diff options
| author | Tim Keller <tjk@tjkeller.xyz> | 2026-07-09 18:52:32 -0500 |
|---|---|---|
| committer | Tim Keller <tjk@tjkeller.xyz> | 2026-07-09 18:52:32 -0500 |
| commit | cb1655c86a9552a6801c5296e9241204085a59f3 (patch) | |
| tree | cf6303262c774b122f84e2b318fb6a55bd70b8d5 /hosts/poweredge | |
| parent | 671ba3d42f6c9017fc57876f3c26d22227b1ffef (diff) | |
| download | nixos-cb1655c86a9552a6801c5296e9241204085a59f3.tar.xz nixos-cb1655c86a9552a6801c5296e9241204085a59f3.zip | |
transmissions downloads world accessible and mount media dir
Diffstat (limited to 'hosts/poweredge')
| -rw-r--r-- | hosts/poweredge/transmission.nix | 26 |
1 files changed, 17 insertions, 9 deletions
diff --git a/hosts/poweredge/transmission.nix b/hosts/poweredge/transmission.nix index cded95d..f221f77 100644 --- a/hosts/poweredge/transmission.nix +++ b/hosts/poweredge/transmission.nix @@ -6,8 +6,8 @@ # Container containers.transmission = let home = "/var/lib/transmission"; - download-dir = "${home}/complete"; - incomplete-dir = "${home}/incomplete"; + download-dir = "${home}/Downloads"; + incomplete-dir = "${home}/.incomplete"; in { autoStart = true; privateNetwork = true; @@ -18,11 +18,15 @@ # Download dirs bindMounts = { "${download-dir}" = { - hostPath = "/media/ingens/media/.incomplete"; + hostPath = "/media/ingens/media/.complete"; isReadOnly = false; }; "${incomplete-dir}" = { - hostPath = "/media/ingens/media/.complete"; + hostPath = "/media/ingens/media/.incomplete"; + isReadOnly = false; + }; + "${home}/media" = { + hostPath = "/media/ingens/media"; isReadOnly = false; }; }; @@ -54,12 +58,17 @@ services.transmission = { inherit home; enable = true; + user = "transmission"; settings = { inherit download-dir incomplete-dir; + downloadDirPermissions = "775"; }; }; + # Allow transmission to write to bound mounts + users.users.transmission.extraGroups = [ "root" ]; + # TODO remove (#258793) systemd.services.transmission.serviceConfig = { RootDirectoryStartOnly = lib.mkForce null; @@ -84,12 +93,11 @@ updateResolvConf = true; }; - # VPN killswitch + # VPN "killswitch" networking.firewall.extraCommands = '' # Get domain name host and port from ovpn config SERVER_HOST=$(${pkgs.gawk}/bin/awk '/^remote /{print $2;exit}' /run/secrets/ovpn-config.ovpn) SERVER_PORT=$(${pkgs.gawk}/bin/awk '/^remote /{print $3;exit}' /run/secrets/ovpn-config.ovpn) - # Resolve server ip from host while [ -z "$SERVER_IP" ]; do sleep 3 @@ -104,12 +112,12 @@ ${pkgs.iptables}/bin/iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # Exception: allow established connections ${pkgs.iptables}/bin/iptables -A OUTPUT -p udp -d "$SERVER_IP" --dport "$SERVER_PORT" -j ACCEPT - # Allow DNS + # Get dns ip from resolv.conf DNS_IP=$(${pkgs.gawk}/bin/awk '/^nameserver /{print $2; exit}' /etc/resolv.conf) + + # Allow dns ${pkgs.iptables}/bin/iptables -A OUTPUT -o eth0 -p udp -d "$DNS_IP" --dport 53 -j ACCEPT ${pkgs.iptables}/bin/iptables -A OUTPUT -o eth0 -p tcp -d "$DNS_IP" --dport 53 -j ACCEPT - - # Allow transmission RPC ''; system.stateVersion = "26.05"; |