haugene / docker-transmission-openvpn Goto Github PK

When starting up transmission we should bind it to the IP given to us from PIA. This should prevent leaking our IP.

The transmission setting is bind-address-ipv4.

Script to get the IP of tun0:

# ifconfig tun0 | sed -n '2 p' | awk '{print $2}' | cut -d: -f2
10.181.1.6

Things to consider

• What if the IP changes?
• Will the interface always be tun0?

Should create a common config file that contains pia username/pass etc and can be passed as a parameter to the "docker run" command. Should be able to specify which .ovpn config to use.

If you would accept a PR, I'd like to create env vars that will override the transmissions config options at start up. This would let the image be a lot more configurable, without requiring a user to mount a config folder.

What do you think?

Hello, first of all I'm new to docker. I was looking for something to run my transmission deamon and this seems perfect. I have followed this guide and for some reason, I think I'm running into routing issues. I've created the other container with nginx proxy rinning in it, but I get "409: conflict" when I try to access the transmission proxy.

Do I have to do something else to make it work?

Thanks in advance.

I have openmediavault 2.3 running with couchpotato installed in the host and sickrage running in a docker container. I downloaded the transmission-openvpn container and I'm having a few issues that need some help with. I'm fairly new to docker so I might be overlooking some details. btw docker is running on the openmediavault host. 1st issue I encountered is that when I run the container port 9091 shows as filtered on both eth0 and eth1. port only shows open for localhost and the docker interface. For some reason if I use localhost instead of the IP of the docker instance (or maybe is because I'm connecting via LAN) it shows the frame of transmission but no content. Again all these are details. If I vpn into my openmediavault server transmission displays correctly. Now, my real problem is that couchpotato is snatching the torrents but they are not populating in transmission por some reason. In Sickrage (docker) it's able to send the torrents and download them but after the files are downloaded sickrage is supposed to move them over to the shows folder and it's apparently deleting them instead. Please advise.

First off top marks for one of the best dockers images and guides that I have come across, I had this setup on my Sinology within a few hours and everything just worked.

one tiny change with DMS 6 I had to use

docker run --name TransmissionVPN --privileged -d -v /volume1/DockerVPN/resolv.conf:/etc/resolv.conf -v /volume1/DockerVPN/:/data -e "OPENVPN_PROVIDER=PIA" -e "OPENVPN_CONFIG=Netherlands" -e "OPENVPN_USERNAME=p111111111" -e "OPENVPN_PASSWORD=whatever" -p 9091:9091 haugene/transmission-openvpn

Putting --name TransmissionVPN at the end of the command failed.

The Docker image is using a PIA VPN'ed IP address within the subnet range of 40.0.0.0/8 and the NAS is using an ISP IP address within the subnet range of 101.0.0.0/8 . The strange bit is that I can get to transmission from my Mac without any proxy/NGINX, just using 192.168.0.22:9010 the NAS's local lan IP address. I have even tested using http://ipmagnet.services.cbcdn.com to prove my bittorents are going out over the VPN and they do. Bit confused why I do not need NGINX but hay its working as expected

Now my question is this.
So how do I access the Transmission web client from my iPhone when not on Wi-Fi but over the mobile signal LTE/3G? DDNS would be one option any more ideas?

I'm pretty new to Docker, so I'm still struggling a touch to figure it all out, and it probably doesn't help that I'm using it with Boot2Docker. Anyhow...

The script is failing because www.privateinternetaccess.com can't be resolved:

Mon Feb 23 12:04:15 2015 TUN/TAP device tun0 opened
Mon Feb 23 12:04:15 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Feb 23 12:04:15 2015 /sbin/ip link set dev tun0 up mtu 1500
Mon Feb 23 12:04:15 2015 /sbin/ip addr add dev tun0 local ##.###.#.6 peer ##.###.#.5
Mon Feb 23 12:04:15 2015 Initialization Sequence Completed
head: cannot open '/config/transmission-credentials.txt' for reading: No such file or directory
tail: cannot open '/config/transmission-credentials.txt' for reading: No such file or directory
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:--  0:00:19 --:--:--     0curl: (6) Could not resolve host: www.privateinternetaccess.com
Got new port  from pia
transmission auth not required
localhost:9091/transmission/rpc/ responded: "success"
Checking port...
Error: portTested: http error 0: No Response

Would you have any ideas on what this might be?

Ran a fresh git clone, built and run, and getting this syntax error.

admin@snow:~/dev/docker/torrent/docker-transmission-openvpn$ docker logs a7
Starting OpenVPN using config Netherlands.ovpn
Overriding resolv.conf...
Setting PIA credentials...
Thu May 28 09:58:26 2015 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec  1 2014
Thu May 28 09:58:26 2015 WARNING: file '/config/pia-credentials.txt' is group or others accessible
Thu May 28 09:58:26 2015 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Thu May 28 09:58:26 2015 UDPv4 link local: [undef]
Thu May 28 09:58:26 2015 UDPv4 link remote: [AF_INET]109.201.154.147:1194
Thu May 28 09:58:26 2015 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu May 28 09:58:26 2015 [Private Internet Access] Peer Connection Initiated with [AF_INET]109.201.154.147:1194
Thu May 28 09:58:29 2015 TUN/TAP device tun0 opened
Thu May 28 09:58:29 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu May 28 09:58:29 2015 /sbin/ip link set dev tun0 up mtu 1500
Thu May 28 09:58:29 2015 /sbin/ip addr add dev tun0 local 10.139.1.6 peer 10.139.1.5
Thu May 28 09:58:29 2015 /etc/transmission-daemon/start.sh tun0 1500 1542 10.139.1.6 10.139.1.5 init
/etc/transmission-daemon/start.sh: 4: /etc/transmission-daemon/environment-variables.sh: Syntax error: newline unexpected
Thu May 28 09:58:29 2015 WARNING: Failed running command (--up/--down): external program exited with error status: 2
Thu May 28 09:58:29 2015 Exiting due to fatal error

