# Transmission — the daemon Officer's transmission sidecar drives over RPC.
#
# Rendered by setup.sh; ${...} are substituted before this reaches disk. Everything the container keeps
# lives beside this file, so `ls` answers "what is this service storing" without docker involved.
name: officer-transmission

services:
  transmission:
    image: lscr.io/linuxserver/transmission:latest
    container_name: officer-transmission
    restart: unless-stopped

    # As the installing user, so completed downloads are not root-owned — the single most annoying
    # thing about a container that writes to a shared folder.
    user: '${OFFICER_UID}:${OFFICER_GID}'

    environment:
      - PUID=${OFFICER_UID}
      - PGID=${OFFICER_GID}
      - TZ=${OFFICER_TZ}
      # Blank means no RPC auth, which is Transmission's normal posture and is safe HERE specifically
      # because the RPC port is bound to loopback below. setup.sh fills these only if the user asked for
      # credentials; an empty USER is not the same as the variable being unset.
      - USER=${TRANSMISSION_USER}
      - PASS=${TRANSMISSION_PASS}

    ports:
      # Loopback only. Officer talks to this over 127.0.0.1; nothing else has any business reaching the
      # RPC endpoint, and publishing it on all interfaces would put an unauthenticated control API on the
      # network because "no auth" is the default above.
      - '127.0.0.1:${TRANSMISSION_PORT}:9091'
      # Peer traffic, and the exception to the loopback rule: BitTorrent peers must be able to connect
      # inbound or the client is crippled to outbound-only connections.
      - '${TRANSMISSION_PEER_PORT}:51413'
      - '${TRANSMISSION_PEER_PORT}:51413/udp'

    volumes:
      - ./config:/config
      - ./downloads:/downloads
      - ./watch:/watch
