dotfiles/modules/nixos/services/transmission.nix

86 lines
3.1 KiB
Nix
Raw Normal View History

2024-01-10 04:11:11 +00:00
# Transmission is a bittorrent client, which can run in the background for
# automated downloads with a web GUI.
2022-10-16 01:32:39 +00:00
{ config, pkgs, lib, ... }: {
2022-10-09 14:12:31 +00:00
config = let
namespace = config.networking.wireguard.interfaces.wg0.interfaceNamespace;
2022-10-10 03:25:28 +00:00
vpnIp = lib.strings.removeSuffix "/32"
(builtins.head config.networking.wireguard.interfaces.wg0.ips);
2024-03-24 17:16:20 +00:00
in lib.mkIf config.services.transmission.enable {
2022-10-09 14:12:31 +00:00
# Setup transmission
services.transmission = {
settings = {
port-forwarding-enabled = false;
rpc-authentication-required = true;
rpc-port = 9091;
rpc-bind-address = "0.0.0.0";
rpc-username = config.user;
2024-03-24 17:16:20 +00:00
# This is a salted hash of the real password
# https://github.com/tomwijnroks/transmission-pwgen
rpc-password = "{c4c5145f6e18bcd3c7429214a832440a45285ce26jDOBGVW";
rpc-host-whitelist = config.hostnames.transmission;
2022-10-09 14:12:31 +00:00
rpc-host-whitelist-enabled = true;
2024-03-24 17:16:20 +00:00
rpc-whitelist = lib.mkDefault "127.0.0.1"; # Overwritten by Cloudflare
rpc-whitelist-enabled = true;
2022-10-09 14:12:31 +00:00
};
};
2024-03-24 17:16:20 +00:00
# Configure Cloudflare DNS to point to this machine
services.cloudflare-dyndns.domains = [ config.hostnames.transmission ];
2022-10-09 14:12:31 +00:00
# Bind transmission to wireguard namespace
2023-06-06 03:49:41 +00:00
systemd.services.transmission = lib.mkIf config.wireguard.enable {
bindsTo = [ "netns@${namespace}.service" ];
2022-10-16 01:32:39 +00:00
requires = [ "network-online.target" "transmission-secret.service" ];
after = [ "wireguard-wg0.service" "transmission-secret.service" ];
unitConfig.JoinsNamespaceOf = "netns@${namespace}.service";
serviceConfig.NetworkNamespacePath = "/var/run/netns/${namespace}";
2022-10-09 14:12:31 +00:00
};
# Create reverse proxy for web UI
2023-03-12 13:24:16 +00:00
caddy.routes = lib.mkAfter [{
2024-03-24 17:16:20 +00:00
group =
if (config.hostnames.download == config.hostnames.transmission) then
"download"
else
"transmission";
2023-06-04 01:10:23 +00:00
match = [{
2024-03-24 17:16:20 +00:00
host = [ config.hostnames.transmission ];
2023-06-04 01:10:23 +00:00
path = [ "/transmission*" ];
}];
2022-10-09 14:12:31 +00:00
handle = [{
handler = "reverse_proxy";
2024-03-24 17:16:20 +00:00
upstreams = [{
dial = "localhost:${
builtins.toString config.services.transmission.settings.rpc-port
}";
}];
2022-10-09 14:12:31 +00:00
}];
}];
# Caddy and Transmission both try to set rmem_max for larger UDP packets.
# We will choose Transmission's recommendation (4 MB).
boot.kernel.sysctl."net.core.rmem_max" = 4194304;
2022-10-09 14:12:31 +00:00
# Allow inbound connections to reach namespace
2023-06-06 03:49:41 +00:00
systemd.services.transmission-web-netns = lib.mkIf config.wireguard.enable {
description = "Forward to transmission in wireguard namespace";
2022-10-09 14:12:31 +00:00
requires = [ "transmission.service" ];
after = [ "transmission.service" ];
serviceConfig = {
Restart = "on-failure";
TimeoutStopSec = 300;
};
wantedBy = [ "multi-user.target" ];
script = ''
${pkgs.iproute2}/bin/ip netns exec ${namespace} ${pkgs.iproute2}/bin/ip link set dev lo up
2022-10-10 03:25:28 +00:00
${pkgs.socat}/bin/socat tcp-listen:9091,fork,reuseaddr exec:'${pkgs.iproute2}/bin/ip netns exec ${namespace} ${pkgs.socat}/bin/socat STDIO "tcp-connect:${vpnIp}:9091"',nofork
2022-10-09 14:12:31 +00:00
'';
};
};
}