nixos/modules/services/torrent/transmission.nix

   1 { config, lib, pkgs, options, ... }:
   2
   3 with lib;
   4
   5 let
   6   cfg = config.services.transmission;
   7   inherit (config.environment) etc;
   8   apparmor = config.security.apparmor.enable;
   9   stateDir = "/var/lib/transmission";
  10   # TODO: switch to configGen.json once RFC0042 is implemented
  11   settingsFile = pkgs.writeText "settings.json" (builtins.toJSON (cfg.settings // {
  12     download-dir = "${stateDir}/Downloads";
  13     incomplete-dir = "${stateDir}/.incomplete";
  14   }));
  15   settingsDir = ".config/transmission-daemon";
  16   makeAbsolute = base: path:
  17     if builtins.match "^/.*" path == null
  18     then base+"/"+path else path;
  19 in
  20 {
  21   options = {
  22     services.transmission = {
  23       enable = mkEnableOption ''
  24         Whether or not to enable the headless Transmission BitTorrent daemon.
  25
  26         Transmission daemon can be controlled via the RPC interface using
  27         transmission-remote, the WebUI (http://${cfg.settings.rpc-bind-address}:${toString cfg.settings.rpc-port}/ by default),
  28         or other clients like stig or tremc.
  29
  30         Torrents are downloaded to ${cfg.settings.download-dir} by default and are
  31         accessible to users in the "transmission" group.
  32       '';
  33
  34       settings = mkOption rec {
  35         # TODO: switch to types.config.json as prescribed by RFC0042 once it's implemented
  36         type = types.attrs;
  37         apply = attrs:
  38           let super = recursiveUpdate default attrs; in
  39           super // {
  40             download-dir   = makeAbsolute cfg.home super.download-dir;
  41             incomplete-dir = makeAbsolute cfg.home super.incomplete-dir;
  42           };
  43         default =
  44           {
  45             download-dir = "${cfg.home}/Downloads";
  46             incomplete-dir = "${cfg.home}/.incomplete";
  47             incomplete-dir-enabled = true;
  48             peer-port = 51413;
  49             peer-port-random-high = 65535;
  50             peer-port-random-low = 49152;
  51             peer-port-random-on-start = false;
  52             rpc-bind-address = "127.0.0.1";
  53             rpc-port = 9091;
  54             umask = 18; # 0o022 in decimal as expected by Transmission, obtained with: echo $((8#022))
  55           };
  56         example =
  57           {
  58             download-dir = "/srv/torrents/";
  59             incomplete-dir = "/srv/torrents/.incomplete/";
  60             incomplete-dir-enabled = true;
  61             rpc-whitelist = "127.0.0.1,192.168.*.*";
  62           };
  63         description = ''
  64           Attribute set whose fields overwrites fields in
  65           <literal>.config/transmission-daemon/settings.json</literal>
  66           (each time the service starts). String values must be quoted, integer and
  67           boolean values must not.
  68
  69           See https://github.com/transmission/transmission/wiki/Editing-Configuration-Files
  70           for documentation.
  71         '';
  72       };
  73
  74       downloadDirPermissions = mkOption {
  75         type = types.str;
  76         default = "770";
  77         example = "775";
  78         description = ''
  79           The permissions set by the <literal>systemd-tmpfiles-setup</literal> service
  80           on <link linkend="opt-services.transmission.settings">settings.download-dir</link>
  81           and <link linkend="opt-services.transmission.settings">settings.incomplete-dir</link>.
  82         '';
  83       };
  84
  85       port = mkOption {
  86         type = types.port;
  87         description = ''
  88           TCP port number to run the RPC/web interface.
  89
  90           If instead you want to change the peer port,
  91           use <link linkend="opt-services.transmission.settings">settings.peer-port</link>
  92           or <link linkend="opt-services.transmission.settings">settings.peer-port-random-on-start</link>.
  93         '';
  94       };
  95
  96       home = mkOption {
  97         type = types.path;
  98         default = stateDir;
  99         description = ''
 100           The directory where Transmission will create <literal>.config/transmission-daemon/</literal>.
 101           as well as <literal>Downloads/</literal> unless <link linkend="opt-services.transmission.settings">settings.download-dir</link> is changed,
 102           and <literal>.incomplete/</literal> unless <link linkend="opt-services.transmission.settings">settings.incomplete-dir</link> is changed.
 103         '';
 104       };
 105
 106       user = mkOption {
 107         type = types.str;
 108         default = "transmission";
 109         description = "User account under which Transmission runs.";
 110       };
 111
 112       group = mkOption {
 113         type = types.str;
 114         default = "transmission";
 115         description = "Group account under which Transmission runs.";
 116       };
 117
 118       credentialsFile = mkOption {
 119         type = types.path;
 120         description = ''
 121           Path to a JSON file to be merged with the settings.
 122           Useful to merge a file which is better kept out of the Nix store
 123           because it contains sensible data like <link linkend="opt-services.transmission.settings">settings.rpc-password</link>.
