From a3eaab5a078941ecdd458a0169ce515b7290eca9 Mon Sep 17 00:00:00 2001
From: Adrian Cowan <othrayte@gmail.com>
Date: Mon, 10 Nov 2025 23:27:50 +1100
Subject: [PATCH] Add deluge bittorrent client

---
 2-nomad-config/deluge.nomad.hcl         | 120 ++++++++++++++++++++++++
 2-nomad-config/deluge.tf                |  64 +++++++++++++
 2-nomad-config/secrets/secrets.enc.json |   8 +-
 3 files changed, 190 insertions(+), 2 deletions(-)
 create mode 100644 2-nomad-config/deluge.nomad.hcl
 create mode 100644 2-nomad-config/deluge.tf

diff --git a/2-nomad-config/deluge.nomad.hcl b/2-nomad-config/deluge.nomad.hcl
new file mode 100644
index 0000000..d95cab4
--- /dev/null
+++ b/2-nomad-config/deluge.nomad.hcl
@@ -0,0 +1,120 @@
+job "deluge" {
+  group "deluge" {
+    network {
+      //mode = "bridge"
+      port "http" {
+        to = 8112
+      }
+    }
+
+    task "wireguard" {
+      driver = "docker"
+
+      lifecycle {
+        hook    = "prestart"
+        sidecar = true
+      }
+
+      config {
+        image      = "thrnz/docker-wireguard-pia:latest"
+        privileged = true
+        ports      = ["http"]
+      }
+
+      env {
+        LOC           = "aus_melbourne"
+        LOCAL_NETWORK = "192.168.1.0/24"
+        # PORT_FORWARDING = "1" # TODO: Find a way to tell deluge the forwarded port, the wireguard container outputs it /pia-shared/port.dat
+      }
+
+      template {
+        data        = <<EOH
+USER="{{ with nomadVar "nomad/jobs/deluge" }}{{ .pia_user }}{{ end }}"
+PASS="{{ with nomadVar "nomad/jobs/deluge" }}{{ .pia_pass }}{{ end }}"
+EOH
+        destination = "secrets/pia.env"
+        env         = true # Load the file as environment variables
+      }
+
+      resources {
+        cpu    = 50
+        memory = 32
+      }
+    }
+
+    task "deluge" {
+      driver = "docker"
+
+      config {
+        image        = "lscr.io/linuxserver/deluge:latest"
+        network_mode = "container:wireguard-${NOMAD_ALLOC_ID}" # Share namespace with VPN
+      }
+
+      env {
+        PUID = "1000"
+        PGID = "1000"
+        TZ   = "Australia/Melbourne"
+      }
+
+      volume_mount {
+        volume      = "unraid_appdata_deluge"
+        destination = "/config"
+        read_only   = false
+      }
+
+      volume_mount {
+        volume      = "unraid_media_deluge"
+        destination = "/data/downloads"
+        read_only   = false
+      }
+
+      service {
+        name = "deluge"
+        port = "http"
+
+        tags = [
+          "traefik.enable=true",
+          "traefik.http.routers.deluge.middlewares=auth@file",
+        ]
+
+        check {
+          name     = "alive"
+          type     = "tcp"
+          port     = "http"
+          interval = "10s"
+          timeout  = "2s"
+        }
+      }
+
+      resources {
+        cpu        = 400
+        memory     = 2048
+        memory_max = 3000
+      }
+    }
+
+    volume "unraid_appdata_deluge" {
+      type            = "csi"
+      read_only       = false
+      source          = "unraid_appdata_deluge"
+      access_mode     = "single-node-writer"
+      attachment_mode = "file-system"
+
+      mount_options {
+        mount_flags = ["uid=1000", "gid=1000"]
+      }
+    }
+
+    volume "unraid_media_deluge" {
+      type            = "csi"
+      read_only       = false
+      source          = "unraid_media_deluge"
+      access_mode     = "single-node-writer"
+      attachment_mode = "file-system"
+
+      mount_options {
+        mount_flags = ["uid=1000", "gid=1000"]
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/2-nomad-config/deluge.tf b/2-nomad-config/deluge.tf
