Files

T

Clément Désiles 5efc0b0d6e fix(nginx): make Let's Encrypt opt-in per service

certbot cannot issue for internal hostnames (*.nas.local), which made
nginx-enabled services with internal names fail on deploy.

Add a <service>_nginx_letsencrypt flag (default false) and computed
<service>_nginx_ssl_certificate/_key paths: when off the vhost uses the
shared self-signed cert (nginx_default_ssl_cert), when on it uses the
Let's Encrypt lineage. Gate the certbot include on the flag and apply the
pattern to all service roles (deluge, fdroid, gitea, grafana, immich,
metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).

2026-09-21 10:04:47 +02:00

3.1 KiB

Raw Blame History

Deluge Role

Deploys Deluge - a lightweight BitTorrent client with a web UI - using Podman with k8s files. The linuxserver/deluge image runs both deluged and deluge-web.

Prerequisites

The podman role must have been applied to the host first (shared service, intentionally not declared in meta/main.yml to keep deluge deploys fast). Order it before deluge in the playbook for fresh installs.

Role Variables

See defaults/main.yml for all available variables and their default values.

The web UI listens on http://<host>:{{ deluge_web_port }} with the default credentials admin / deluge. Change the password immediately (Preferences → Interface → Password) — the role does not manage it.

Set the inbound port to {{ deluge_torrent_port }} under Preferences → Network, otherwise Deluge picks a random port and the mapped torrent port is useless.

Storage

deluge_config_dir - torrent state, auth and web settings. Must stay on local storage (SQLite over NFS corrupts under concurrent access). Backed up.
deluge_downloads_dir - default save path for completed torrents. May be a network mount (see roles/nfs_client). User data, not backed up.

Ports

Port	Protocol	Purpose
`deluge_web_port` (8112)	tcp	Web UI
`deluge_torrent_port` (6881)	tcp + udp	Incoming peer traffic, DHT/uTP

The thin-client daemon port (58846) is not mapped; add it to the pod manifest if a native Deluge client needs to connect.

Firewall

The role opens deluge_torrent_port (tcp+udp) in ufw for deluge_firewall_allowed_sources (default 0.0.0.0/0 — peers must reach it for a seedbox to work). The web UI port is not opened: expose it via nginx or reach it over the VPN.

Nginx Reverse Proxy

Set deluge_nginx_enabled: true and deluge_nginx_hostname to expose the web UI over HTTPS. TLS is opt-in:

deluge_nginx_letsencrypt: false (default) — use the shared self-signed cert (nginx_default_ssl_cert, generated by the nginx role). Required for internal names like *.nas.local, which Let's Encrypt cannot issue.
deluge_nginx_letsencrypt: true — provision a Let's Encrypt cert via the shared nginx role's certbot tasks. Requires a publicly-resolvable hostname with a DNS record pointing at the host.

The web UI login has no fail2ban coverage (Deluge uses form auth, not HTTP Basic), so don't leave it public. Set deluge_nginx_allowed_sources to the VPN subnet (e.g. ["192.168.30.0/27"]) to restrict the vhost to the tunnel; everything else gets a 403. Empty (the default) leaves it open.

Backup

The role exposes deluge_backup_paths (config only). Add a job in the host inventory to include it:

backup_jobs:
    - name: deluge
      repositories: [next_s3]
      paths: "{{ deluge_backup_paths }}"

Troubleshooting

systemctl --user status deluge
journalctl --user -u deluge -f
podman logs deluge

3.1 KiB Raw Blame History