Transmission SSL 설정하기

토렌트 머신으로 사용할 때 Transmission을 설치해서 사용한다. 우분투에서도 https://blog.dasomoli.org/raspberrypi-torrent-%eb%a8%b8%ec%8b%a0-%eb%a7%8c%eb%93%a4%ea%b8%b0/ 의 내용을 그대로 설정하면 된다. 이대로 설정하면 http 프로토콜을 이용하게 되는데, 여기서 한 단계 더 나아가서 SSL 설정을 통해 https를 쓰도록 설정하자. letsencrypt 인증서를 사용하는 certbot을 사용하면, 설정은 매우 간단하다.

# certbot --apache

실행 예제 화면은 다음과 같다.

root@bamtol:/etc/letsencrypt# certbot --apache
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: blog.dasomoli.org
2: torrent.dasomoli.org
3: www.dasomoli.org
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 2

Requesting a certificate for torrent.dasomoli.org

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/torrent.dasomoli.org/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/torrent.dasomoli.org/privkey.pem
This certificate expires on 2023-06-07.
These files will be updated when the certificate renews.

Deploying certificate
Successfully deployed certificate for torrent.dasomoli.org to /etc/apache2/sites-available/torrent.dasomoli.org-le-ssl.conf
Congratulations! You have successfully enabled HTTPS on https://torrent.dasomoli.org

NEXT STEPS:
- The certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in the background, but you may need to take steps to enable that functionality. See https://certbot.org/renewal-setup for instructions.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

그럼 /etc/apache2/sites-enabled/torrent.dasomoli.org-le-ssl.conf 파일이 생성되는데 여기에 SSLProxyEngine on 옵션을 추가해준다. 그럼 이렇게 된다.

<IfModule mod_ssl.c>
<VirtualHost *:443>
        # The ServerName directive sets the request scheme, hostname and port that
        # the server uses to identify itself. This is used when creating
        # redirection URLs. In the context of virtual hosts, the ServerName
        # specifies what hostname must appear in the request's Host: header to
        # match this virtual host. For the default virtual host (this file) this
        # value is not decisive as it is used as a last resort host regardless.
        # However, you must set it for any further virtual host explicitly.
        ServerName torrent.dasomoli.org
        ServerAdmin dasomoli@gmail.com

        ProxyPass / http://localhost:9000/
        ProxyPassReverse / http://localhost:9000/

        # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
        # error, crit, alert, emerg.
        # It is also possible to configure the loglevel for particular
        # modules, e.g.
        #LogLevel info ssl:warn

        ErrorLog ${APACHE_LOG_DIR}/torrent.log
        CustomLog ${APACHE_LOG_DIR}/torrent.access.log combined

        # For most configuration files from conf-available/, which are
        # enabled or disabled at a global level, it is possible to
        # include a line for only one particular virtual host. For example the
        # following line enables the CGI configuration for this host only
        # after it has been globally disabled with "a2disconf".
        #Include conf-available/serve-cgi-bin.conf


SSLCertificateFile /etc/letsencrypt/live/torrent.dasomoli.org/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/torrent.dasomoli.org/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
SSLProxyEngine on
</VirtualHost>
</IfModule>

이게 끝. apache2 서비스를 재시작한 후 https로 접근한다.

[RaspberryPi] Torrent 머신 만들기

Torrent 파일을 등록해놓으면, 집에 있는 서버에 해당 파일을 자동으로 다운로드 받아놓는다. transmission을 설치하면 된다.

# apt-get install transmission-cli transmission-common transmission-daemon
# service transmission-daemon stop
# vi /etc/transmission-daemon/settings.json

설정 파일의 다음 항목을 수정한다.

"download-dir": "/mnt/NAS/TorrentDownload",
"rpc-username": "dasomoli",
"rpc-password": "password",
"rpc-whitelist-enabled": false,
"umask": 2,

업로드 속도를 제한하고 싶다면 다음을 수정한다. 예를 들어, 10 KB/sec 로 제한한다면

"speed-limit-up": 10,
"speed-limit-up-enabled": true,

기본 포트를 바꾸고 싶다면 다음을 수정한다.

"rpc-port": 9000

# service transmission-daemon reload
# usermod -aG debian-transmission dasomoli

download-dir은 다운로드 받을 디렉토리, rpc-username은 웹 인터페이스로 들어갈 때 로그인 할 ID, rpc-password는 그 Password이다. rpc-whitelist-enabled를 false 로 설정하면, 말 그대로 whitelist를 사용하지 않으므로, 어디에서든 접속이 가능하다.

접속은 기본은 9091 포트로 접속하면 된다. 위에선 9000으로 바꿨다. 하지만, 포트 번호를 치긴 귀찮으므로 apache2의 proxy를 이용해서 접속하자.

# vi /etc/apache2/sites-available/torrent.dasomoli.org.conf

<VirtualHost *:80>
        # The ServerName directive sets the request scheme, hostname and port that
        # the server uses to identify itself. This is used when creating
        # redirection URLs. In the context of virtual hosts, the ServerName
        # specifies what hostname must appear in the request's Host: header to
        # match this virtual host. For the default virtual host (this file) this
        # value is not decisive as it is used as a last resort host regardless.
        # However, you must set it for any further virtual host explicitly.
        ServerName torrent.dasomoli.org
        ServerAdmin dasomoli@gmail.com

        ProxyPass / http://localhost:9000/
        ProxyPassReverse / http://localhost:9000/

        # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
        # error, crit, alert, emerg.
        # It is also possible to configure the loglevel for particular
        # modules, e.g.
        #LogLevel info ssl:warn

        ErrorLog ${APACHE_LOG_DIR}/torrent.log
        CustomLog ${APACHE_LOG_DIR}/torrent.access.log combined

        # For most configuration files from conf-available/, which are
        # enabled or disabled at a global level, it is possible to
        # include a line for only one particular virtual host. For example the
        # following line enables the CGI configuration for this host only
        # after it has been globally disabled with "a2disconf".
        #Include conf-available/serve-cgi-bin.conf
</VirtualHost>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

이제 proxy 모듈을 enable하고, site를 enable한 후, apache2를 재시작하자.

# a2enmod proxy
# a2enmod proxy_http
# a2ensite torrent.dasomoli.org.conf
# service apache2 restart

# sudo service transmission-daemon start

이제 http://torrent.dasomoli.org 로 접속하면 된다.
당연히 미리 DNS설정은 되어 있어야 한다.

부팅 시에 Web UI 가 연결이 안되는 경우가 있는데, 이 때는 transmission-daemon을 reload 하면 된다. 수많은 해결(이라고 주장하는) 방법이 있지만, 가장 간단하면서 잘 동작하는 방법은 그냥 raspi-config에서 “Network at Boot:”의 “Wait for network”을 체크하는 것이다.

가장 간단하지만 잘 동작하는 허무한 해결책…

참고: https://askubuntu.com/questions/157455/how-to-change-the-default-permissions-of-files-created-by-transmission-daemon