Deluge BitTorrent Client on AWS User Guide

Overview

Deluge is a popular, lightweight, cross-platform open source BitTorrent client. It uses a client/server design: a background daemon (deluged) handles all downloading and seeding, while a clean browser based Web UI (deluge-web) lets you add torrents and magnet links, organise downloads, and set bandwidth and connection limits from anywhere. The cloudimg image installs Deluge at a pinned stable release and ships it secure by default: the daemon and Web UI bind to the loopback interface only and are fronted by an nginx reverse proxy that terminates TLS and enforces HTTP basic authentication on every request. The well known default Web UI password is rotated away, and the Web UI password, the daemon connection secret and the basic authentication credential are all set to unique random values on each instance's first boot. Backed by 24/7 cloudimg support.

What is included:

• Deluge 2.2.0 installed into a dedicated Python virtual environment at /opt/deluge, run as the unprivileged deluge system user by deluged.service (daemon) and deluge-web.service (Web UI)
• The daemon bound to 127.0.0.1:58846 and the Web UI bound to 127.0.0.1:8112 - neither is reachable from the network directly
• An nginx reverse proxy on :443 that terminates TLS (a self-signed certificate regenerated per instance on first boot) and enforces HTTP basic authentication, with :80 redirecting to HTTPS
• A per-instance admin credential minted on first boot; only one-way hashes are written to disk (bcrypt in /etc/nginx/deluge.htpasswd, salted SHA1 in the Web UI config), and the plaintext is placed in a root-only note at /root/deluge-credentials.txt
• An unauthenticated /healthz endpoint for load-balancer health checks
• A round-trip self-test at /usr/local/bin/deluge-selftest that proves the appliance end to end, including that the default deluge password is refused and the per-instance password is accepted
• 24/7 cloudimg support

Prerequisites

An AWS account, an EC2 key pair in the target region, and a VPC with a public subnet. m5.large (2 vCPU / 8 GiB RAM) is the recommended instance type. Security group inbound: allow 22/tcp from your management network for SSH, and 443/tcp (and 80/tcp for the HTTPS redirect) for the Web UI. Restrict 443/tcp to the CIDR range you will manage the client from - the Web UI should not be exposed to the whole internet.

Step 1 - Launch the AMI

Subscribe to the listing in AWS Marketplace, choose Continue to Launch, and launch through the EC2 console or the AWS CLI. Select the m5.large instance type, your key pair, and a security group that opens ports 22, 80 and 443.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <your-key-pair> \
  --security-group-ids <security-group-id> \
  --subnet-id <subnet-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=deluge}]'

Step 2 - Connect to your instance

Connect over SSH as the default login user for the OS variant you launched. This listing may ship more than one OS variant; use the matching login user below.

Step 3 - Confirm the services are running

Deluge runs as two long-running services - the daemon and the Web UI - behind nginx, with a one-shot first-boot service that mints the per-instance credentials and TLS certificate. Confirm the stack is healthy:

systemctl is-active deluged.service deluge-web.service nginx.service

All three report active.

Step 4 - Verify the stack and endpoints

Confirm the baked Deluge version, that the daemon and Web UI are bound to the loopback interface only, that the unauthenticated health probe answers, that port 80 redirects to HTTPS, and that the Web UI itself refuses anonymous access:

cat /opt/cloudimg/deluge-VERSION
ss -tln | grep -E ':8112|:58846'
curl -sk -o /dev/null -w 'healthz: HTTP %{http_code}\n' https://127.0.0.1/healthz
curl -s  -o /dev/null -w 'port 80: HTTP %{http_code}\n' http://127.0.0.1/
curl -sk -o /dev/null -w 'unauthenticated Web UI: HTTP %{http_code}\n' https://127.0.0.1/

The daemon is bound to 127.0.0.1:58846 and the Web UI to 127.0.0.1:8112 only, /healthz returns 200, port 80 returns 301 (redirect to HTTPS), and the Web UI returns 401 because nginx enforces basic authentication on every path.

Step 5 - Read your per-instance admin credential

The image ships no shared or default login - the well known default Deluge Web UI password deluge is rotated away on first boot. A unique admin credential is generated for this instance; only one-way hashes are stored on the server, and the plaintext is written to a root-only file. The same password is used for both the outer nginx basic-auth prompt and the Deluge Web UI login, so you only track one secret. Read the username, URL and file permissions:

sudo stat -c '%a %U:%G' /root/deluge-credentials.txt
sudo grep -E '^DELUGE_(USER|URL)=' /root/deluge-credentials.txt

The file is 600 root:root, DELUGE_USER is your admin username, and DELUGE_URL is the HTTPS address to open in your browser. Run sudo cat /root/deluge-credentials.txt to also see the password.

Step 6 - Prove the appliance end to end

A bundled self-test exercises the whole appliance over TLS: the unauthenticated health probe, that anonymous access is refused, that the authenticated Web UI renders, that the Web UI JSON-RPC rejects the old default deluge password and accepts the per-instance one, and that the Web UI is connected to the local daemon.

sudo /usr/local/bin/deluge-selftest

It prints OK deluge self-test passed: ....

Step 7 - Open the Web UI

Browse to https://<public-ip>/ (the value of DELUGE_URL). The certificate is self-signed per instance, so your browser shows a one-time warning; accept it. At the browser's basic-auth prompt enter the admin username and password from the credentials file, then enter the same password at the Deluge Web UI login form.

Once signed in, the main window shows the (initially empty) torrents list, the filter panel, and the status bar confirming the Web UI is connected to the local daemon.

Step 8 - Add your first torrent

Click Add in the toolbar to open the Add Torrents dialog. Add a torrent from a .torrent File or paste a magnet link or URL with Url, then click Add. Deluge registers the torrent with the daemon and begins downloading.

Lawful use: no torrent, tracker or content is preconfigured on this image. You are solely responsible for ensuring that everything you download and share is lawful and that you hold the necessary rights. Use Deluge only for content you are authorised to distribute or obtain - for example your own data, or freely licensed software and open datasets.

Step 9 - Set your download location and limits

Click Preferences in the toolbar to configure the client. Under Downloads, files download to /var/lib/deluge/Downloads by default; change the download location, enable moving completed downloads, or pre-allocate disk space here. Under Bandwidth you can cap upload and download speeds and connection counts, and under Network you can set the listening ports.

Maintenance

• Downloads and state: downloads land in /var/lib/deluge/Downloads and the daemon state lives under /var/lib/deluge. Attach and mount a larger EBS volume there, or take EBS snapshots, to manage capacity and backups.
• Credential: the per-instance admin credential is in /root/deluge-credentials.txt. To rotate the basic-auth password, run sudo /usr/local/sbin/deluge-write-htpasswd admin <new-password>.
• TLS: the image serves HTTPS with a self-signed certificate generated per instance. For production, place your own domain and a CA-signed certificate in front of the instance, or replace the certificate in /etc/nginx/tls.
• Restart: sudo systemctl restart deluged.service deluge-web.service nginx.service if you need to bounce the stack.
• Security: keep 443/tcp restricted to the CIDR you manage from; the daemon RPC (58846) and Web UI (8112) are bound to loopback and are never exposed directly. unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.

This image packages the open source Deluge software (GPL-3.0 License) for convenient deployment on AWS. cloudimg is not affiliated with, endorsed by, or sponsored by the Deluge project.