Everything changed - major rewrite

modules/services/transmission.nix

@@ -15,6 +15,7 @@
 let
   cfg     = config.homey.transmission;
   dataDir = config.homey.storage.mountPoint;
+  domain  = homeyConfig.domain;
 in
 {
   options.homey.transmission = {
@@ -61,6 +62,14 @@ in
       requires = lib.mkAfter [ "mnt-data.mount" "podman-homey-network.service" ];
     };
 
+    # -----------------------------------------------------------------------
+    # Authelia access control — admins only, two_factor; all others denied.
+    # -----------------------------------------------------------------------
+    homey.authelia.accessControlRules = [
+      { priority = 30; domain = [ "torrent.${domain}" ]; subject = [ "group:admins" ]; policy = "two_factor"; }
+      { priority = 31; domain = [ "torrent.${domain}" ]; policy = "deny"; }
+    ];
+
     # -----------------------------------------------------------------------
     # Caddy virtual host — forward_auth, admins only
     # -----------------------------------------------------------------------