all repos — nixfiles @ a666f0f73054ee5d579a6442b9e84573129d1f03

System and user configuration, managed by nix and home-manager

system/roles/torrent-client.nix (view raw)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
{
  config,
  lib,
  pkgs,
  ...
}:
let
  inherit (config.networking) domain fqdn;
  inherit (import ../../data) homenet tailnet;

  cfg = config.services.transmission;
  storeDir = "/srv/transmission";
in
{
  services.transmission = {
    enable = true;
    openPeerPorts = true;
    webHome = pkgs.trgui-ng-web;
    performanceNetParameters = true;

    settings = {
      utp-enabled = false;

      download-dir = "${storeDir}/downloads";
      incomplete-dir = "${storeDir}/incomplete";
      incomplete-dir-enabled = true;
      watch-dir = "${storeDir}/watch";
      watch-dir-enabled = true;
      trash-original-torrent-files = true;

      rpc-bind-address = "[::1]";
      rpc-whitelist-enabled = false;
      rpc-host-whitelist-enabled = false;
    };
  };
  systemd.services.transmission = {
    serviceConfig = {
      LimitNOFILE = 524288;
    };
  };

  systemd.tmpfiles.rules = [
    "d ${storeDir} 0755 ${cfg.user} ${cfg.group}"
    "d ${cfg.settings.download-dir} 0755 ${cfg.user} ${cfg.group}"
    "d ${cfg.settings.incomplete-dir} 0755 ${cfg.user} ${cfg.group}"
    "d ${cfg.settings.watch-dir} 0777 ${cfg.user} ${cfg.group}"
  ];

  services.caddy.virtualHosts =
    let
      upstream = ''
        reverse_proxy [::1]:${toString cfg.settings.rpc-port}
      '';
    in
    {
      "bt.${domain}" = {
        extraConfig = ''
          ${lib.optionalString (domain == homenet) ''
            tls {
              issuer internal {
                ca home
              }
            }
          ''}
          ${upstream}
        '';
      };
      "bt.${tailnet}" = {
        extraConfig = ''
          bind tailscale/bt
          tls {
            get_certificate tailscale
          }
          ${upstream}
        '';
      };
    };

  services.dnsmasq.settings.cname = [
    "bt.${domain},${fqdn}"
  ];
}