App overwrites manual settings.json changes on restart

[WiseMetalhead]

I noticed that any manual changes I make to the settings.json file don’t persist after restarting the app. However, if I change the download path through the web interface and then restart the app, that setting is saved to settings.json and stays there permanently.

That would be fine, but unfortunately, not all settings are available through the web UI. For example, the entire rpc section is missing — it only exists in the file.

Is this a known issue, or am I missing something?

[james]

Hello @WiseMetalhead
This was already reported once here: https://forum.cloudron.io/topic/10527/unwanted-configuration-changes

The following settings get written on every app startup - https://git.cloudron.io/packages/transmission-app/-/blob/master/start.sh?ref_type=heads#L13-L20:

# https://github.com/transmission/transmission/blob/main/docs/Editing-Configuration-Files.md
cat /app/data/config/settings.json | \
    jq ".[\"peer-port\"]=${TORRENT_PORT:-51413}" | \
    jq ".[\"rpc-host-whitelist\"]=\"${CLOUDRON_APP_DOMAIN}\"" | \
    jq '.["rpc-authentication-required"]=false' | \
    jq '.["rpc-port"]=9091' | \
    jq '.["rpc-whitelist-enabled"]=false' \
    > /run/settings.json.tmp && mv /run/settings.json.tmp /app/data/config/settings.json

[joseph]

Which setting gets overwritten (that you are configuring?) ?

[WiseMetalhead]

@joseph said in App overwrites manual settings.json changes on restart:

Which setting gets overwritten

In my case, restarting the app resets the following parameters: download-dir (although if I change it through the GUI, it works fine), rpc-authentication-required, and rpc-username.

@james said in App overwrites manual settings.json changes on restart:

This was already reported once here

I went through that thread, but if I understood it correctly, the download-dir parameter was still getting reset even when it was set through the GUI. That really threw me off.

[james]

As you can see from my post rpc-authentication-required is getting set by Cloudron on every app restart.
Do you think we should change this to be only once one creation, instead of every startup?

[WiseMetalhead]

@james said in App overwrites manual settings.json changes on restart:

Do you think we should change this to be only once one creation

I can't speak for everyone, but the idea in my case was to control Transmission remotely using the Tremotesf (https://github.com/equeim/tremotesf-android) mobile app. If you expose the RPC port to the internet, I assume anyone could connect freely, since rpc-authentication-required is explicitly set to false. In that case, having a username and password would definitely help.

I guess this isn’t the most common use case, so it's probably fine to skip the app altogether and just manage Transmission through the browser instead. It’s just not as convenient when you don’t have a computer nearby.

[james]

Hello @WiseMetalhead
After many hours of looking into the Transmission package and especially the RPC part, unfortunately we have to inform you and the users of the Cloudron @transmission app that we will not provide the app with the RPC Port exposed.
After thorough consideration we came to the conclusion that it is simply too insecure.

---

If you truly wish to still do this against our recommendation, you can modify the Transmission app yourself to do this.

[WiseMetalhead]

@james said in App overwrites manual settings.json changes on restart:

After thorough consideration we came to the conclusion that it is simply too insecure.

Hello @james
Thanks a lot for clearing that up and for taking the time to look into it. This is a valid concern.

In the end, I switched to @qbittorrent, where I was able to set up remote access through qBitController. To be honest, I didn’t notice right away that there was another torrent client in the app store besides Transmission.