 124         '';
 125         default = "/dev/null";
 126         example = "/var/lib/secrets/transmission/settings.json";
 127       };
 128
 129       openFirewall = mkEnableOption "Whether to automatically open the peer port(s) in the firewall.";
 130     };
 131   };
 132
 133   config = mkIf cfg.enable {
 134     systemd.tmpfiles.rules =
 135       optional (cfg.home != stateDir) "d '${cfg.home}/${settingsDir}' 700 '${cfg.user}' '${cfg.group}' - -"
 136       ++ [ "d '${cfg.settings.download-dir}' '${cfg.downloadDirPermissions}' '${cfg.user}' '${cfg.group}' - -" ]
 137       ++ optional cfg.settings.incomplete-dir-enabled
 138         "d '${cfg.settings.incomplete-dir}' '${cfg.downloadDirPermissions}' '${cfg.user}' '${cfg.group}' - -";
 139
 140     assertions = [
 141       { assertion = builtins.match "^/.*" cfg.home != null;
 142         message = "`services.transmission.home' must be an absolute path.";
 143       }
 144       { assertion = types.port.check cfg.settings.rpc-port;
 145         message = "${toString cfg.settings.rpc-port} is not a valid port number for `services.transmission.settings.rpc-port`.";
 146       }
 147       # In case both port and settings.rpc-port are explicitely defined: they must be the same.
 148       { assertion = !options.services.transmission.port.isDefined || cfg.port == cfg.settings.rpc-port;
 149         message = "`services.transmission.port' is not equal to `services.transmission.settings.rpc-port'";
 150       }
 151     ];
 152
 153     services.transmission.settings =
 154       optionalAttrs options.services.transmission.port.isDefined { rpc-port = cfg.port; };
 155
 156     systemd.services.transmission = {
 157       description = "Transmission BitTorrent Service";
 158       after = [ "network.target" ] ++ optional apparmor "apparmor.service";
 159       requires = optional apparmor "apparmor.service";
 160       wantedBy = [ "multi-user.target" ];
 161       environment.CURL_CA_BUNDLE = etc."ssl/certs/ca-certificates.crt".source;
 162       preStart = ''
 163         set -eux
 164         ${pkgs.jq}/bin/jq --slurp add ${settingsFile} '${cfg.credentialsFile}' >'${stateDir}/${settingsDir}/settings.json'
 165       '';
 166
 167       serviceConfig = {
 168         WorkingDirectory = stateDir;
 169         ExecStart = "${pkgs.transmission}/bin/transmission-daemon -f";
 170         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
 171         User = cfg.user;
 172         Group = cfg.group;
 173         StateDirectory = removePrefix "/var/lib/" stateDir + "/" + settingsDir;
 174         StateDirectoryMode = "0700";
 175         BindPaths =
 176           optional (cfg.home != stateDir) "${cfg.home}/${settingsDir}:${stateDir}/${settingsDir}"
 177           ++ [ "${cfg.settings.download-dir}:${stateDir}/Downloads" ]
 178           ++ optional cfg.settings.incomplete-dir-enabled "${cfg.settings.incomplete-dir}:${stateDir}/.incomplete";
 179         # The following options give:
 180         # systemd-analyze security transmission
 181         # → Overall exposure level for transmission.service: 1.5 OK
 182         AmbientCapabilities = "";
 183         CapabilityBoundingSet = "";
 184         LockPersonality = true;
 185         MemoryDenyWriteExecute = true;
 186         NoNewPrivileges = true;
 187         PrivateDevices = true;
 188         PrivateMounts = true;
 189         PrivateNetwork = false;
 190         PrivateTmp = true;
 191         PrivateUsers = false;
 192         ProtectClock = true;
 193         ProtectControlGroups = true;
 194         ProtectHome = mkDefault true;
 195         ProtectHostname = true;
 196         ProtectKernelLogs = true;
 197         ProtectKernelModules = true;
 198         ProtectKernelTunables = true;
 199         ProtectSystem = mkDefault "strict";
 200         ReadWritePaths = [ stateDir ];
 201         RemoveIPC = true;
 202         RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
 203         RestrictNamespaces = true;
 204         RestrictRealtime = true;
 205         RestrictSUIDSGID = true;
 206         # In case transmission crashes with status=31/SYS,
 207         # having systemd.coredump.enable = true
 208         # and environment.enableDebugInfo = true
 209         # enables to use coredumpctl debug to find the denied syscall.
