hosts/losurdo/transmission.nix

   1 { pkgs, lib, config, hostName, inputs, ... }:
   2 let
   3   inherit (config.services) transmission;
   4   inherit (config.users) users;
   5   inherit (config.security) gnupg;
   6   netns = "calyx";
   7   wg-intra-peers = import (inputs.julm-nix + "/nixos/profiles/wireguard/wg-intra/peers.nix");
   8 in
   9 {
  10 users.groups.transmission.members = [
  11   users."julm".name
  12   users."sevy".name
  13 ];
  14 networking.nftables.ruleset = ''
  15   table inet filter {
  16     chain input-intra {
  17       tcp dport ${toString transmission.settings.rpc-port} \
  18         counter accept comment "transmission: rpc"
  19     }
  20   }
  21 '';
  22 services.netns.namespaces.${netns}.nftables = ''
  23   table inet filter {
  24     chain input {
  25       meta l4proto { udp, tcp } \
  26         th dport ${toString transmission.settings.peer-port} \
  27         counter accept comment "transmission"
  28     }
  29     chain output {
  30       skuid ${transmission.user} counter accept comment "transmission"
  31     }
  32   }
  33 '';
  34 #users.groups.keys.members = [ transmission.user ];
  35 security.gnupg.secrets."transmission/settings.json" = {
  36   user = transmission.user;
  37   systemdConfig.before = [ "transmission.service" ];
  38   systemdConfig.wantedBy = [ "transmission.service" ];
  39 };
  40 fileSystems."/var/lib/transmission" = {
  41   device = "${hostName}/var/torrents";
  42   fsType = "zfs";
  43 };
  44 systemd.services.transmission = {
  45   after = [
  46     "netns-${netns}.service"
  47     "zfs.target"
  48   ];
  49   requires = [
  50     "netns-${netns}.service"
  51     "zfs.target"
  52   ];
  53   startAt = "20:00:00";
  54   unitConfig.JoinsNamespaceOf = ["netns-${netns}.service"];
  55   serviceConfig.BindReadOnlyPaths = ["/etc/netns/${netns}/resolv.conf:/etc/resolv.conf"];
  56   serviceConfig.PrivateNetwork = true;
  57   #serviceConfig.NetworkNamespacePath = "/var/run/netns/${netns}";
  58 };
  59 systemd.sockets.proxy-to-transmission = {
  60   wantedBy = ["sockets.target"];
  61   listenStreams = ["${wg-intra-peers.${hostName}.ipv4}:9091"];
  62   socketConfig.FreeBind = true;
  63 };
  64 systemd.services.proxy-to-transmission = {
  65   requires = ["transmission.service"];
  66   after = ["transmission.service" "proxy-to-transmission.socket"];
  67   unitConfig.JoinsNamespaceOf = ["netns-${netns}.service"];
  68   serviceConfig = {
  69     ExecStart = "${pkgs.systemd}/lib/systemd/systemd-socket-proxyd 127.0.0.1:9091";
  70     PrivateNetwork = true;
  71     PrivateTmp = true;
  72   };
  73 };
  74 systemd.services.stop-transmission = {
  75   serviceConfig.Type = "oneshot";
  76   unitConfig.Conflicts = ["transmission.service"];
  77   startAt = "06..19:0,15,30,45:00";
  78   script = "true";
  79 };
  80 services.transmission = {
  81   enable = true;
  82   performanceNetParameters = true;
  83   credentialsFile = gnupg.secrets."transmission/settings.json".path;
  84   settings = {
  85     message-level = 2;
  86     download-dir = "/var/lib/transmission/downloaded";
  87     incomplete-dir = "/var/lib/transmission/.incoming";
  88     incomplete-dir-enabled = true;
  89     watch-dir = "/var/lib/transmission/.torrents";
  90     watch-dir-enabled = true;
  91     trash-original-torrent-files = false;
  92     preallocation = 0;
  93     umask = 7; # 007 octal, in decimal!
  94     download-queue-enabled = true;
  95     download-queue-size = 5;
  96     peer-id-ttl-hours = 6;
  97     peer-limit-global = 1000;
  98     peer-limit-per-torrent = 100;
  99
 100     peer-port = 6882;
 101     peer-port-random-on-start = false;
 102     encryption = 1;
 103     dht-enabled = true;
 104     lpd-enabled = false;
 105     pex-enabled = true;
 106     port-forwarding-enabled = true;
 107     scrape-paused-torrents-enabled = false;
 108     peer-socket-tos = "lowcost";
 109     queue-stalled-enabled = true;
 110     queue-stalled-minutes = 30;
 111     speed-limit-down-enabled = false;
 112     speed-limit-up = 50;
 113     speed-limit-up-enabled = true;
 114     alt-speed-enabled = true;
 115     alt-speed-time-enabled = true;
 116     alt-speed-down = 1000;
 117     alt-speed-up = 0;
 118     alt-speed-time-day = 127; # all days. 65; # weekend only
 119     alt-speed-time-begin = 360; # 06h00 local time
 120     alt-speed-time-end = 1260; # 21h00 local time
 121     ratio-limit = 4;
 122     ratio-limit-enabled = true;
 123
 124     rpc-enabled = true;
 125     rpc-bind-address = "127.0.0.1";
 126     rpc-port = 9091;
 127     rpc-whitelist = "127.0.0.1,${wg-intra-peers.${hostName}.ipv4}/24";
 128     rpc-whitelist-enabled = true;
 129     rpc-host-whitelist = "localhost,${hostName}.wg";
 130     rpc-host-whitelist-enabled = true;
 131     rpc-authentication-required = true;
 132   };
 133 };
 134 }