diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 88715af4dc0e1..5e7d7b203e95d 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1479,6 +1479,7 @@
./services/web-apps/pretix.nix
./services/web-apps/prosody-filer.nix
./services/web-apps/rimgo.nix
+ ./services/web-apps/rutorrent.nix
./services/web-apps/screego.nix
./services/web-apps/sftpgo.nix
./services/web-apps/suwayomi-server.nix
diff --git a/nixos/modules/services/web-apps/rutorrent.nix b/nixos/modules/services/web-apps/rutorrent.nix
new file mode 100644
index 0000000000000..cce701fef4978
--- /dev/null
+++ b/nixos/modules/services/web-apps/rutorrent.nix
@@ -0,0 +1,302 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.services.rutorrent;
+
+ rtorrentPluginDependencies = with pkgs; {
+ _task = [ procps ];
+ unpack = [ unzip unrar ];
+ rss = [ curl ];
+ mediainfo = [ mediainfo ];
+ spectrogram = [ sox ];
+ screenshots = [ ffmpeg ];
+ };
+
+ phpPluginDependencies = with pkgs; {
+ _cloudflare = [ python3 ];
+ };
+
+ getPluginDependencies = dependencies: concatMap (p: attrByPath [ p ] [] dependencies);
+
+in {
+ options = {
+ services.rutorrent = {
+ enable = mkEnableOption "ruTorrent";
+
+ hostName = mkOption {
+ type = types.str;
+ description = "FQDN for the ruTorrent instance.";
+ };
+
+ dataDir = mkOption {
+ type = types.str;
+ default = "/var/lib/rutorrent";
+ description = "Storage path of ruTorrent.";
+ };
+
+ user = mkOption {
+ type = types.str;
+ default = "rutorrent";
+ description = ''
+ User which runs the ruTorrent service.
+ '';
+ };
+
+ group = mkOption {
+ type = types.str;
+ default = "rutorrent";
+ description = ''
+ Group which runs the ruTorrent service.
+ '';
+ };
+
+ rpcSocket = mkOption {
+ type = types.str;
+ default = config.services.rtorrent.rpcSocket;
+ defaultText = "config.services.rtorrent.rpcSocket";
+ description = ''
+ Path to rtorrent rpc socket.
+ '';
+ };
+
+ plugins = mkOption {
+ type = with types; listOf (either str package);
+ default = [ "httprpc" ];
+ example = literalExpression ''[ "httprpc" "data" "diskspace" "edit" "erasedata" "theme" "trafic" ]'';
+ description = ''
+ List of plugins to enable. See the list of available plugins. Note: the unpack plugin needs the nonfree unrar package.
+ You need to either enable one of the rpc or httprpc plugin or enable the option.
+ '';
+ };
+
+ poolSettings = mkOption {
+ type = with types; attrsOf (oneOf [ str int bool ]);
+ default = {
+ "pm" = "dynamic";
+ "pm.max_children" = 32;
+ "pm.start_servers" = 2;
+ "pm.min_spare_servers" = 2;
+ "pm.max_spare_servers" = 4;
+ "pm.max_requests" = 500;
+ };
+ description = ''
+ Options for ruTorrent's PHP pool. See the documentation on php-fpm.conf for details on configuration directives.
+ '';
+ };
+
+ nginx = {
+ enable = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Whether to enable nginx virtual host management.
+ Further nginx configuration can be done by adapting services.nginx.virtualHosts.<name>.
+ See for further information.
+ '';
+ };
+
+ exposeInsecureRPC2mount = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ If you do not enable one of the rpc or httprpc plugins you need to expose an RPC mount through scgi using this option.
+ Warning: This allow to run arbitrary commands, as the rtorrent user, so make sure to use authentification. The simplest way would be to use the services.nginx.virtualHosts.<name>.basicAuth option.