 210         SystemCallFilter = [
 211           "@default"
 212           "@aio"
 213           "@basic-io"
 214           #"@chown"
 215           #"@clock"
 216           #"@cpu-emulation"
 217           #"@debug"
 218           "@file-system"
 219           "@io-event"
 220           #"@ipc"
 221           #"@keyring"
 222           #"@memlock"
 223           #"@module"
 224           #"@mount"
 225           "@network-io"
 226           #"@obsolete"
 227           #"@pkey"
 228           #"@privileged"
 229             # Reached when querying infos through RPC (eg. with stig)
 230             "quotactl"
 231           "@process"
 232           #"@raw-io"
 233           #"@reboot"
 234           #"@resources"
 235           #"@setuid"
 236           "@signal"
 237           #"@swap"
 238           "@sync"
 239           "@system-service"
 240           "@timer"
 241         ];
 242         SystemCallArchitectures = "native";
 243         UMask = "0077";
 244       };
 245     };
 246
 247     # It's useful to have transmission in path, e.g. for remote control
 248     environment.systemPackages = [ pkgs.transmission ];
 249
 250     users.users = optionalAttrs (cfg.user == "transmission") ({
 251       transmission = {
 252         group = cfg.group;
 253         uid = config.ids.uids.transmission;
 254         description = "Transmission BitTorrent user";
 255         home = stateDir;
 256         createHome = false;
 257       };
 258     });
 259
 260     users.groups = optionalAttrs (cfg.group == "transmission") ({
 261       transmission = {
 262         gid = config.ids.gids.transmission;
 263       };
 264     });
 265
 266     networking.firewall = mkIf cfg.openFirewall (
 267       if cfg.settings.peer-port-random-on-start
 268       then
 269         { allowedTCPPortRanges =
 270             [ { from = cfg.settings.peer-port-random-low;
 271                 to   = cfg.settings.peer-port-random-high;
 272               }
 273             ];
 274           allowedUDPPortRanges =
 275             [ { from = cfg.settings.peer-port-random-low;
 276                 to   = cfg.settings.peer-port-random-high;
 277               }
 278             ];
 279         }
 280       else
 281         { allowedTCPPorts = [ cfg.settings.peer-port ];
 282           allowedUDPPorts = [ cfg.settings.peer-port ];
 283         }
 284     );
 285
 286     security.apparmor.policies."bin/transmission-daemon".profile = ''
 287       #include <tunables/global>
 288
 289       ${pkgs.transmission}/bin/transmission-daemon {
 290         #include <abstractions/base>
 291         #include <abstractions/nameservice>
 292
 293         ${getLib pkgs.stdenv.cc.cc}/lib/*.so* mr,
 294         ${getLib pkgs.stdenv.cc.libc}/lib/*.so* mr,
 295         ${getLib pkgs.libevent}/lib/libevent*.so*        mr,
 296         ${getLib pkgs.curl}/lib/libcurl*.so*             mr,
 297         ${getLib pkgs.openssl}/lib/libssl*.so*           mr,
 298         ${getLib pkgs.openssl}/lib/libcrypto*.so*        mr,
 299         ${getLib pkgs.zlib}/lib/libz*.so*                mr,
 300         ${getLib pkgs.libssh2}/lib/libssh2*.so*          mr,
 301         ${getLib pkgs.systemd}/lib/libsystemd*.so*       mr,
 302         ${getLib pkgs.xz}/lib/liblzma*.so*               mr,
 303         ${getLib pkgs.libgcrypt}/lib/libgcrypt*.so*      mr,
 304         ${getLib pkgs.libgpgerror}/lib/libgpg-error*.so* mr,
 305         ${getLib pkgs.nghttp2}/lib/libnghttp2*.so*       mr,
 306         ${getLib pkgs.c-ares}/lib/libcares*.so*          mr,
 307         ${getLib pkgs.libcap}/lib/libcap*.so*            mr,
 308         ${getLib pkgs.attr}/lib/libattr*.so*             mr,
 309         ${getLib pkgs.lz4}/lib/liblz4*.so*               mr,
 310         ${getLib pkgs.libkrb5}/lib/lib*.so*              mr,
 311         ${getLib pkgs.keyutils}/lib/libkeyutils*.so*     mr,
 312         ${getLib pkgs.utillinuxMinimal.out}/lib/libblkid.so* mr,
 313         ${getLib pkgs.utillinuxMinimal.out}/lib/libmount.so* mr,
 314         ${getLib pkgs.utillinuxMinimal.out}/lib/libuuid.so* mr,
 315
 316         @{PROC}/sys/kernel/random/uuid   r,
 317         @{PROC}/sys/vm/overcommit_memory r,
 318         #@{PROC}/@{pid}/environ r,
 319         @{PROC}/@{pid}/mounts r,
 320         /tmp/tr_session_id_* rwk,
 321
 322         ${pkgs.openssl.out}/etc/** r,
 323         ${config.systemd.services.transmission.environment.CURL_CA_BUNDLE} r,
 324         ${pkgs.transmission}/share/transmission/** r,
 325
 326         owner ${stateDir}/${settingsDir}/** rw,
 327
 328         ${stateDir}/Downloads/** rw,
 329         ${optionalString cfg.settings.incomplete-dir-enabled ''
 330           ${stateDir}/.incomplete/** rw,
 331         ''}
 332       }
 333     '';
 334   };
 335
 336   meta.maintainers = with lib.maintainers; [ julm ];
 337 }