Added most of what will be needed to get this running
This commit is contained in:
rasmus-kirk
@@ -0,0 +1,220 @@
|
||||
# TODO: Dir creation and file permissions in nix
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
cfg = config.kirk.servarr.transmission;
|
||||
servarr = config.kirk.servarr;
|
||||
dnsServers = config.lib.vpn.dnsServers;
|
||||
in {
|
||||
options.kirk.servarr.transmission = {
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = lib.mdDoc "Enable transmission";
|
||||
};
|
||||
|
||||
stateDir = mkOption {
|
||||
type = types.path;
|
||||
default = "${servarr.stateDir}/servarr/transmission";
|
||||
description = lib.mdDoc "The state directory for transmission. Only works with useVpn option.";
|
||||
};
|
||||
|
||||
downloadDir = mkOption {
|
||||
type = types.path;
|
||||
default = "${servarr.mediaDir}/torrents";
|
||||
description = lib.mdDoc ''
|
||||
The directory for transmission to download to.
|
||||
'';
|
||||
};
|
||||
|
||||
useVpn = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = lib.mdDoc "Run transmission through VPN";
|
||||
};
|
||||
|
||||
useFlood = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = lib.mdDoc "Use the flood UI";
|
||||
};
|
||||
|
||||
peerPort = mkOption {
|
||||
type = types.port;
|
||||
default = 50000;
|
||||
description = "transmission peer traffic port.";
|
||||
};
|
||||
|
||||
uiPort = mkOption {
|
||||
type = types.port;
|
||||
default = 9091;
|
||||
description = "transmission web-UI port.";
|
||||
};
|
||||
|
||||
extraConfig = mkOption {
|
||||
type = types.attrs;
|
||||
default = {};
|
||||
description = "Extra settings config for the transmission service.";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
services.transmission = mkIf (!cfg.useVpn) {
|
||||
enable = true;
|
||||
group = "media";
|
||||
#home = cfg.stateDir;
|
||||
webHome = if cfg.useFlood then pkgs.flood-for-transmission else null;
|
||||
package = pkgs.transmission_4;
|
||||
openRPCPort = true;
|
||||
openPeerPorts = true;
|
||||
settings = {
|
||||
download-dir = "${servarr.mediaDir}/torrents";
|
||||
incomplete-dir-enabled = true;
|
||||
incomplete-dir = "${servarr.mediaDir}/torrents/.incomplete";
|
||||
watch-dir-enabled = true;
|
||||
watch-dir = "${servarr.mediaDir}/torrents/.watch";
|
||||
|
||||
rpc-port = cfg.uiPort;
|
||||
rpc-whitelist-enabled = true;
|
||||
rpc-whitelist = "192.168.15.1,127.0.0.1";
|
||||
rpc-authentication-required = true;
|
||||
|
||||
blocklist-enabled = true;
|
||||
blocklist-url = "https://github.com/Naunter/BT_BlockLists/raw/master/bt_blocklists.gz";
|
||||
|
||||
encryption = 1;
|
||||
utp-enabled = true;
|
||||
port-forwarding-enabled = false;
|
||||
|
||||
anti-brute-force-enabled = true;
|
||||
anti-brute-force-threshold = 10;
|
||||
} // cfg.extraConfig;
|
||||
};
|
||||
|
||||
kirk.vpnnamespace = mkIf cfg.useVpn {
|
||||
portMappings = [{
|
||||
From = cfg.uiPort;
|
||||
To = cfg.uiPort;
|
||||
}];
|
||||
openUdpPorts = [ cfg.peerPort ];
|
||||
openTcpPorts = [ cfg.peerPort ];
|
||||
};
|
||||
|
||||
containers.transmission = mkIf cfg.useVpn {
|
||||
autoStart = true;
|
||||
ephemeral = true;
|
||||
extraFlags = [ "--network-namespace-path=/var/run/netns/wg" ];
|
||||
|
||||
bindMounts = {
|
||||
"${servarr.mediaDir}/torrents".isReadOnly = false;
|
||||
"/var/lib/transmission" = {
|
||||
hostPath = cfg.stateDir;
|
||||
isReadOnly = false;
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
users.groups.media = {
|
||||
gid = config.users.groups.media.gid;
|
||||
};
|
||||
users.users.transmission = {
|
||||
uid = lib.mkForce config.users.users.transmission.uid;
|
||||
isSystemUser = true;
|
||||
group = "media";
|
||||
};
|
||||
|
||||
# Use systemd-resolved inside the container
|
||||
# Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
|
||||
networking.useHostResolvConf = lib.mkForce false;
|
||||
services.resolved.enable = true;
|
||||
networking.nameservers = dnsServers;
|
||||
|
||||
systemd.services.transmission.serviceConfig = {
|
||||
RootDirectoryStartOnly = lib.mkForce false;
|
||||
RootDirectory = lib.mkForce "";
|
||||
};
|
||||
|
||||
services.transmission = {
|
||||
enable = true;
|
||||
# This is maybe wrong, too afraid to fix it lol
|
||||
group = "media";
|
||||
webHome = if cfg.useFlood then pkgs.flood-for-transmission else null;
|
||||
package = pkgs.transmission_4;
|
||||
openRPCPort = true;
|
||||
openPeerPorts = true;
|
||||
settings = {
|
||||
download-dir = "${servarr.mediaDir}/torrents";
|
||||
incomplete-dir-enabled = true;
|
||||
incomplete-dir = "${servarr.mediaDir}/torrents/.incomplete";
|
||||
watch-dir-enabled = true;
|
||||
watch-dir = "${servarr.mediaDir}/torrents/.watch";
|
||||
|
||||
rpc-bind-address = "192.168.15.1";
|
||||
rpc-port = cfg.uiPort;
|
||||
rpc-whitelist-enabled = false;
|
||||
rpc-whitelist = "192.168.15.1,127.0.0.1";
|
||||
rpc-authentication-required = false;
|
||||
|
||||
blocklist-enabled = true;
|
||||
blocklist-url = "https://github.com/Naunter/BT_BlockLists/raw/master/bt_blocklists.gz";
|
||||
|
||||
peer-port = cfg.peerPort;
|
||||
dht-enabled = true;
|
||||
pex-enabled = true;
|
||||
utp-enabled = false;
|
||||
encryption = 1;
|
||||
port-forwarding-enabled = false;
|
||||
|
||||
anti-brute-force-enabled = true;
|
||||
anti-brute-force-threshold = 10;
|
||||
|
||||
# 0 = None, 1 = Critical, 2 = Error, 3 = Warn, 4 = Info, 5 = Debug, 6 = Trace
|
||||
message-level = 3;
|
||||
} // cfg.extraConfig;
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
wget
|
||||
util-linux
|
||||
unixtools.ping
|
||||
coreutils
|
||||
curl
|
||||
bash
|
||||
libressl
|
||||
netcat-gnu
|
||||
openresolv
|
||||
dig
|
||||
];
|
||||
|
||||
system.stateVersion = "23.11";
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx = mkIf cfg.useVpn {
|
||||
enable = true;
|
||||
|
||||
recommendedTlsSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedGzipSettings = true;
|
||||
|
||||
virtualHosts."127.0.0.1:${builtins.toString cfg.uiPort}" = {
|
||||
listen = [
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = cfg.uiPort;
|
||||
}
|
||||
];
|
||||
locations."/" = {
|
||||
recommendedProxySettings = true;
|
||||
proxyWebsockets = true;
|
||||
proxyPass = "http://192.168.15.1:${builtins.toString cfg.uiPort}";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user