From 90afbfa31af036f4475005cd80dbf6b1722c4de4 Mon Sep 17 00:00:00 2001 From: makefu Date: Sun, 21 Aug 2016 11:55:46 +0200 Subject: m 5 torrent: implement shared torrent secret --- makefu/2configs/torrent.nix | 81 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 81 insertions(+) create mode 100644 makefu/2configs/torrent.nix (limited to 'makefu') diff --git a/makefu/2configs/torrent.nix b/makefu/2configs/torrent.nix new file mode 100644 index 000000000..c18db9fa3 --- /dev/null +++ b/makefu/2configs/torrent.nix @@ -0,0 +1,81 @@ +{ config, lib, pkgs, ... }: + +with config.krebs.lib; + +let + daemon-user = "tor"; + daemon-pw = (import ); + peer-port = 51412; + web-port = 8112; + daemon-port = 58846; + dl-dir = "/var/download"; +in { + # prepare secrets + krebs.build.source.torrent-secrets.file = + if getEnv "dummy_secrets" == "true" + then toString + else "/home/makefu/secrets/torrent"; + + users.users = { + download = { + name = "download"; + home = dl-dir; + uid = genid "download"; + createHome = true; + useDefaultShell = true; + group = "download"; + openssh.authorizedKeys.keys = [ ]; + }; + }; + # todo: race condition, do this after download user has been created + system.activationScripts."download-dir-chmod" = '' + for i in finished torrents; do + mkdir -p "${dl-dir}/$i" + chown download:download "${dl-dir}/$i" + chmod 770 "${dl-dir}/$i" + done + ''; + + users.extraGroups = { + download = { + gid = genid "download"; + members = [ + config.krebs.build.user.name + "download" + "deluge" + ]; + }; + }; + + makefu.deluge = { + enable = true; + auth = "${daemon-user}:${daemon-pw}:10"; + # web.enable = true; + cfg = { + autoadd_enable = true; + download_location = dl-dir + "/finished"; + torrentfiles_location = dl-dir + "/torrents"; copy_torrent_file = true; + lsd = true; + dht = true; + upnp = true; + natpmp = true; + add_paused = false; + allow_remote = true; + remove_seed_at_ratio = false; + move_completed = false; + daemon_port = daemon-port; + listen_ports = [ peer-port peer-port ]; + outgoing_ports = [ peer-port peer-port ]; + # performance tuning + cache_expiry = 3600; + stop_seed_at_ratio = true; + }; + }; + + networking.firewall.extraCommands = '' + iptables -A INPUT -i retiolum -p tcp --dport ${toString daemon-port} -j ACCEPT + ''; + + networking.firewall.allowedTCPPorts = [ peer-port ]; + networking.firewall.allowedUDPPorts = [ peer-port ]; +} -- cgit v1.2.3