/etc/transmission-daemon/start.sh: 4: /etc/transmission-daemon/environment-variables.sh: Syntax error: newline unexpected

So I'm new to docker and nginx. Once I have the containers running, what ip's can i use to access them? Also, what ip should i use for the nginx proxy config?

If the openvpn connection is having problems we should stop all downloads.

I have this docker running on my Synology, but I can't get the variables to work. Where and how do I add these in the docker run-command for a Synology?

I try to add the seed ratio and ratio limit variables, but in the command line I can't get it to work. Changes in the settings.json are overwritten at every restart of the container.

@SVR111 requested AirVPN as new provider in #48. As it was a bit off topic, I'm creating a new issue for this request.

Question though! I can add AirVPN as provider, but it seems you need to generate a configuration on their home pages which needs you to be logged in. Could you generate a config for me @SVR111? From what I understand you choose operating system (go linux) and a region to connect to. If you want, you could generate configs for several regions and I'll add them all. Or just send me one.

If someone gives me a dropbox-link or something with configs for AirVPN, I'll it as a provider to the container.

Hi, thanks for this amazing container, seems a lot of work has already gone into it. Are there any instructions on how to add other VPN providers, for docker newbies like myself? I am using PureVPN. Is it just a matter of adding a new directory and copying the .ovpn files into it?

• If a torrent is in progress...
• I stop/start my container
• if I go to the web UI now, the in progress torrent is paused, and any progress it had is lost.

Any ideas?

So I don't know if this is an issue or not, but I'm seeing some weird behaviour.

When I run the following default script, everything works fine.

$ docker run --privileged  -d \
              -v /your/storage/path/:/data \
              -e "PIA_USERNAME=user" \
              -e "PIA_PASSWORD=pass" \
              -p 9091:9091 \
              -e "OPEN_VPN_CONFIG=Netherlands" \
              haugene/transmission-openvpn

but if I do

$ git clone https://github.com/haugene/docker-transmission-openvpn
$ docker build -t="docker-transmission-openvpn" .

$ docker run --privileged  -d \
              -v /your/storage/path/:/data \
              -e "PIA_USERNAME=user" \
              -e "PIA_PASSWORD=pass" \
              -p 9091:9091 \
              -e "OPEN_VPN_CONFIG=Netherlands" \
              ocker-transmission-openvpn

I get the following messages when I run docker logs containerid

Starting OpenVPN using config Netherlands.ovpn
Overriding resolv.conf...
Setting PIA credentials...
Wed May 27 21:22:28 2015 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec  1 2014
Wed May 27 21:22:28 2015 WARNING: file '/config/pia-credentials.txt' is group or others accessible
Wed May 27 21:22:28 2015 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Wed May 27 21:22:28 2015 RESOLVE: Cannot resolve host address: nl.privateinternetaccess.com: Temporary failure in name resolution
Wed May 27 21:22:28 2015 RESOLVE: Cannot resolve host address: nl.privateinternetaccess.com: Temporary failure in name resolution
Wed May 27 21:22:33 2015 RESOLVE: Cannot resolve host address: nl.privateinternetaccess.com: Temporary failure in name resolution

It won't connect at all, which is weird.

Any ideas?

Can this Docker container be used with other VPN providers such as FrootVPN?

Can you please add support for usenetserver vpn? Thanks!

Here is my log, it seems to be very similar to yours, I am not sure what you meant when you said that my routing seem be done differently on Unraid? I am clueless when it comes to routing but I am puzzled by that 172.17.42.1 address as my docker eth0 address is actually 172.17.0.68 (see me interfaces below)

