services/transmission.nix

@@ -9,44 +9,26 @@ let
 
   domain = config.networking.domain;
   webuiDomain = "transmission.${domain}";
+
+  transmissionRpcPort = 9091;
+  transmissionPeerPort = 30251;
+
+  downloadBase = "/data/downloads/"; # NOTE: to be excluded from backups
 in
 {
   options.my.services.transmission = with lib; {
     enable = mkEnableOption "Transmission torrent client";
-
     username = mkOption {
       type = types.str;
       default = "Ambroisie";
       example = "username";
       description = "Name of the transmission RPC user";
     };
-
     password = mkOption {
       type = types.str;
       example = "password";
       description = "Password of the transmission RPC user";
     };
-
-    downloadBase = mkOption {
-      type = types.str;
-      default = "/data/downloads/";
-      example = "/var/lib/transmission/download";
-      description = "Download base directory";
-    };
-
-    privatePort = mkOption {
-      type = types.port;
-      default = 9091;
-      example = 8080;
-      description = "Internal port for webui";
-    };
-
-    peerPort = mkOption {
-      type = types.port;
-      default = 30251;
-      example = 32323;
-      description = "Peering port";
-    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -54,16 +36,15 @@ in
       enable = true;
       group = "media";
 
-      downloadDirPermissions = "775";
-
       settings = {
-        download-dir = "${cfg.downloadBase}/complete";
+        download-dir = "${downloadBase}/complete";
-        incomplete-dir = "${cfg.downloadBase}/incomplete";
+        incomplete-dir = "${downloadBase}/incomplete";
+        umask = 0; # Make it world-writeable
 
-        peer-port = cfg.peerPort;
+        peer-port = transmissionPeerPort;
 
         rpc-enabled = true;
-        rpc-port = cfg.privatePort;
+        rpc-port = transmissionRpcPort;
         rpc-authentication-required = true;
 
         rpc-username = cfg.username;
@@ -81,12 +62,12 @@ in
       forceSSL = true;
       useACMEHost = domain;
 
-      locations."/".proxyPass = "http://localhost:${toString cfg.privatePort}";
+      locations."/".proxyPass = "http://localhost:${toString transmissionRpcPort}";
     };
 
     networking.firewall = {
-      allowedTCPPorts = [ cfg.peerPort ];
+      allowedTCPPorts = [ transmissionPeerPort ];
-      allowedUDPPorts = [ cfg.peerPort ];
+      allowedUDPPorts = [ transmissionPeerPort ];
     };
   };
 }