+ '';
+ };
+ };
+ };
+ };
+
+ config = mkIf cfg.enable (mkMerge [
+ { assertions = let
+ usedRpcPlugins = intersectLists cfg.plugins [ "httprpc" "rpc" ];
+ in [
+ { assertion = (length usedRpcPlugins < 2);
+ message = "Please specify only one of httprpc or rpc plugins";
+ }
+ { assertion = !(length usedRpcPlugins > 0 && cfg.nginx.exposeInsecureRPC2mount);
+ message = "Please do not use exposeInsecureRPC2mount if you use one of httprpc or rpc plugins";
+ }
+ ];
+
+ warnings = let
+ nginxVhostCfg = config.services.nginx.virtualHosts."${cfg.hostName}";
+ in []
+ ++ (optional (cfg.nginx.exposeInsecureRPC2mount && (nginxVhostCfg.basicAuth == {} || nginxVhostCfg.basicAuthFile == null )) ''
+ You are using exposeInsecureRPC2mount without using basic auth on the virtual host. The exposed rpc mount allow for remote command execution.
+
+ Please make sure it is not accessible from the outside.
+ '');
+
+ systemd = {
+ services = {
+ rtorrent.path = getPluginDependencies rtorrentPluginDependencies cfg.plugins;
+ rutorrent-setup = let
+ rutorrentConfig = pkgs.writeText "rutorrent-config.php" ''
+ false,
+ 'proto' => 'http', // 'http' or 'https'
+ 'host' => 'PROXY_HOST_HERE',
+ 'port' => 3128
+ );
+
+ @define('RPC_TIME_OUT', 5, true); // in seconds
+
+ @define('LOG_RPC_CALLS', false, true);
+ @define('LOG_RPC_FAULTS', true, true);
+
+ // for php
+ @define('PHP_USE_GZIP', false, true);
+ @define('PHP_GZIP_LEVEL', 2, true);
+
+ $schedule_rand = 10; // rand for schedulers start, +0..X seconds
+
+ $do_diagnostic = true;
+ $log_file = '${cfg.dataDir}/logs/errors.log'; // path to log file (comment or leave blank to disable logging)
+
+ $saveUploadedTorrents = true; // Save uploaded torrents to profile/torrents directory or not
+ $overwriteUploadedTorrents = false; // Overwrite existing uploaded torrents in profile/torrents directory or make unique name
+
+ $topDirectory = '/'; // Upper available directory. Absolute path with trail slash.
+ $forbidUserSettings = false;
+
+ $scgi_port = 0;
+ $scgi_host = "unix://${cfg.rpcSocket}";
+
+ $XMLRPCMountPoint = "/RPC2"; // DO NOT DELETE THIS LINE!!! DO NOT COMMENT THIS LINE!!!
+
+ $throttleMaxSpeed = 327625*1024;
+
+ $pathToExternals = array(
+ "php" => "${pkgs.php}/bin/php", // Something like /usr/bin/php. If empty, will be found in PATH.
+ "curl" => "${pkgs.curl}/bin/curl", // Something like /usr/bin/curl. If empty, will be found in PATH.
+ "gzip" => "${pkgs.gzip}/bin/gzip", // Something like /usr/bin/gzip. If empty, will be found in PATH.
+ "id" => "${pkgs.coreutils}/bin/id", // Something like /usr/bin/id. If empty, will be found in PATH.
+ "stat" => "${pkgs.coreutils}/bin/stat", // Something like /usr/bin/stat. If empty, will be found in PATH.
+ "pgrep" => "${pkgs.procps}/bin/pgrep", // TODO why can't we use phpEnv.PATH
+ );
+
+ $localhosts = array( // list of local interfaces
+ "127.0.0.1",
+ "localhost",
+ );
+
+ $profilePath = '${cfg.dataDir}/share'; // Path to user profiles
+ $profileMask = 0770; // Mask for files and directory creation in user profiles.
+ // Both Webserver and rtorrent users must have read-write access to it.
+ // For example, if Webserver and rtorrent users are in the same group then the value may be 0770.
+
+ $tempDirectory = null; // Temp directory. Absolute path with trail slash. If null, then autodetect will be used.