Sun Aug 16 18:00:27 2015 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec  1 2014
Sun Aug 16 18:00:27 2015 WARNING: file '/config/openvpn-credentials.txt' is group or others accessible
Sun Aug 16 18:00:27 2015 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sun Aug 16 18:00:27 2015 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sun Aug 16 18:00:27 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Sun Aug 16 18:00:27 2015 UDPv4 link local: [undef]
Sun Aug 16 18:00:27 2015 UDPv4 link remote: [AF_INET]109.201.137.163:1194
Sun Aug 16 18:00:27 2015 TLS: Initial packet from [AF_INET]109.201.137.163:1194, sid=31a2bf87 ca03bcc8
Sun Aug 16 18:00:27 2015 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sun Aug 16 18:00:27 2015 VERIFY OK: depth=1, C=DE, ST=Hesse-Nassau, L=Frankfurt, O=BTGuard, CN=BTGuard CA, [email protected]
Sun Aug 16 18:00:27 2015 VERIFY OK: depth=0, C=DE, ST=Hesse-Nassau, L=Frankfurt, O=BTGuard, CN=server, [email protected]
Sun Aug 16 18:00:27 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Aug 16 18:00:27 2015 NOTE: --mute triggered...
Sun Aug 16 18:00:27 2015 4 variation(s) on previous 3 message(s) suppressed by --mute
Sun Aug 16 18:00:27 2015 [server] Peer Connection Initiated with [AF_INET]109.201.137.163:1194
Sun Aug 16 18:00:29 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sun Aug 16 18:00:29 2015 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 8.8.8.8,redirect-gateway,route 10.10.10.1,topology net30,ping 10,ping-restart 120,ifconfig 10.10.10.158 10.10.10.157'
Sun Aug 16 18:00:29 2015 OPTIONS IMPORT: timers and/or timeouts modified
Sun Aug 16 18:00:29 2015 NOTE: --mute triggered...
Sun Aug 16 18:00:29 2015 3 variation(s) on previous 3 message(s) suppressed by --mute
Sun Aug 16 18:00:29 2015 ROUTE_GATEWAY 172.17.42.1/255.255.0.0 IFACE=eth0 HWADDR=02:42:ac:11:00:44
Sun Aug 16 18:00:29 2015 TUN/TAP device tun0 opened
Sun Aug 16 18:00:29 2015 TUN/TAP TX queue length set to 100
Sun Aug 16 18:00:29 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Aug 16 18:00:29 2015 /sbin/ip link set dev tun0 up mtu 1500
Sun Aug 16 18:00:29 2015 /sbin/ip addr add dev tun0 local 10.10.10.158 peer 10.10.10.157
Sun Aug 16 18:00:29 2015 /etc/transmission/start.sh tun0 1500 1541 10.10.10.158 10.10.10.157 init
Updating TRANSMISSION_BIND_ADDRESS_IPV4 to tun0 ip: 10.10.10.158
Generating transmission settings.json from env variables
STARTING TRANSMISSION
NO PORT UPDATER FOR THIS PROVIDER
Transmission startup script complete.
Sun Aug 16 18:00:29 2015 /sbin/ip route add 109.201.137.163/32 via 172.17.42.1
Sun Aug 16 18:00:29 2015 /sbin/ip route del 0.0.0.0/0
Sun Aug 16 18:00:29 2015 /sbin/ip route add 0.0.0.0/0 via 10.10.10.157
Sun Aug 16 18:00:29 2015 /sbin/ip route add 10.10.10.1/32 via 10.10.10.157
Sun Aug 16 18:00:29 2015 Initialization Sequence Completed

Here are my routes

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.10.10.157    0.0.0.0         UG    0      0        0 tun0
10.10.10.1      10.10.10.157    255.255.255.255 UGH   0      0        0 tun0
10.10.10.157    0.0.0.0         255.255.255.255 UH    0      0        0 tun0
109.201.137.163 172.17.42.1     255.255.255.255 UGH   0      0        0 eth0
172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 eth0

and my interfaces

eth0      Link encap:Ethernet  HWaddr 02:42:ac:11:00:44  
          inet addr:172.17.0.68  Bcast:0.0.0.0  Mask:255.255.0.0
          UP BROADCAST RUNNING  MTU:1500  Metric:1
          RX packets:2456 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2226 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:557144 (557.1 KB)  TX bytes:489313 (489.3 KB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.10.10.158  P-t-P:10.10.10.157  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:381 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:24787 (24.7 KB)

The Transmission Docker image is set to \data\download aka \volume1\DockerVPN\download

This works for torrents that I manually added via the transmission web client.

Sickbeard and CouchPotota are set to download using transmission mode, not using a watch folder. Here are the links I sent up to tell them to where to download to

\volume1\DockerVPN\download\TV
\volume1\DockerVPN\download\Movies

The downloads snatch and appear in transmission and appear to download ok but the files never physically appear anywhere on the NAS or docker image.

Everything is 777 permission why I manually ran Chmod 777 -R on

\volume1\DockerVPN\

If I set Sickbeard and CouchPotato's download location to blank and let transmission decide where to download to then it will works fine.

I think this has something to do with the Docker image using \data\download and not \volume1\DockerVPN\download. I think Sickbeard is passing over the full link and transmission is like what is that? I need the docker shortcut style link instead.

Any ideas?

P.S I cannot use the watch folder aka black hole option because transmission does not support multiple watch folders.

Hello,

With default FrootVPN config, the URL has changed :
se-vpn.frootvpn.com

to

se.vpn.frootvpn.com

Hi

I really hope you can help, I just spend half a day trying to get this to work, but I can't.

transmission-openvpn seems to work fine and this is the last output from docker log:

Got new port 57505 from pia
transmission auth not required
localhost:9091/transmission/rpc/ responded: "success"
Checking port...
Port is open: Yes

If I check the container IP with:

docker exec -it 399 /sbin/ifconfig

I get eth0: 172.17.0.2

Then I run the nginx container with -p 8888:8888 and in the nginx.conf I have:

proxy_pass http://172.17.0.2:9091

But I can't acces the web interface no matter what I try. I try to access it with:

http://172.17.0.2:8888/transmission/web/

Any ideas?

Thanks

Hi, I can run the docker container okay and connect and download torrents just fine while connected to the vpn.

My issue is that the transmission folder (mount to /home/transmission for me) is set to root for user:group, so every time transmission downloads something I have to sudo chown or chmod to delete it from the folder.

