Another problem is when downloadDir is changed and if transmission user can not create the new directory, the service fails to start. This is especially important if the destination directory is owned by root (for example /home/mytransmission). I have made some changes to address the issue on top of your commit: 3f5e465bb2020@c0cac41

I'm not sure I figured out what you mean. Are you saying that the preStart script creating the necessary directories is being run by transmission as this is the user of the systemd service? Meaning that if the user transmission can't create these directories then the service will fail?

I'm not sure how exactly your changes improve that, nothing there elevates the permissions of the preStart script so that the mkdir command is being run root. Besides, I think if someone chooses such a non standard directory as a download-dir, it's rather reasonable that he will manually create it and then the preStart script will only set the permissions.

transmission user is not a super user, so it can not create necessary folders when non-default downloadDir is used. By running preStart as root, this can be solved. I've edited my comment above to include only two more lines.

Thanks for clarifying this @bb2020. The question is, are you sure the preStart script won't fail because the ExecStartPre is being run by transmission which is not privileged? Also what does this line do:

https://github.com/bb2020/nixpkgs/blob/c0cac417e4ad094dbd9a7ca2776d97b409722b8c/nixos/modules/services/torrent/transmission.nix#L141

?

As for this privileges doubt, according to systemd.service's man page (see this table), we should use the + as a prefix to the ExecStartPre and this will ensure the ExecStartPre script will be able to actually mkdir this directories.

This reminds me that @aszlig wrote about a "directories" module in #59988 (comment). I think having something like that in NixOS would be nice, and help with issues like this.

today I noticed that with a downloadDir pointing e.g to ${homeDir}/Downloads (The default), it's impossible to cd to it since the ${homeDir} permissions are always set to 700

If you ask me, introducing homeDirPermissions is not necessary. Assigning homeDir dir to 770 and settingsDir to 700 should be sufficient.

what does this line do: https://github.com/bb2020/nixpkgs/blob/c0cac417e4ad094dbd9a7ca2776d97b409722b8c/nixos/modules/services/torrent/transmission.nix#L141

PermissionsStartOnly runs preStart as root, but not the service process itself. However it looks like it is deprecated and similar modules have been ported to systemd.tmpfiles.

I've made some changes here that fixes both issues, I presume. a06e0a1 bb2020@3625af9

Now that's the systemd way of handling this! Kind of makes @aszlig's thing redundant doesn't it? @bb2020 would you like to create a new PR? I'm off my laptop at the moment...

It is actually a discouraged method. However, I see it is widely used by many modules 😃
I don't have time to test it though. I was hoping you would test it and go on with this PR.

It was previously discussed in some nixpkgs issues.

It'd be nice to talk it over at nixos/RFCs, or the forums.. When I'll find the time I'll quote you so you could join the discussion :)

P.S I'll test your implementation as well.

BTW Speaking of improvements to this module, does anybody has a clear guess on how to fix this warnings I've been getting lately:

trace: warning: In file /nix/var/nix/profiles/per-user/root/channels/nixos/nixos/modules/services/torrent/transmission.nix
a list is being assigned to the option config.users.users.
This will soon be an error as type loaOf is deprecated.
See https://git.io/fj2zm for more information.
Do
  users.users =
    { transmission = {...}; ...}
instead of
  users.users =
    [ { name = "transmission"; ...} ...]

trace: warning: In file /nix/var/nix/profiles/per-user/root/channels/nixos/nixos/modules/services/torrent/transmission.nix
a list is being assigned to the option config.users.groups.
This will soon be an error as type loaOf is deprecated.
See https://git.io/fj2zm for more information.
Do
  users.groups =
    { transmission = {...}; ...}
instead of
  users.groups =
    [ { name = "transmission"; ...} ...]

See also #78113 (which hardcodes homedirPermissions to 755).

I have not tested the patch in this PR, but reading the diff it looks fine.

I would prefer this over #78113 since i want transmission group members to be able to write/move files inside the transmission directory

This reminds me that @aszlig wrote about a "directories" module in #59988 (comment). I think having something like that in NixOS would be nice, and help with issues like this.

For things like eg. runtime or state directories, systemd can already handle this (as @doronbehar mentioned), but AFAIK it only applies to those standard directory layouts and not arbitrary directories. The module above however is fairly complex (mainly because it also supports POSIX ACLs), so I'm not really sure whether it would be worth introducing additional complexity if it's only used for like 2 modules.

Addendum: One advantage of that module would have however, is that it would prevent race conditions regarding mkdir/chmod calls and it also allows to configure permissions of leading directories in a hierarchical way, so if there would be more NixOS modules where this would be useful, I might reconsider upstreaming.

The module above however is fairly complex (mainly because it also supports POSIX ACLs), so I'm not really sure whether it would be worth introducing additional complexity if it's only used for like 2 modules.

Perhaps a module like that might have more user out-of-tree than in-tree? I know that personally I would use it out-of-tree (for my nixos configs).

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/nixpkgs-policy-as-for-systemd-prestart-setup-scripts-vs-systemd-tmpfiles/5839/1

I'm closing this as I will (some when in the future) create a PR with broader changes for permissions of services/modules - as mentioned in that discourse thread^ (https://discourse.nixos.org/t/nixpkgs-policy-as-for-systemd-prestart-setup-scripts-vs-systemd-tmpfiles/5839/1).

In the meantime, I'm using:

    systemd.services.transmission.serviceConfig.ExecStartPre = pkgs.lib.mkForce null;