new file mode 100644
index 0000000..066115e
--- /dev/null
+++ b/2-nomad-config/deluge.tf
@@ -0,0 +1,64 @@
+
+resource "nomad_job" "deluge" {
+  jobspec = file("deluge.nomad.hcl")
+}
+
+resource "nomad_variable" "deluge" {
+  path = "nomad/jobs/deluge"
+  items = {
+    pia_user = data.sops_file.secrets.data["pia.user"]
+    pia_pass = data.sops_file.secrets.data["pia.pass"]
+  }
+}
+
+resource "nomad_csi_volume_registration" "unraid_appdata_deluge" {
+  #Note: Before chaning the definition of this volume you need to stop the jobs that are using it
+  depends_on = [data.nomad_plugin.smb]
+  plugin_id  = "smb"
+
+  volume_id = "unraid_appdata_deluge"
+  name      = "unraid_appdata_deluge"
+
+  external_id = "unraid_appdata_deluge"
+
+  capability {
+    access_mode     = "single-node-writer"
+    attachment_mode = "file-system"
+  }
+
+  context = {
+    source = "//betelgeuse-seven-unraid.lan/appdata"
+    subDir = "deluge" # Note: Needs to be manually created on the share
+  }
+
+  secrets = {
+    "username" = "nomad"
+    "password" = data.sops_file.secrets.data["unraid.nomad"]
+  }
+}
+
+resource "nomad_csi_volume_registration" "unraid_media_deluge" {
+  #Note: Before chaning the definition of this volume you need to stop the jobs that are using it
+  depends_on = [data.nomad_plugin.smb]
+  plugin_id  = "smb"
+
+  volume_id = "unraid_media_deluge"
+  name      = "unraid_media_deluge"
+
+  external_id = "unraid_media_deluge"
+
+  capability {
+    access_mode     = "single-node-writer"
+    attachment_mode = "file-system"
+  }
+
+  context = {
+    source = "//betelgeuse-seven-unraid.lan/media"
+    subDir = "downloads"
+  }
+
+  secrets = {
+    "username" = "nomad"
+    "password" = data.sops_file.secrets.data["unraid.nomad"]
+  }
+}
diff --git a/2-nomad-config/secrets/secrets.enc.json b/2-nomad-config/secrets/secrets.enc.json
index 646c4a2..f57f3d2 100644
--- a/2-nomad-config/secrets/secrets.enc.json
+++ b/2-nomad-config/secrets/secrets.enc.json
@@ -36,6 +36,10 @@
 	"sonarr": {
 		"database_pw": "ENC[AES256_GCM,data:TN381ZYJLeUHX9U3Jnd9+w==,iv:lKaMYHeaSGXJd0/EGxkDY2l2v62xG3xs8TVC0HwXL94=,tag:3z5rK+2RfJHJdQc7KC9KmA==,type:str]"
 	},
+	"pia": {
+		"user": "ENC[AES256_GCM,data:kniAs2gCTq4=,iv:1Oaht02fFSQwzWmWEtjsJZCJChPJsZhwRyux8dMY2CU=,tag:NqWaUhuYTSFZZK/CpSisdg==,type:str]",
+		"pass": "ENC[AES256_GCM,data:c8qWGcaI0p7MyQ==,iv:/3ehYrgdDwjzFdXyX/vKTK+zt6u7gWNRZBIdWDG1KiE=,tag:jqfIMnB1OKchBZ4U2s1o4g==,type:str]"
+	},
 	"sops": {
 		"age": [
 			{
@@ -43,8 +47,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByUWM4ZDVVbGFrUGdMRHBX\nUFBmU3Nlc0RBSzhFK0tHNHpkQXUvUVdiZUZJCmpRN1lFdENpWW0rcThjVlVQNUl6\nWnlLU0RnQ3FZby81Ly8xTFBrek9nMncKLS0tIFQ4UTRNOC9CRmx4OFJWem1wckZz\nUDFTSzdWZldFK3FqcTNWTWRyNDhHQ2MKS811mR5xn7qiC/aVgPFYJ5c6Q3zxRfcr\nHcvxUvB01vNJKZpRg92vvKPkV6lQO3DXCT98OdfwiymlEOvYxg71Pg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-11-07T09:57:48Z",
-		"mac": "ENC[AES256_GCM,data:DPNWxb9zDNLZ5sIBgOvQ+Gky+F+B3MDA9pOcDkBlb7w7WhmOx1rAXzeK3FCbJDb/y6CQnTPHRQWAPo8bgikIrprmP3zxbSTRJVwKcgVj96KnpRCClVeRwOv7AuYOyxIF/xpUL98/SKciVZvcNh/gUqxt7vq3EsBw1yEAGORSKq0=,iv:Vzrpr19T39nVFHFMMcXivHacCgqS1X2+IcI311+er1I=,tag:ZwG0znMH3hoJ4o8WmOUm+g==,type:str]",
+		"lastmodified": "2025-11-10T12:23:50Z",
+		"mac": "ENC[AES256_GCM,data:vCc3DG0TQrF+mnjX1ZtIzPbZaLQ1DC6MLmcZUTFl2uVkGc4cIImcQMes8U9yU7ftuOAqRWnAwWX2BFrFTq5FLfMH3rmRHgImbD3P0HQpD1Yx6ktnUixNeu/knTmLBD52euzPzc8e5RUIHtlwzWLkEFUYR5pzfPHt7CQ/6J60nhU=,iv:5eXIg5PPP9v5UjXOF/XQga/R7WUTkeFyTGCSKSeZjmE=,tag:zJAcuoFMGt0BcJdSP0tFZQ==,type:str]",
 		"encrypted_regex": "^(.*)$",
 		"version": "3.10.2"
 	}