@@ -784,6 +784,14 @@ extraConfig = ''
             reverse_proxy localhost:${toString config.services.readeck.settings.server.port}
           '';
         };
+        "bt.${ts-domain}" = let
+          tm = config.services.transmission.settings;
+          in {
+          extraConfig = ''
+            bind tailscale/bt
+            reverse_proxy [${tm.rpc-bind-address}]:${toString tm.rpc-port}
+          '';
+        };
       };
   };
   systemd.services.caddy.serviceConfig = {
@@ -1302,107 +1310,23 @@ "uid=${toString config.ids.uids.transmission}"
         "gid=${toString config.ids.gids.transmission}"
       ];
   };
-  containers.bt =
-    let
-      externalDir = "/srv/transmission";
-      tsHostname = "bt.${ts-domain}";
-      tsPort = 41643;
-      hostConfig = config;
-    in
-    {
-      autoStart = true;
-      enableTun = true;
-      privateNetwork = true;
-      hostAddress6 = "fc00::1";
-      localAddress6 = "fc00::9091";
-      hostAddress = "10.231.91.1";
-      localAddress = "10.231.91.10";
-      forwardPorts = [
-        { hostPort = tsPort; }
-        { hostPort = config.services.transmission.settings.peer-port; }
-      ];
-      bindMounts = {
-        ${config.services.transmission.home} = {
-          hostPath = hostConfig.services.transmission.home;
-          isReadOnly = false;
-        };
-        ${externalDir} = {
-          hostPath = externalDir;
-          isReadOnly = false;
-        };
-      };
-      config =
-        {
-          config,
-          lib,
-          pkgs,
-          ...
-        }:
-        {
-          system.stateVersion = "24.11";
-          networking = {
-            useHostResolvConf = false;
-            resolvconf.enable = false;
-            firewall.trustedInterfaces = [ "tailscale0" ];
-            firewall.rejectPackets = true;
-            nameservers = hostConfig.networking.nameservers;
-          };
-          services.resolved = {
-            enable = true;
-            llmnr = "false";
-          };
-          services.tailscale = {
-            enable = true;
-            openFirewall = true;
-            permitCertUid = "caddy";
-            port = tsPort;
-          };
-          services.caddy = {
-            enable = true;
-            email = "caddy@alanpearce.eu";
-            virtualHosts = {
-              "http://" = {
-                hostName = "bt";
-                extraConfig = ''
-                  redir ${tsHostname}{uri}
-                '';
-              };
-              ${tsHostname} = {
-                extraConfig = ''
-                  encode zstd gzip
-                  tls {
-                    get_certificate tailscale
-                  }
-                  reverse_proxy localhost:${toString config.services.transmission.settings.rpc-port}
-                '';
-              };
-            };
-          };
-          services.transmission = {
-            enable = true;
-            package = pkgs.transmission_4;
-            openFirewall = true;
-            webHome = pkgs.flood-for-transmission;
-            settings = {
-              utp-enabled = true;
-              incomplete-dir-enabled = true;
-              incomplete-dir = "/srv/transmission/leeching";
-              download-dir = "/srv/transmission/seeding";
-              watch-dir = "/srv/transmission/watch";
-              watch-dir-enabled = true;
-              rpc-bind-address = "::1";
-              rpc-whitelist-enabled = false;
-              rpc-host-whitelist = tsHostname;
-              rpc-host-whitelist-enabled = true;
-            };
-          };
-          systemd.services.transmission = {
-            serviceConfig = {
-              RootDirectory = lib.mkForce "";
-            };
-          };
-        };
+  services.transmission = {
+    enable = true;
+    package = pkgs.transmission_4;
+    openFirewall = true;
+    webHome = pkgs.flood-for-transmission;
+    settings = {
+      utp-enabled = true;
+      incomplete-dir-enabled = true;
+      incomplete-dir = "/srv/transmission/leeching";
+      download-dir = "/srv/transmission/seeding";
+      watch-dir = "/srv/transmission/watch";
+      watch-dir-enabled = true;
+      rpc-bind-address = "::1";
+      rpc-whitelist-enabled = false;
+      rpc-host-whitelist-enabled = false;
     };
+  };
 
   containers.searchix-stable = {
     autoStart = true;