# Deluge Role

Deploys [Deluge](https://deluge-torrent.org/) - a lightweight BitTorrent client with a web UI - using Podman with k8s files. The `linuxserver/deluge` image runs both `deluged` and `deluge-web`.

## Prerequisites

The `podman` role must have been applied to the host first (shared service, intentionally not declared in `meta/main.yml` to keep deluge deploys fast). Order it before `deluge` in the playbook for fresh installs.

## Role Variables

See `defaults/main.yml` for all available variables and their default values.

## First Login

The web UI listens on `http://<host>:{{ deluge_web_port }}` with the default credentials `admin` / `deluge`. **Change the password immediately** (Preferences → Interface → Password) — the role does not manage it.

Set the inbound port to `{{ deluge_torrent_port }}` under Preferences → Network, otherwise Deluge picks a random port and the mapped torrent port is useless.

## Storage

- `deluge_config_dir` - torrent state, auth and web settings. Must stay on local storage (SQLite over NFS corrupts under concurrent access). Backed up.
- `deluge_downloads_dir` - default save path for completed torrents. May be a network mount (see `roles/nfs_client`). User data, not backed up.

## Ports

| Port                         | Protocol  | Purpose                        |
| ---------------------------- | --------- | ------------------------------ |
| `deluge_web_port` (8112)     | tcp       | Web UI                         |
| `deluge_torrent_port` (6881) | tcp + udp | Incoming peer traffic, DHT/uTP |

The thin-client daemon port (58846) is not mapped; add it to the pod manifest if a native Deluge client needs to connect.

## Firewall

The role opens `deluge_torrent_port` (tcp+udp) in ufw for
`deluge_firewall_allowed_sources` (default `0.0.0.0/0` — peers must reach it for
a seedbox to work). The web UI port is not opened: expose it via nginx or reach
it over the VPN.

## Nginx Reverse Proxy

Set `deluge_nginx_enabled: true` and `deluge_nginx_hostname` to expose the web UI over HTTPS. TLS is opt-in:

- `deluge_nginx_letsencrypt: false` (default) — use the shared self-signed cert (`nginx_default_ssl_cert`, generated by the `nginx` role). Required for internal names like `*.nas.local`, which Let's Encrypt cannot issue.
- `deluge_nginx_letsencrypt: true` — provision a Let's Encrypt cert via the shared `nginx` role's certbot tasks. Requires a publicly-resolvable hostname with a DNS record pointing at the host.

The web UI login has no fail2ban coverage (Deluge uses form auth, not HTTP Basic), so don't leave it public. Set `deluge_nginx_allowed_sources` to the VPN subnet (e.g. `["192.168.30.0/27"]`) to restrict the vhost to the tunnel; everything else gets a 403. Empty (the default) leaves it open.

## Backup

The role exposes `deluge_backup_paths` (config only). Add a job in the host inventory to include it:

```yaml
backup_jobs:
    - name: deluge
      repositories: [next_s3]
      paths: "{{ deluge_backup_paths }}"
```

## Troubleshooting

```sh
systemctl --user status deluge
journalctl --user -u deluge -f
podman logs deluge
```