transmission: production config

hosts/paidh-dha.nix

@@ -5,6 +5,8 @@
 {
   imports = [
     ../networks/pi3B_rack.nix
+    ../profiles/transmission.nix
+    ../secrets/transmission.nix
   ];
 
   # Comment out deployment when building the SD Image.

profiles/transmission.nix

@@ -6,10 +6,17 @@
 
   services = {
     transmission = {
-      enable = true;                                   # Enable Transmission
+      enable = true;                              # Enable Transmission
+      credentialsFile = "/run/keys/transmission"; # Authentication secrets
+      settings = {
+        rpc-authentication-required = true;       # Enforce authentication
+        rpc-bind-address = "0.0.0.0";             # Listen on all interfaces
+        rpc-whitelist = "127.0.0.1,10.42.0.*";    # Allow hosts on the LAN
+      };
     };
     cron = {
       enable = true;
+      # Run transmission while everyone's asleep
       systemCronJobs = [
         "55 0 * * * transmission systemctl enable transmission-daemon"
         "00 1 * * * transmission systemctl start transmission-daemon"
@@ -19,6 +26,9 @@
     };
   };
 
-  networking.firewall.allowedTCPPorts = [ 9091 ];   # Open the required firewall ports
+  networking.firewall.allowedTCPPorts = [ 9091 ];   # Open the rpc firewall port
+
+  # Allow transmission to read the secrets keys
+  users.groups.keys.members = [ "transmission" ];
 
 }