I've tried changing from running with --privileged to
--cap_add=NET ADMIN --device /dev/net/tun
As I thought that might help, but I still get the same file/folder permission issue.

I've also tried editing the dockerfile and building a new image.
RUN mkdir /data
RUN chown -R nobody:nogroup /data
VOLUME /data
But it doesn't make a difference

Do you have any suggestions for managing permissions issue?

Support for more OpenVPN providers, other than PIA, was proposed in the comments on the Docker registry.

The container should be expanded so that the OpenVPN provider is customizable and the solution should make it as easy and flexible as possible to add more providers later.

An implementation has been done on the dev branch, awaiting some testing before merging to master.

There was a request from plexmaka on the Docker hub to add HideMe as a provider.
As I couldn't find a way to download all configs easily from their web pages I will only download and include one config for this provider (Netherlands - Haarlem) which was the recommended one.

hello,

thanks a lot for your stuff !

i try to add a new provider, but i'm working on a synology.
i'm not able to start with a vpn missconfiguration.

i tried with a free hideme account but it does not work with trial version (only few servers are available)

is it possible to directly add a HMA provider ?

thanks

@makloda asked this question in issue #49.

Hi Haugene. I am using pureVPN and it works great ,however, sometimes my VPN provider loses connection so that causes transmission to stop all transfers (as it should). Currently I use a cron on the Synology host to simply restart the docker container every 4 hours which then restarts the whole image and connecst to VPN again. But it feels like killing an ant with a sledgehammer. Is there a way to schedule automatic reconnection to the VPN inside the container in case the VPN connection is dropped?

Moving it here as it is unrelated to the other issue.

Looking at the shell script, it seems the port/IP is only periodically updated for the PIA VPN provider, but not for the other providers?

From "start.sh":

if [ "$OPENVPN_PROVIDER" = "PIA" ]
then
    echo "STARTING PORT UPDATER"
    exec /etc/transmission/periodicUpdates.sh &
else
    echo "NO PORT UPDATER FOR THIS PROVIDER"
fi

echo "Transmission startup script complete."

My (self-added) VPN provider PureVPN now produces "18:16:33
NO PORT UPDATER FOR THIS PROVIDER" in the logs.

Whats the best way to allow the updater to run for all providers? I could schedule to restart the docker container every couple hours but that's not very elegant.

Hi, I've been using your script for a while and it's really useful.
However it seems that the /etc/transmission/updatePort.sh is not working properly...
In the logs, I see that the port isn't really updated
{"log":"Got new port 32069 from pia\n","stream":"stdout","time":"2016-05-15T13:35:54.527651501Z"}
{"log":"Checking port...\n","stream":"stdout","time":"2016-05-15T13:35:54.569254009Z"}
{"log":"Got new port 32069 from pia\n","stream":"stdout","time":"2016-05-15T14:11:36.122131619Z"}
{"log":"Checking port...\n","stream":"stdout","time":"2016-05-15T14:11:36.169260958Z"}

The script uses a hyperlink
https://www.privateinternetaccess.com/vpninfo/port_forward_assignment, but when I try to follow it, I see a "page not found" error.
I can only speculate that it was removed or something.
Also after the script has fired my router sometimes hangs and needs to be restarted - I still couldn't track it in the logs, though...

I'm quite new with the whole git thing, so please excuse me if I don't provide enough information.

Hello Haugene,

it seem that frootvpn just updated their openvpn config, is it possible to modify the container ?
The mail received from froot :

_Beloved Customer,

we're currently updating our swedish OpenVPN servers which might affect you sooner or later.
You're required to download a new copy of the OpenVPN Configuration file found at:
https://www.frootvpn.com/files/se.openvpn.frootvpn.ovpn
The current configuration files will result in errors such as:
Authenticate/Decrypt packet error: packet HMAC authentication failed And most importantly will leave you unencrypted!

The entire Update will last 2 weeks, giving you enough time to update before the last legacy servers are being shut down.

Nevertheless we urge you to update your config as soon as possible!

Best Regards,_

many thanks in advance

The newly created torrent directory will be stored on the host with a permission of 644 and as root:root.

Can this be configured to allow me to pass my user and group into the container, so that when writing the torrent, it will write correctly to my host file system, removing the need for my to use sudo to change the configuration.

I have a script which moves and sorts these files, and I don't want to elevate the scripts privileges, as this can be done in the container.

Thanks

When I add torrents to transmission, they seem to load okay (metadata is downloaded), but none of the data will download.

Hello,
I come to you because I have a problem I have this message that appears.

Tue Apr 19 12:35:57 2016 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #19046837 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with -
-mute-replay-warnings

The download does well but apparently this is the upload does not work .

Did message says something to you ?

thank you in advance for your help.

Best regards.

sorry for my english, i'm french

here is there configuration files : https://anonine.com/static/anonine_openvpn.zip

and there installation guide : https://anonine.com/en/guides/openvpn-ubuntu-14.04-64bit

if you want me to test it, no problem at all of course !

thks

Arnaud

I fired up a haugene/transmission-openvpn docker instance with PIA credentials. I can reach the web interface, but adding magnet links or torrent files never progresses. They are stalled at 0% with no connections.

