfig = false; # because uid 3000 does not exist in here # allow transmission to write in syncthing folders users.groups.syncthing = { gid = config.ids.gids.syncthing; members = [ "transmission" ]; }; services.transmission = { enable = true; package = pkgs.legacy_2405.transmission_4; settings = { download-dir = "/media/torrent/downloads"; incomplete-dir = "/media/torrent/incomplete"; incomplete-dir-enabled = true; message-level = 1; umask = 2; rpc-whitelist-enabled = false; rpc-host-whitelist-enabled = false; rpc-port = uiPort; rpc-enable = true; rpc-bind-address = "127.0.0.1"; # "normal" speed limits speed-limit-down-enabled = false; speed-limit-down = 800; speed-limit-up-enabled = true; speed-limit-up = 3000; upload-slots-per-torrent = 8; # Queuing # When true, Transmission will only download # download-queue-size non-stalled torrents at once. download-queue-enabled = true; download-queue-size = 3; # When true, torrents that have not shared data for # queue-stalled-minutes are treated as 'stalled' # and are not counted against the queue-download-size # and seed-queue-size limits. queue-stalled-enabled = true; queue-stalled-minutes = 60; # When true. Transmission will only seed seed-queue-size # non-stalled torrents at once. seed-queue-enabled = false; seed-queue-size = 10; # Enable UPnP or NAT-PMP. peer-port = 51413; port-forwarding-enabled = false; # Start torrents as soon as they are added start-added-torrents = true; # Encryption preference. # 0 = Prefer unencrypted connections, # 1 = Prefer encrypted connections, # 2 = Require encrypted connections; # default = 1 # Encryption may help get around some ISP filtering, but at the cost of slightly # higher CPU use encryption = 2; }; }; systemd.services.transmission = { serviceConfig = { Restart = "always"; BindPaths = lib.mkForce [ "/media" # this is needed otherwise cp -l is not working "/var/lib/transmission/.config/transmission-daemon" ]; BindReadOnlyPaths = lib.mkForce [ builtins.storeDir "/etc" ]; PrivateMounts = lib.mkForce false; PrivateUsers = lib.mkForce false; RootDirectoryStartOnly = lib.mkForce false; RootDirectory = lib.mkForce "/var/lib"; ExecStartPre = lib.mkForce [ ]; # this prevents configuration creation, but fixes startup problems }; }; }; }; networking.firewall = { allowedTCPPorts = [ 51413 ]; allowedUDPPorts = [ 51413 ]; }; healthchecks.closed.public.ports.transmission2 = [ uiPort ]; # host nginx setup # ---------------- # curl -H "Host: transmission.robi.private" https://robi.private/ < will work # curl -H "Host: transmission.robi.private" https://144.76.13.147/ < wont work services.nginx = { enable = true; recommendedProxySettings = true; virtualHosts = { "transmission2.${config.networking.hostName}.private" = { extraConfig = '' allow ${config.tinc.private.subnet}; deny all; ''; locations."/" = { proxyPass = "http://127.0.0.1:${toString uiPort}"; }; }; }; }; }