From 56edac8252816edca5ea6e77d38d9016e8a3271c Mon Sep 17 00:00:00 2001 From: Ryan Yin Date: Sat, 31 Oct 2026 01:09:16 +0800 Subject: [PATCH] fix(transmission): grant the AppArmor lock permission nixpkgs' transmission 4.1.4 profile grants rw on the daemon's config directory but not k, while 4.1.4 takes a fcntl lock on ~/.config/transmission-daemon/lock, so the daemon exited at startup with "Another process is already using". Include rwk for that one file only. WA-044, drop once the nixpkgs profile carries the permission. Assisted-by: Claude Code (claude-opus-5-5) --- WORKAROUNDS.md | 9 +++++---- hosts/12kingdoms-youko/homelab-services/transmission.nix | 7 +++++++ 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/WORKAROUNDS.md b/WORKAROUNDS.md index 20022d5c..45aa12b8 100644 --- a/WORKAROUNDS.md +++ b/WORKAROUNDS.md @@ -82,10 +82,11 @@ A known limitation with no fix yet. An unfinished feature or gap. -| ID | What & where | Why | Removal condition | Added | Revisit | Status | -| ------ | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------- | ---------- | ----------------------- | ------ | -| WA-013 | NixOS tests — `outputs/README.md` | full-host tests still rebuild custom packages (no private cache) and need the host ssh key to decrypt agenix; the shared-firewall security-exporters VM test now runs in CI (KVM); `outputs/x86_64-linux/nixos-tests/idols-ruby.nix` is exposed as `packages.x86_64-linux.ruby-nixos-tests` but is not in `checks` or CI | Resolve when a private cache exists and tests can run per-service | 2024-03-13 | quarterly | active | -| WA-027 | NFS golden store `no_root_squash` — `hosts/12kingdoms-youko/nfs-golden.nix` | the existing PVC subdirectories are root-owned, so enabling `root_squash` would break running workloads until they are migrated; the CSI node plugin is hostNetwork and sources from the allowlisted node IPs | Drop when the PVC subdirectories are migrated and `root_squash` is enabled | 2026-10-07 | next maintenance window | active | +| ID | What & where | Why | Removal condition | Added | Revisit | Status | +| ------ | -------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------- | ---------- | ------------------------ | ------ | +| WA-013 | NixOS tests — `outputs/README.md` | full-host tests still rebuild custom packages (no private cache) and need the host ssh key to decrypt agenix; the shared-firewall security-exporters VM test now runs in CI (KVM); `outputs/x86_64-linux/nixos-tests/idols-ruby.nix` is exposed as `packages.x86_64-linux.ruby-nixos-tests` but is not in `checks` or CI | Resolve when a private cache exists and tests can run per-service | 2024-03-13 | quarterly | active | +| WA-027 | NFS golden store `no_root_squash` — `hosts/12kingdoms-youko/nfs-golden.nix` | the existing PVC subdirectories are root-owned, so enabling `root_squash` would break running workloads until they are migrated; the CSI node plugin is hostNetwork and sources from the allowlisted node IPs | Drop when the PVC subdirectories are migrated and `root_squash` is enabled | 2026-10-07 | next maintenance window | active | +| WA-044 | transmission AppArmor lock permission — `hosts/12kingdoms-youko/homelab-services/transmission.nix` | nixpkgs' transmission 4.1.4 profile grants `rw` on the daemon's config dir but not `k`, while 4.1.4 takes an fcntl lock on `~/.config/transmission-daemon/lock`; the daemon exits with "Another process is already using". A `local/bin.transmission-daemon` include adds `rwk` for that lock file only | Drop once the nixpkgs profile includes the lock permission | 2026-10-31 | on the next nixpkgs bump | active | ## Related diff --git a/hosts/12kingdoms-youko/homelab-services/transmission.nix b/hosts/12kingdoms-youko/homelab-services/transmission.nix index 02c0ddf6..ccd49a70 100644 --- a/hosts/12kingdoms-youko/homelab-services/transmission.nix +++ b/hosts/12kingdoms-youko/homelab-services/transmission.nix @@ -57,6 +57,13 @@ let ''; in { + # transmission 4.1.4 takes an fcntl lock on its config-dir lock file, but the + # AppArmor profile shipped by nixpkgs grants rw without k (lock), so the + # daemon exits with "Another process is already using". See WORKAROUNDS.md. + security.apparmor.includes."local/bin.transmission-daemon" = '' + /var/lib/transmission/.config/transmission-daemon/lock rwk, + ''; + # Join the shared fileshare group so transmission can read/write files # created by sftpgo, and vice versa (via setgid directories). users.users.${name}.extraGroups = [ "fileshare" ];