Tailing the log I can see:
(6) Could not resolve host: www.privateinternetaccess.com Got new port from pia transmission auth not required localhost:9091/transmission/rpc/ responded: "success" Checking port... Error: portTested: http error 0: No Response

When I "docker exec -it haugene-transmission /bin/bash", I cannot ping anything. restarting openvpn through the script doesn't help. If i issue "ip link delete tun0" to remove the tunnel device (tun0-00), I get "File descriptor in bad state".

Any ideas?

Can you add support for IPVanish?

Configs can be found at: https://www.ipvanish.com/software/configs/

Not sure what's up, maybe a script is erroring out before it actually starts transmission. Here's the log:

<-- snip -->
STARTING TRANSMISSION
STARTING PORT UPDATER
Transmission startup script complete.
Thu Oct 29 15:07:13 2015 Initialization Sequence Completed
Generating new client id for PIA
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   106  100    14  100    92     15    103 --:--:-- --:--:-- --:--:--   103
Got new port 51575 from pia
transmission auth not required
Fatal: no entropy gathering module detected
Aborted
Fatal: no entropy gathering module detected
Aborted
Checking port...
Fatal: no entropy gathering module detected
Aborted

Hi, and thanks for your great work !

I'm a total noob with Docker, but I've managed to make it work on my Synology NAS (DS2415+).
As my VPN provider was not listed, I had to create the config files myself in the image (bad, I know).

As my VPN provider uses TAP instead of TUN with full port forward to the client, I also had to trick the transmission start script, which makes it more generic.

OpenVPN calls the script and passes link information through the script arguments.
For instance in my OpenVPN log (visible trough docker log:
Wed Jan 20 16:50:19 2016 /etc/transmission/start.sh tap0 1500 1574 91.240.66.198 255.255.255.224 init

My changes in /etc/transmission/start.sh
Original : tun0ip=$(ifconfig tun0 | sed -n '2 p' | awk '{print $2}' | cut -d: -f2)
First suggestion : tun0ip=$(ifconfig $1 | sed -n '2 p' | awk '{print $2}' | cut -d: -f2)
=> use device name passed as first argument instead of arbitrarily using tun0

*Second suggestion, straight forward ! : *
tun0ip=$4
=> use device IP address as passed directly as the 4th argument by OpenVPN !

Cherry on top, without any change, I can access the transmission web UI by either using my NAS' private IP, or the public IP.

QUESTION : How can I restrict the web UI to the local IP only (or put at least some auth on it ?)
(nevermind, I found out I had to pass extra ENV variables (TRANSMISSION_...) to tune it)

If you want to add PrivateVPN provider, here's the default file I used :

client
remote-random
remote 91.240.64.20 21000
remote 91.240.64.20 21001
remote 91.240.64.20 21002
remote 91.240.64.20 21003
remote 91.240.64.19 21000
remote 91.240.64.19 21001
remote 91.240.64.19 21002
remote 91.240.64.19 21003
remote 91.240.64.18 21000
remote 91.240.64.18 21001
remote 91.240.64.18 21002
remote 91.240.64.18 21003
remote 91.240.64.18 21004
remote 91.240.64.18 21005
remote 91.240.64.18 21006
remote 91.240.64.18 21007
dev tap0
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
<ca>
-----BEGIN CERTIFICATE-----
MIIE3zCCA8egAwIBAgIJAMXxdK4eMVKxMA0GCSqGSIb3DQEBBQUAMIGlMQswCQYD
VQQGEwJTRTELMAkGA1UECBMCQ0ExEjAQBgNVBAcTCVN0b2NraG9sbTETMBEGA1UE
ChMKUHJpdmF0ZVZQTjETMBEGA1UECxMKUHJpdmF0ZVZQTjETMBEGA1UEAxMKUHJp
dmF0ZVZQTjERMA8GA1UEKRMIY2hhbmdlbWUxIzAhBgkqhkiG9w0BCQEWFHN1cHBv
cnRAcHJpdmF0dnBuLnNlMB4XDTE0MDQyNjA3MjcxNVoXDTI0MDQyMzA3MjcxNVow
gaUxCzAJBgNVBAYTAlNFMQswCQYDVQQIEwJDQTESMBAGA1UEBxMJU3RvY2tob2xt
MRMwEQYDVQQKEwpQcml2YXRlVlBOMRMwEQYDVQQLEwpQcml2YXRlVlBOMRMwEQYD
VQQDEwpQcml2YXRlVlBOMREwDwYDVQQpEwhjaGFuZ2VtZTEjMCEGCSqGSIb3DQEJ
ARYUc3VwcG9ydEBwcml2YXR2cG4uc2UwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQC/H+vc6QChwv2fj5XLzQcO05b3zIpPqQWsKunWyLnKUybFz79pUfhv
07L9arJj2LPwW0DVcyl9dxUWgqJOcWG5UrwYWF3ZDlGHkJywH5XKpnmdiqR8kkPi
atGm28aMpYIOvP+uIFrMD509cZONC0WIyVUrV9tpRX7LfKBti509ifPH+tINm5R9
B9dMQJKBI951wYXD8cCBodXsan++yOzuazkKHn1U1tY3TdqdIyD2HiBUbXhSH86w
fAmvY/O7L6f+YHzyI4hHseLzEo9htbaOQLvtg57cr2eBl2K46qiDwKn2q1aiJ2kx
uNkK1Q1uYAUzdyJHUsbbg+FZFxra8uAxAgMBAAGjggEOMIIBCjAdBgNVHQ4EFgQU
cLPgc+zc/6yPLEOKVPL62EW9rLAwgdoGA1UdIwSB0jCBz4AUcLPgc+zc/6yPLEOK
VPL62EW9rLChgaukgagwgaUxCzAJBgNVBAYTAlNFMQswCQYDVQQIEwJDQTESMBAG
A1UEBxMJU3RvY2tob2xtMRMwEQYDVQQKEwpQcml2YXRlVlBOMRMwEQYDVQQLEwpQ
cml2YXRlVlBOMRMwEQYDVQQDEwpQcml2YXRlVlBOMREwDwYDVQQpEwhjaGFuZ2Vt
ZTEjMCEGCSqGSIb3DQEJARYUc3VwcG9ydEBwcml2YXR2cG4uc2WCCQDF8XSuHjFS
sTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQA0UbskTX1IX6NLfAs3
8gPj321zN2ryj3ADxS8sLjy/+hUbdHu3FyQ12pI7jIVeAK4n7DccBRAMDBTWfNtv
jqFiWp10G2cI6d2xwDaDZFJNSWDyl4OYQjE4RtyBwH4IskKAdrT0oXg+kVgo8TiU
BwAvzuoZFWFHYYYhfCh9bGdicLCtBfiZ6zjlAltjVA0tjdbYCG5WkPqsXAUeKBmf
oQ5n10nzGdkZSMwlp9g5tFfni9kq/oSAupS5XXyvUG3IpFsdZWuZUo6fr5Hp6Ve5
Yvux4/hgnPLuT8E/46EKkATabVnpNa3/CgSqiJLEd4m6ZUiykqI7Hq3juKkK6DrT
ilw/
-----END CERTIFICATE-----
</ca> 

