@doronbehar Indeed support for watch-dir is missing, thanks. I cannot test this PR right now, but I suppose that:

• Because the user's settings may not define it, a default value must be added for watch-dir-enabled.
• Also, a sensible default like "${cfg.home}/Torrents" or else, may be set for watch-dir.
• Maybe using BindReadOnlyPaths= (instead of BindPaths=) would be enough for watch-dir to work correctly.
• A rule r ${cfg.settings.watch-dir}, guarded by cfg.settings.watch-dir-enabled must also be added in transmission-daemon's AppArmor profile.

Because the user's settings may not define it, a default value must be added for watch-dir-enabled
Also, a sensible default like "${cfg.home}/Torrents" or else, may be set for watch-dir.

There's an upstream default for watch-dir which is "${cfg.home}/watchdir" and it's false by default. I copied most of what you did with incomplete-dir for watch-dir, according to upstream's defaults, so I hope it should be OK now.

Maybe using BindReadOnlyPaths= (instead of BindPaths=) would be enough for watch-dir to work correctly.

No, because after Transmission is adding a torrent, it renames the file with the .added suffix, so it should need write permissions as well.

A rule r ${cfg.settings.watch-dir}, guarded by cfg.settings.watch-dir-enabled must also be added in transmission-daemon's AppArmor profile.

Agreed. I added this plus other checks based on incomplete-dir.

@doronbehar Great :) I still can't test it, but it looks like there is a missing ''} in the AppArmor profile there: 42dd740#diff-3b9521332ddaab17070757e70eb2ff9bR421

Correct. I fixed that and tested the transmission.nix test and it succeeded.

Well then, LGTM, thanks for this PR @doronbehar :)