]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/transmission.nix
Add 1 git-crypt collaborator
[sourcephile-nix.git] / hosts / losurdo / transmission.nix
1 { pkgs, lib, config, hostName, inputs, ... }:
2 let
3 inherit (config.services) transmission;
4 inherit (config.users) users;
5 inherit (config.security) gnupg;
6 netns = "riseup";
7 wg-intra-peers = import (inputs.julm-nix + "/nixos/profiles/wireguard/wg-intra/peers.nix");
8 in
9 {
10 users.groups.transmission.members = [
11 users."julm".name
12 users."sevy".name
13 ];
14 services.netns.namespaces.${netns}.nftables = ''
15 add rule inet filter input tcp dport ${toString transmission.settings.peer-port} counter accept comment "Transmission"
16 add rule inet filter input udp dport ${toString transmission.settings.peer-port} counter accept comment "Transmission"
17 add rule inet filter output meta skuid ${transmission.user} counter accept comment "Transmission"
18 '';
19 #users.groups.keys.members = [ transmission.user ];
20 security.gnupg.secrets."transmission/settings.json" = {
21 user = transmission.user;
22 systemdConfig.before = [ "transmission.service" ];
23 systemdConfig.wantedBy = [ "transmission.service" ];
24 };
25 fileSystems."/var/lib/transmission" = {
26 device = "${hostName}/var/torrents";
27 fsType = "zfs";
28 };
29 systemd.services.transmission = {
30 after = [
31 "netns-${netns}.service"
32 "zfs.target"
33 ];
34 requires = [
35 "netns-${netns}.service"
36 "zfs.target"
37 ];
38 startAt = "20:00:00";
39 unitConfig.JoinsNamespaceOf = ["netns-${netns}.service"];
40 serviceConfig.BindReadOnlyPaths = ["/etc/netns/${netns}/resolv.conf:/etc/resolv.conf"];
41 serviceConfig.PrivateNetwork = true;
42 #serviceConfig.NetworkNamespacePath = "/var/run/netns/${netns}";
43 };
44 systemd.sockets.proxy-to-transmission = {
45 wantedBy = ["sockets.target"];
46 listenStreams = ["${wg-intra-peers.${hostName}.ipv4}:9091"];
47 socketConfig.FreeBind = true;
48 };
49 systemd.services.proxy-to-transmission = {
50 requires = ["transmission.service"];
51 after = ["transmission.service" "proxy-to-transmission.socket"];
52 unitConfig.JoinsNamespaceOf = ["netns-${netns}.service"];
53 serviceConfig = {
54 ExecStart = "${pkgs.systemd}/lib/systemd/systemd-socket-proxyd 127.0.0.1:9091";
55 PrivateNetwork = true;
56 PrivateTmp = true;
57 };
58 };
59 systemd.services.stop-transmission = {
60 serviceConfig.Type = "oneshot";
61 unitConfig.Conflicts = ["transmission.service"];
62 startAt = "06..19:0,15,30,45:00";
63 script = "true";
64 };
65 services.transmission = {
66 enable = true;
67 performanceNetParameters = true;
68 credentialsFile = gnupg.secrets."transmission/settings.json".path;
69 settings = {
70 message-level = 2;
71 download-dir = "/var/lib/transmission/downloaded";
72 incomplete-dir = "/var/lib/transmission/.incoming";
73 incomplete-dir-enabled = true;
74 watch-dir = "/var/lib/transmission/.torrents";
75 watch-dir-enabled = true;
76 trash-original-torrent-files = false;
77 preallocation = 0;
78 umask = 7; # 007 octal, in decimal!
79 download-queue-enabled = true;
80 download-queue-size = 5;
81 peer-id-ttl-hours = 6;
82 peer-limit-global = 1000;
83 peer-limit-per-torrent = 100;
84
85 peer-port = 6882;
86 peer-port-random-on-start = false;
87 encryption = 1;
88 dht-enabled = true;
89 lpd-enabled = false;
90 pex-enabled = true;
91 port-forwarding-enabled = true;
92 scrape-paused-torrents-enabled = false;
93 peer-socket-tos = "lowcost";
94 queue-stalled-enabled = true;
95 queue-stalled-minutes = 30;
96 speed-limit-down-enabled = false;
97 speed-limit-up = 50;
98 speed-limit-up-enabled = true;
99 alt-speed-enabled = true;
100 alt-speed-time-enabled = true;
101 alt-speed-down = 1000;
102 alt-speed-up = 0;
103 alt-speed-time-day = 127; # all days. 65; # weekend only
104 alt-speed-time-begin = 360; # 06h00 local time
105 alt-speed-time-end = 1260; # 21h00 local time
106 ratio-limit = 4;
107 ratio-limit-enabled = true;
108
109 rpc-enabled = true;
110 rpc-bind-address = "127.0.0.1";
111 rpc-port = 9091;
112 rpc-whitelist = "127.0.0.1,${wg-intra-peers.${hostName}.ipv4}/24";
113 rpc-whitelist-enabled = true;
114 rpc-host-whitelist = "localhost,${hostName}.wg";
115 rpc-host-whitelist-enabled = true;
116 rpc-authentication-required = true;
117 };
118 };
119 }