auth-user-pass /config/openvpn-credentials.txt
ns-cert-type server
comp-lzo
verb 3

# OpenVPN controls startup and shut down of transmission
script-security 2
up /etc/transmission/start.sh
down /etc/transmission/stop.sh

Hi,

Thanks for this very useful piece of software.

I've set up docker-transmission-openvpn as a systemd service so that it starts at boot time, and restarts if it fails.

Would it be useful for me to document this for addition to the README? If so, I'll raise a pull request.

Cheers,

Dave

Hi!

I recently decided to change up the settings and therefore updated the image before firing it up again. It appears this was a bad idea, I get these logs from the container. Note that the the same holds true with keeping everything at default as well, so it appears something is broken in combination with my VPN provider?

+ chmod 600 /config/openvpn-credentials.txt
+ echo username
+ echo password
+ dockerize -template /etc/transmission/environment-variables.tmpl:/etc/transmission/environment-variables.sh /bin/true
+ exec openvpn --config /etc/openvpn/ipvanish/ipvanish-DE-Frankfurt-fra-a12.ovpn
Mon Mar 28 14:03:18 2016 DEPRECATED OPTION: --tls-remote, please update your configuration
Mon Mar 28 14:03:18 2016 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec  1 2014
Mon Mar 28 14:03:18 2016 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Mon Mar 28 14:03:18 2016 Deprecated TLS cipher name 'DHE-RSA-AES256-SHA', please use IANA name 'TLS-DHE-RSA-WITH-AES-256-CBC-SHA'
Mon Mar 28 14:03:18 2016 Deprecated TLS cipher name 'DHE-DSS-AES256-SHA', please use IANA name 'TLS-DHE-DSS-WITH-AES-256-CBC-SHA'
Mon Mar 28 14:03:18 2016 Deprecated TLS cipher name 'AES256-SHA', please use IANA name 'TLS-RSA-WITH-AES-256-CBC-SHA'
Mon Mar 28 14:03:18 2016 Socket Buffers: R=[212992->131072] S=[212992->131072]
Mon Mar 28 14:03:23 2016 UDPv4 link local: [undef]
Mon Mar 28 14:03:23 2016 UDPv4 link remote: [AF_INET]81.171.75.20:443
Mon Mar 28 14:03:23 2016 TLS: Initial packet from [AF_INET]81.171.75.20:443, sid=08190374 49f6baae
Mon Mar 28 14:03:23 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mon Mar 28 14:03:23 2016 VERIFY OK: depth=1, /C=US/ST=FL/L=Winter_Park/O=IPVanish/OU=IPVanish_VPN/CN=IPVanish_CA/[email protected]
Mon Mar 28 14:03:23 2016 VERIFY X509NAME OK: /C=US/ST=FL/L=Winter_Park/O=IPVanish/OU=IPVanish_VPN/CN=fra-a12.ipvanish.com/[email protected]
Mon Mar 28 14:03:23 2016 VERIFY OK: depth=0, /C=US/ST=FL/L=Winter_Park/O=IPVanish/OU=IPVanish_VPN/CN=fra-a12.ipvanish.com/[email protected]
Mon Mar 28 14:03:24 2016 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Mar 28 14:03:24 2016 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Mar 28 14:03:24 2016 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Mar 28 14:03:24 2016 Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Mar 28 14:03:24 2016 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Mar 28 14:03:24 2016 [fra-a12.ipvanish.com] Peer Connection Initiated with [AF_INET]81.171.75.20:443
Mon Mar 28 14:03:26 2016 SENT CONTROL [fra-a12.ipvanish.com]: 'PUSH_REQUEST' (status=1)
Mon Mar 28 14:03:26 2016 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 198.18.0.1,dhcp-option DNS 198.18.0.2,rcvbuf 262144,explicit-exit-notify 5,route-gateway 172.21.22.1,topology subnet,ping 20,ping-restart 40,ifconfig 172.21.22.81 255.255.254.0'
Mon Mar 28 14:03:26 2016 OPTIONS IMPORT: timers and/or timeouts modified
Mon Mar 28 14:03:26 2016 OPTIONS IMPORT: explicit notify parm(s) modified
Mon Mar 28 14:03:26 2016 OPTIONS IMPORT: --sndbuf/--rcvbuf options modified
Mon Mar 28 14:03:26 2016 Socket Buffers: R=[131072->425984] S=[131072->131072]
Mon Mar 28 14:03:26 2016 OPTIONS IMPORT: --ifconfig/up options modified
Mon Mar 28 14:03:26 2016 OPTIONS IMPORT: route options modified
Mon Mar 28 14:03:26 2016 OPTIONS IMPORT: route-related options modified
Mon Mar 28 14:03:26 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Mar 28 14:03:26 2016 ROUTE_GATEWAY 172.17.0.1/255.255.0.0 IFACE=eth0 HWADDR=02:42:ac:11:00:02
Mon Mar 28 14:03:26 2016 ERROR: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
Mon Mar 28 14:03:26 2016 Exiting due to fatal error

