Clément Désiles
5efc0b0d6e
certbot cannot issue for internal hostnames (*.nas.local), which made nginx-enabled services with internal names fail on deploy. Add a <service>_nginx_letsencrypt flag (default false) and computed <service>_nginx_ssl_certificate/_key paths: when off the vhost uses the shared self-signed cert (nginx_default_ssl_cert), when on it uses the Let's Encrypt lineage. Gate the certbot include on the flag and apply the pattern to all service roles (deluge, fdroid, gitea, grafana, immich, metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).
67 lines
3.1 KiB
Markdown
67 lines
3.1 KiB
Markdown
# Deluge Role
|
|
|
|
Deploys [Deluge](https://deluge-torrent.org/) - a lightweight BitTorrent client with a web UI - using Podman with k8s files. The `linuxserver/deluge` image runs both `deluged` and `deluge-web`.
|
|
|
|
## Prerequisites
|
|
|
|
The `podman` role must have been applied to the host first (shared service, intentionally not declared in `meta/main.yml` to keep deluge deploys fast). Order it before `deluge` in the playbook for fresh installs.
|
|
|
|
## Role Variables
|
|
|
|
See `defaults/main.yml` for all available variables and their default values.
|
|
|
|
## First Login
|
|
|
|
The web UI listens on `http://<host>:{{ deluge_web_port }}` with the default credentials `admin` / `deluge`. **Change the password immediately** (Preferences → Interface → Password) — the role does not manage it.
|
|
|
|
Set the inbound port to `{{ deluge_torrent_port }}` under Preferences → Network, otherwise Deluge picks a random port and the mapped torrent port is useless.
|
|
|
|
## Storage
|
|
|
|
- `deluge_config_dir` - torrent state, auth and web settings. Must stay on local storage (SQLite over NFS corrupts under concurrent access). Backed up.
|
|
- `deluge_downloads_dir` - default save path for completed torrents. May be a network mount (see `roles/nfs_client`). User data, not backed up.
|
|
|
|
## Ports
|
|
|
|
| Port | Protocol | Purpose |
|
|
| ---------------------------- | --------- | ------------------------------ |
|
|
| `deluge_web_port` (8112) | tcp | Web UI |
|
|
| `deluge_torrent_port` (6881) | tcp + udp | Incoming peer traffic, DHT/uTP |
|
|
|
|
The thin-client daemon port (58846) is not mapped; add it to the pod manifest if a native Deluge client needs to connect.
|
|
|
|
## Firewall
|
|
|
|
The role opens `deluge_torrent_port` (tcp+udp) in ufw for
|
|
`deluge_firewall_allowed_sources` (default `0.0.0.0/0` — peers must reach it for
|
|
a seedbox to work). The web UI port is not opened: expose it via nginx or reach
|
|
it over the VPN.
|
|
|
|
## Nginx Reverse Proxy
|
|
|
|
Set `deluge_nginx_enabled: true` and `deluge_nginx_hostname` to expose the web UI over HTTPS. TLS is opt-in:
|
|
|
|
- `deluge_nginx_letsencrypt: false` (default) — use the shared self-signed cert (`nginx_default_ssl_cert`, generated by the `nginx` role). Required for internal names like `*.nas.local`, which Let's Encrypt cannot issue.
|
|
- `deluge_nginx_letsencrypt: true` — provision a Let's Encrypt cert via the shared `nginx` role's certbot tasks. Requires a publicly-resolvable hostname with a DNS record pointing at the host.
|
|
|
|
The web UI login has no fail2ban coverage (Deluge uses form auth, not HTTP Basic), so don't leave it public. Set `deluge_nginx_allowed_sources` to the VPN subnet (e.g. `["192.168.30.0/27"]`) to restrict the vhost to the tunnel; everything else gets a 403. Empty (the default) leaves it open.
|
|
|
|
## Backup
|
|
|
|
The role exposes `deluge_backup_paths` (config only). Add a job in the host inventory to include it:
|
|
|
|
```yaml
|
|
backup_jobs:
|
|
- name: deluge
|
|
repositories: [next_s3]
|
|
paths: "{{ deluge_backup_paths }}"
|
|
```
|
|
|
|
## Troubleshooting
|
|
|
|
```sh
|
|
systemctl --user status deluge
|
|
journalctl --user -u deluge -f
|
|
podman logs deluge
|
|
```
|