+
+ $canUseXSendFile = false; // If true then use X-Sendfile feature if it exist
+
+ $locale = "UTF8";
+ '';
+ in {
+ wantedBy = [ "multi-user.target" ];
+ before = [ "phpfpm-rutorrent.service" ];
+ script = ''
+ ln -sf ${pkgs.rutorrent}/{css,images,js,lang,index.html} ${cfg.dataDir}/
+ mkdir -p ${cfg.dataDir}/{conf,logs,plugins} ${cfg.dataDir}/share/{settings,torrents,users}
+ ln -sf ${pkgs.rutorrent}/conf/{access.ini,plugins.ini} ${cfg.dataDir}/conf/
+ ln -sf ${rutorrentConfig} ${cfg.dataDir}/conf/config.php
+
+ cp -r ${pkgs.rutorrent}/php ${cfg.dataDir}/
+
+ ${optionalString (cfg.plugins != [])
+ ''cp -r ${concatMapStringsSep " " (p: "${pkgs.rutorrent}/plugins/${p}") cfg.plugins} ${cfg.dataDir}/plugins/''}
+
+ chown -R ${cfg.user}:${cfg.group} ${cfg.dataDir}/{conf,share,logs,plugins}
+ chmod -R 755 ${cfg.dataDir}/{conf,share,logs,plugins}
+ '';
+ serviceConfig.Type = "oneshot";
+ };
+ };
+
+ tmpfiles.rules = [ "d '${cfg.dataDir}' 0775 ${cfg.user} ${cfg.group} -" ];
+ };
+
+ users.groups."${cfg.group}" = {};
+
+ users.users = {
+ "${cfg.user}" = {
+ home = cfg.dataDir;
+ group = cfg.group;
+ extraGroups = [ config.services.rtorrent.group ];
+ description = "ruTorrent Daemon user";
+ isSystemUser = true;
+ };
+
+ "${config.services.rtorrent.user}" = {
+ extraGroups = [ cfg.group ];
+ };
+ };
+ }
+
+ (mkIf cfg.nginx.enable (mkMerge [
+ { services = {
+ phpfpm.pools.rutorrent = let
+ envPath = lib.makeBinPath (getPluginDependencies phpPluginDependencies cfg.plugins);
+ pool = {
+ user = cfg.user;
+ group = config.services.rtorrent.group;
+ settings = mapAttrs (name: mkDefault) {
+ "listen.owner" = config.services.nginx.user;
+ "listen.group" = config.services.nginx.group;
+ } // cfg.poolSettings;
+ };
+ in if (envPath == "") then pool else pool // { phpEnv.PATH = envPath; };
+
+ nginx = {
+ enable = true;
+ virtualHosts = {
+ ${cfg.hostName} = {
+ root = cfg.dataDir;
+ locations = {
+ "~ [^/]\.php(/|$)" = {
+ extraConfig = ''
+ fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+ if (!-f $document_root$fastcgi_script_name) {
+ return 404;
+ }
+
+ # Mitigate https://httpoxy.org/ vulnerabilities
+ fastcgi_param HTTP_PROXY "";
+
+ fastcgi_pass unix:${config.services.phpfpm.pools.rutorrent.socket};
+ fastcgi_index index.php;
+
+ include ${pkgs.nginx}/conf/fastcgi.conf;
+ '';
+ };
+ };
+ };
+ };
+ };
+ };
+ }
+
+ (mkIf cfg.nginx.exposeInsecureRPC2mount {
+ services.nginx.virtualHosts."${cfg.hostName}".locations."/RPC2" = {
+ extraConfig = ''
+ include ${pkgs.nginx}/conf/scgi_params;
+ scgi_pass unix:${cfg.rpcSocket};
+ '';
+ };
+
+ services.rtorrent.group = "nginx";
+ })
+ ]))
+ ]);
+}
diff --git a/pkgs/by-name/ru/rutorrent/package.nix b/pkgs/by-name/ru/rutorrent/package.nix
new file mode 100644
index 0000000000000..eeff6207d9151
--- /dev/null
+++ b/pkgs/by-name/ru/rutorrent/package.nix
@@ -0,0 +1,25 @@
+{stdenv, lib, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+ pname = "rutorrent";
+ version = "4.2.10";
+
+ src = fetchFromGitHub {
+ owner = "Novik";
+ repo = "ruTorrent";
+ rev = "v${version}";
+ sha256 = "Hkh2fWaZpJLxUYaojR97XVQWXTRzmFkQe4xKsmY1E8M=";
+ };
+
+ installPhase = ''
+ mkdir -p $out/
+ cp -r . $out/
+ '';
+
+ meta = with lib; {
+ description = "Yet another web front-end for rTorrent";
+ homepage = "https://github.com/Novik/ruTorrent";
+ license = licenses.gpl3Plus;
+ platforms = platforms.unix;
+ };
+}