Any hint on what to work here? Unfortunately I don't have the older image anymore :/

Firstly thank you for your great work. i use your Transmission on my Synology DSM 6.0 System. But i am not good at Computer. May i ask some question about it.

1. I create the docker container with your classic command. It works well. When i shut down my NAS and reboot it, i tried to start the created Container, It appeared error like ''Cannot open TUN/TAP ''.
   what is the problem with it ? Should i not shut down the nas directly or should i pause the torrent , stop the Container,exit the docker, then shut down the nas? what is the steps of power off NAS?
2. how to resume the created container after reboot?
3. Sometimes i want to change the Openvpn. Because i want to choose the fastest VPN Server. Do i have to creat another container for that? Or can i change the environment variables in the existent container?
4. the container is over Openvpn and the NAS over myself ISP Provider. They have different IP addresses. Is that right？

Thank you very much.

Hello. I am new to Docker, but I am close to getting this working I think. In the log I can see the VPN has connected, and Transmission Initialization Sequence Complete. My Diskstation IP is 192.168.2.22 and I am trying to use port 8899. My nginx.conf file at etc/nginx has the following content:
events {
worker_connections 1024;
}

http {
server {
listen 8899;
location / {
proxy_pass http://192.168.2.22:9091;
}
}
}
To start nginx I am used the following, and had the following output:

DiskStation> docker run -d \

-v /path/to/nginx.conf:/etc/nginx/nginx.conf:ro
-p 192.168.2.22:8899:8899
nginx
Unable to find image 'nginx:latest' locally
latest: Pulling from nginx
1e58eecba27a: Pull complete
a0e9fe2f8803: Pull complete
d4e3870153bf: Pull complete
7608c10ea730: Pull complete
5068080f8d28: Pull complete
556c463c2460: Pull complete
8d66bf39903a: Pull complete
6e36f46089ed: Pull complete
nginx:latest: The image you are pulling has been verified. Important: image verification is a tech preview feature and should not be relied on to provide security.
Digest: sha256:83be29bb91fc47f3a7453fc51db66816c9c637131f302a83dfd136e4b1901fbe
Status: Downloaded newer image for nginx:latest
ceb40e07049a428266423b52f1ca361a8348222d822cdf80c81b89c727945dd4
FATA[0022] Error response from daemon: Cannot start container ceb40e07049a428266423b52f1ca361a8348222d822cdf80c81b89c727945dd4: [8] System error: not a directory

The container does install and can be started. Here is the log - not sure if the listed error is a problem, but docker ps (below) tells me this is working I think:

Timestamp: 2016-02-17 19:13:03.452376616 -0700 MST
Code: System error

Message: not a directory

Frames:

0: setupRootfs
Package: github.com/docker/libcontainer

File: rootfs_linux.go@29

1: Init
Package: github.com/docker/libcontainer.(*linuxStandardInit)

File: standard_init_linux.go@52

2: StartInitialization
Package: github.com/docker/libcontainer.(*LinuxFactory)

File: factory_linux.go@223

3: initializer
Package: github.com/docker/docker/daemon/execdriver/native
File:

docker ps returns the following, so I think nginx is working:

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
ceb40e07049a nginx:latest "nginx -g 'daemon of 38 minutes ago Up 11 minutes 80/tcp, 443/tcp, 0.0.0.0:8899->8899/tcp sad_fermat
c5696582abe4 haugene/transmission-openvpn:latest "/etc/openvpn/start. 24 hours ago Up 16 seconds 0.0.0.0:9091->9091/tcp mad_payne

I can not get http://192.168.2.22:8899/transmission/web/ to work. I have disabled all firewalls and STILL no dice. Any help would sure be appreciated. I am using a DS 1815+.

Torrents aren't resuming when the docker container is stopped/started, even though the /data/incomplet and /data/watch has *.torrent.added and *.part files.

I think there must be some other Transmission configuration or directory that is managing this state that needs to be located in the /data or /config volumes so it can be restored on docker container restart.

