From cb1655c86a9552a6801c5296e9241204085a59f3 Mon Sep 17 00:00:00 2001
From: Tim Keller <tjk@tjkeller.xyz>
Date: Thu, 9 Jul 2026 18:52:32 -0500
Subject: transmissions downloads world accessible and mount media dir

---
 hosts/poweredge/transmission.nix | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/hosts/poweredge/transmission.nix b/hosts/poweredge/transmission.nix
index cded95d..f221f77 100644
--- a/hosts/poweredge/transmission.nix
+++ b/hosts/poweredge/transmission.nix
@@ -6,8 +6,8 @@
 	# Container
 	containers.transmission = let
 		home = "/var/lib/transmission";
-		download-dir = "${home}/complete";
-		incomplete-dir = "${home}/incomplete";
+		download-dir = "${home}/Downloads";
+		incomplete-dir = "${home}/.incomplete";
 	in {
 		autoStart = true;
 		privateNetwork = true;
@@ -18,11 +18,15 @@
 		# Download dirs
 		bindMounts = {
 			"${download-dir}" = {
-				hostPath = "/media/ingens/media/.incomplete";
+				hostPath = "/media/ingens/media/.complete";
 				isReadOnly = false;
 			};
 			"${incomplete-dir}" = {
-				hostPath = "/media/ingens/media/.complete";
+				hostPath = "/media/ingens/media/.incomplete";
+				isReadOnly = false;
+			};
+			"${home}/media" = {
+				hostPath = "/media/ingens/media";
 				isReadOnly = false;
 			};
 		};
@@ -54,12 +58,17 @@
 			services.transmission = {
 				inherit home;
 				enable = true;
+				user = "transmission";
 
 				settings = {
 					inherit download-dir incomplete-dir;
+					downloadDirPermissions = "775";
 				};
 			};
 
+			# Allow transmission to write to bound mounts
+			users.users.transmission.extraGroups = [ "root" ];
+
 			# TODO remove (#258793)
 			systemd.services.transmission.serviceConfig = {
 				RootDirectoryStartOnly = lib.mkForce null;
@@ -84,12 +93,11 @@
 				updateResolvConf = true;
 			};
 
-			# VPN killswitch
+			# VPN "killswitch"
 			networking.firewall.extraCommands = ''
 				# Get domain name host and port from ovpn config
 				SERVER_HOST=$(${pkgs.gawk}/bin/awk '/^remote /{print $2;exit}' /run/secrets/ovpn-config.ovpn)
 				SERVER_PORT=$(${pkgs.gawk}/bin/awk '/^remote /{print $3;exit}' /run/secrets/ovpn-config.ovpn)
-
 				# Resolve server ip from host
 				while [ -z "$SERVER_IP" ]; do
 					sleep 3
@@ -104,12 +112,12 @@
 				${pkgs.iptables}/bin/iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT  # Exception: allow established connections
 				${pkgs.iptables}/bin/iptables -A OUTPUT -p udp -d "$SERVER_IP" --dport "$SERVER_PORT" -j ACCEPT
 
-				# Allow DNS
+				# Get dns ip from resolv.conf
 				DNS_IP=$(${pkgs.gawk}/bin/awk '/^nameserver /{print $2; exit}' /etc/resolv.conf)
+
+				# Allow dns
 				${pkgs.iptables}/bin/iptables -A OUTPUT -o eth0 -p udp -d "$DNS_IP" --dport 53 -j ACCEPT
 				${pkgs.iptables}/bin/iptables -A OUTPUT -o eth0 -p tcp -d "$DNS_IP" --dport 53 -j ACCEPT
-
-				# Allow transmission RPC
 			'';
 
 			system.stateVersion = "26.05";
-- 
cgit v1.2.3