]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/transmission.nix
losurdo: nsupdate: fix credentials
[sourcephile-nix.git] / hosts / losurdo / transmission.nix
1 { pkgs, lib, config, hostName, inputs, ... }:
2 let
3 inherit (config.services) transmission;
4 inherit (config.users) users;
5 inherit (config.security) gnupg;
6 netns = "riseup";
7 wg-intra-peers = import (inputs.julm-nix + "/nixos/profiles/wireguard/wg-intra/peers.nix");
8 in
9 {
10 users.groups.transmission.members = [
11 users."julm".name
12 users."sevy".name
13 ];
14 services.netns.namespaces.${netns}.nftables = ''
15 table inet filter {
16 chain input {
17 meta l4proto { udp, tcp } \
18 th dport ${toString transmission.settings.peer-port} \
19 counter accept comment "transmission"
20 }
21 chain output {
22 skuid ${transmission.user} counter accept comment "transmission"
23 }
24 }
25 '';
26 #users.groups.keys.members = [ transmission.user ];
27 security.gnupg.secrets."transmission/settings.json" = {
28 user = transmission.user;
29 systemdConfig.before = [ "transmission.service" ];
30 systemdConfig.wantedBy = [ "transmission.service" ];
31 };
32 fileSystems."/var/lib/transmission" = {
33 device = "${hostName}/var/torrents";
34 fsType = "zfs";
35 };
36 systemd.services.transmission = {
37 after = [
38 "netns-${netns}.service"
39 "zfs.target"
40 ];
41 requires = [
42 "netns-${netns}.service"
43 "zfs.target"
44 ];
45 startAt = "20:00:00";
46 unitConfig.JoinsNamespaceOf = ["netns-${netns}.service"];
47 serviceConfig.BindReadOnlyPaths = ["/etc/netns/${netns}/resolv.conf:/etc/resolv.conf"];
48 serviceConfig.PrivateNetwork = true;
49 #serviceConfig.NetworkNamespacePath = "/var/run/netns/${netns}";
50 };
51 systemd.sockets.proxy-to-transmission = {
52 wantedBy = ["sockets.target"];
53 listenStreams = ["${wg-intra-peers.${hostName}.ipv4}:9091"];
54 socketConfig.FreeBind = true;
55 };
56 systemd.services.proxy-to-transmission = {
57 requires = ["transmission.service"];
58 after = ["transmission.service" "proxy-to-transmission.socket"];
59 unitConfig.JoinsNamespaceOf = ["netns-${netns}.service"];
60 serviceConfig = {
61 ExecStart = "${pkgs.systemd}/lib/systemd/systemd-socket-proxyd 127.0.0.1:9091";
62 PrivateNetwork = true;
63 PrivateTmp = true;
64 };
65 };
66 systemd.services.stop-transmission = {
67 serviceConfig.Type = "oneshot";
68 unitConfig.Conflicts = ["transmission.service"];
69 startAt = "06..19:0,15,30,45:00";
70 script = "true";
71 };
72 services.transmission = {
73 enable = true;
74 performanceNetParameters = true;
75 credentialsFile = gnupg.secrets."transmission/settings.json".path;
76 settings = {
77 message-level = 2;
78 download-dir = "/var/lib/transmission/downloaded";
79 incomplete-dir = "/var/lib/transmission/.incoming";
80 incomplete-dir-enabled = true;
81 watch-dir = "/var/lib/transmission/.torrents";
82 watch-dir-enabled = true;
83 trash-original-torrent-files = false;
84 preallocation = 0;
85 umask = 7; # 007 octal, in decimal!
86 download-queue-enabled = true;
87 download-queue-size = 5;
88 peer-id-ttl-hours = 6;
89 peer-limit-global = 1000;
90 peer-limit-per-torrent = 100;
91
92 peer-port = 6882;
93 peer-port-random-on-start = false;
94 encryption = 1;
95 dht-enabled = true;
96 lpd-enabled = false;
97 pex-enabled = true;
98 port-forwarding-enabled = true;
99 scrape-paused-torrents-enabled = false;
100 peer-socket-tos = "lowcost";
101 queue-stalled-enabled = true;
102 queue-stalled-minutes = 30;
103 speed-limit-down-enabled = false;
104 speed-limit-up = 50;
105 speed-limit-up-enabled = true;
106 alt-speed-enabled = true;
107 alt-speed-time-enabled = true;
108 alt-speed-down = 1000;
109 alt-speed-up = 0;
110 alt-speed-time-day = 127; # all days. 65; # weekend only
111 alt-speed-time-begin = 360; # 06h00 local time
112 alt-speed-time-end = 1260; # 21h00 local time
113 ratio-limit = 4;
114 ratio-limit-enabled = true;
115
116 rpc-enabled = true;
117 rpc-bind-address = "127.0.0.1";
118 rpc-port = 9091;
119 rpc-whitelist = "127.0.0.1,${wg-intra-peers.${hostName}.ipv4}/24";
120 rpc-whitelist-enabled = true;
121 rpc-host-whitelist = "localhost,${hostName}.wg";
122 rpc-host-whitelist-enabled = true;
123 rpc-authentication-required = true;
124 };
125 };
126 }