{
	# Container
	containers.transmission = let
		home = "/var/lib/transmission";
		download-dir = "${home}/Downloads";
		incomplete-dir = "${home}/.incomplete";
	in {
		autoStart = true;
		privateNetwork = true;
		hostBridge = "br-lan0";
		localMacAddress = "02:00:00:00:01:47";

		# Download dirs
		bindMounts = {
			"${download-dir}" = {
				hostPath = "/media/ingens/media/dls/transmission/complete";
				isReadOnly = false;
			};
			"${incomplete-dir}" = {
				hostPath = "/media/ingens/media/dls/transmission/incomplete";
				isReadOnly = false;
			};
			"/media/ingens/media" = {
				hostPath = "/media/ingens/media";
				isReadOnly = false;
			};
		};

		config = { lib, ... }: {
			# Network
			networking = {
				enableIPv6 = false;  # Prevent ip leaks
				firewall.allowedTCPPorts = [ 80 51413 ];  # RPC interface + transmission tcp
				firewall.allowedUDPPorts = [ 51413 ];  # transmission udp
				# Override dhcp server settings for default route and dns servers with static settings
				interfaces.eth0.useDHCP = true;
				dhcpcd.extraConfig = ''
					interface eth0
					static routers=192.168.1.9
					static domain_name_servers=9.9.9.9 1.1.1.1
				'';
				#defaultGateway = "192.168.1.9";  # Doesn't work, see above
				#nameservers = [ "9.9.9.9" "1.1.1.1" ];  # Does work, above prevents using dhcp default nameserver
			};

			# Transmission
			services.transmission = {
				inherit home;
				enable = true;
				user = "transmission";

				settings = {
					inherit download-dir incomplete-dir;
					downloadDirPermissions = "775";
				};
			};

			# TODO remove (#258793)
			systemd.services.transmission.serviceConfig = {
				RootDirectoryStartOnly = lib.mkForce null;
				RootDirectory = lib.mkForce null;
			};

			# Reverse proxy
			services.caddy = {
				enable = true;
				virtualHosts.":80".extraConfig = ''
					reverse_proxy localhost:9091
				'';
			};

			system.stateVersion = "26.05";
		};
	};
}