blob: 3df0ddbfe8ebbc3a46ca6d68fe28d3c57052939a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
|
{ config, lib, pkgs, ... }:
with import <stockholm/lib>;
let
daemon-user = "tor";
basicAuth = import <torrent-secrets/auth.nix>;
peer-port = 51412;
web-port = 8112;
daemon-port = 58846;
base-dir = config.makefu.dl-dir;
in {
users.users = {
download = {
name = "download";
home = base-dir;
uid = mkDefault (genid "download");
createHome = true;
useDefaultShell = true;
group = "download";
openssh.authorizedKeys.keys = [ ];
};
};
# todo: race condition, do this after download user has been created
system.activationScripts."download-dir-chmod" = ''
for i in finished watch; do
if test ! -d $i;then
mkdir -p "${base-dir}/$i"
chown rtorrent:download "${base-dir}/$i"
chmod 775 "${base-dir}/$i"
fi
done
'';
users.extraGroups = {
download = {
gid = lib.mkDefault (genid "download");
members = [
config.krebs.build.user.name
"download"
"rtorrent"
"nginx"
];
};
rtorrent.members = [ "download" ];
};
krebs.rtorrent = {
enable = true;
web = {
enable = true;
port = web-port;
inherit basicAuth;
};
rutorrent.enable = true;
enableXMLRPC = true;
listenPort = peer-port;
downloadDir = base-dir + "/finished";
watchDir = base-dir + "/watch";
# dump old torrents into watch folder to have them re-added
};
networking.firewall.extraCommands = ''
iptables -A INPUT -i retiolum -p tcp --dport ${toString web-port} -j ACCEPT
'';
networking.firewall.allowedTCPPorts = [ peer-port ];
networking.firewall.allowedUDPPorts = [ peer-port ];
}
|