I am getting this when I run the container:
...
Sun Mar 13 05:41:26 2016 [Private Internet Access] Peer Connection Initiated with [AF_INET]93.114.44.187:1194
Sun Mar 13 05:41:28 2016 TUN/TAP device tun0 opened
Sun Mar 13 05:41:28 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Mar 13 05:41:28 2016 /sbin/ip link set dev tun0 up mtu 1500
Sun Mar 13 05:41:28 2016 /sbin/ip addr add dev tun0 local 10.126.1.6 peer 10.126.1.5
Sun Mar 13 05:41:28 2016 /etc/transmission/start.sh tun0 1500 1542 10.126.1.6 10.126.1.5 init
Updating TRANSMISSION_BIND_ADDRESS_IPV4 to tun0 ip: 10.126.1.6
Generating transmission settings.json from env variables
INFO: /dev/random not found - symlink to /dev/urandom
STARTING TRANSMISSION
STARTING PORT UPDATER
Transmission startup script complete.
Sun Mar 13 05:41:29 2016 Initialization Sequence Completed

And then nothing, the container just stops. Any ideas?
I am running it in privilege mode with Google DNS on QNAP Container Station.

I was able to run the previous version (1.6) on a previous QNAP Container Station (1.3) without problem.

Any ideas? Thanks.

Hi,

Could anyone add ivacy as a new VPN provider?

Thanks,
Vitaliy

On my system, (debian linux with vanilla docker, and running the command on the readme), transmission does not seem to pick up any torrents I place in the watch directly on my host.

I attach myself into the container and have checked that the container has picked up the file which it has, but transmission does not seem to pick up the file.

Is this an issue on anyone else container.

After some tinkering I got this working on a Synology NAS (412+).
Just wanted to share in case anyone else was trying.

Here's what I had to do:

• Add --dns 8.8.8.8 --dns 8.8.4.4 to the docker run command (as noted in README)
• Run the following script on startup.
  • In my case, this meant putting the script here (making sure it is executable): /usr/syno/etc.defaults/rc.d/S01tun.sh

#!/bin/sh

# Create the necessary file structure for /dev/net/tun
if ( [ ! -c /dev/net/tun ] ); then
  if ( [ ! -d /dev/net ] ); then
    mkdir -m 755 /dev/net
  fi
  mknod /dev/net/tun c 10 200
fi

# Load the tun module if not already loaded
if ( !(lsmod | grep -q "^tun\s") ); then
  insmod /lib/modules/tun.ko
fi

I am French, I use google translation

Hello,

I have a Qnap ts253pro.

That's the problem I have:

Tue Dec. 22 2015 2:24:22 p.m. [vpnsvc] Peer Connection Initiated with [AF_INET] 95.211.195.84:443
Tue Dec. 22 2015 2:24:25 p.m. ERROR: Can not open TUN / TAP dev / dev / net / tun: No such file or directory (errno = 2)
Tue Dec. 22 2015 2:24:25 p.m. Exiting due to fatal error

The problem is that /dev/net/ tun is present in my Qnap.

I saw some problems that resembled mine but I did not find satisfesante answer.

Would you have an idea of the problem?

Thank you in advance for your assistance.

Bonjour,

Je possède un Qnap ts253pro.

Voilà le problème que je rencontre :

Tue Dec 22 14:24:22 2015 [vpnsvc] Peer Connection Initiated with [AF_INET]95.211.195.84:443                                                                                                                 
Tue Dec 22 14:24:25 2015 ERROR: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)                                                                                                   
Tue Dec 22 14:24:25 2015 Exiting due to fatal error

Le problème est que /dev/net/tun est bien présent dans mon Qnap.

J'ai vu quelques problèmes qui ressemblaient au miens mais je n'ai pas trouvé de réponse satisfesante.

Auriez vous une idée du problème ?

Merci d'avance pour votre aide.

Hi,

First of all thanks for making this available to the public! It works like a charm on my Synology DSM 6 and it was fairly easy to setup and configure to my liking.

I'm however having some problems trying to get transmission to automatically unpack downloaded files. I have configured transmission to execute a simple script after downloading completes using TRANSMISSION_SCRIPT_TORRENT_DONE_ENABLED and TRANSMISSION_SCRIPT_TORRENT_DONE_FILENAME, and it can navigate to the torrent using TR_TORRENT_DIR and TR_TORRENT_NAME.

The problem is that it doesn't seem like calling unrar or 7z works - or at least nothing seems to happen when calling them. If I do a 'which unrar' inside the script it correctly logs '/bin/unrar'. But when I try to unrar files nothing happens - and I have tried all sorts of different variations using relative path and absolute path to unrar, and even copying unrar to the torrent directory and calling it with "./unrar", but all to no avail.

Anything special I need to be aware of here? Is something in the nature of this setup preventing a script from executing binaries? Any help would be highly appreciated.

Thanks.

Should make a cron job or something to poll PIA for a port and then set this as listening port in transmission. This would ensure that we're always connectable.

Kristian,
Thanks for building this container and for looking into a resolution to this Synology problem.

I have included your comments from Docker Hub to refresh your memory on this topic.

"On a host system the TUN/TAP device will probably be created/verified on installing the OpenVPN client. As we're here starting a container where it is already installed it will expect the TUN/TAP device to be present. I could try to create a script that sets up the device if it isn't present. But on my machine I already have it so I would have to do some virtualization and stuff. "