diff --git a/docker_swarm/playbooks/stacks.yml b/docker_swarm/playbooks/stacks.yml
index aee6e5f..b6e50cc 100644
--- a/docker_swarm/playbooks/stacks.yml
+++ b/docker_swarm/playbooks/stacks.yml
@@ -16,4 +16,4 @@
     - {role: syncthing, tags: syncthing}
     - {role: kitchenowl, tags: kitchenowl}
     - {role: paperless-ngx, tags: paperless-ngx}
-    - {role: jellyfin, tags: jellyfin}
+    - {role: media, tags: media}
diff --git a/docker_swarm/roles/jellyfin/docker-stack.yml.j2 b/docker_swarm/roles/jellyfin/docker-stack.yml.j2
deleted file mode 100644
index 793f49f..0000000
--- a/docker_swarm/roles/jellyfin/docker-stack.yml.j2
+++ /dev/null
@@ -1,56 +0,0 @@
-# vi: ft=yaml
-version: '3.5'
-
-networks:
-  traefik:
-    external: true
-
-volumes:
-  media:
-    driver_opts:
-      type: "nfs"
-      o: "addr=lewis.dmz,nolock,soft,rw"
-      device: ":/mnt/data/nfs/media"
-  config:
-    driver_opts:
-      type: "nfs"
-      o: "addr=lewis.dmz,nolock,soft,rw"
-      device: ":/mnt/data/nfs/jellyfin/config"
-  cache:
-
-services:
-  jellyfin:
-    image: jellyfin/jellyfin
-    # user: uid:gid
-    network_mode: 'host'
-    volumes:
-      - cache:/cache
-      - type: volume
-        source: config
-        target: /config
-        volume:
-          nocopy: true
-      - type: volume
-        source: media
-        target: /media
-        volume:
-          nocopy: true
-      # - /path/to/media2:/media2:ro
-    # Optional - alternative address used for autodiscovery
-    environment:
-      - JELLYFIN_PublishedServerUrl=http://media.kun.is:444
-    # Optional - may be necessary for docker healthcheck to pass if running in host network mode
-    # extra_hosts:
-    #   - "host.docker.internal:host-gateway"
-    networks:
-      - traefik
-    deploy:
-      labels:
-        - traefik.enable=true
-        - traefik.http.routers.jellyfin.entrypoints=localsecure
-        - traefik.http.routers.jellyfin.rule=Host(`media.kun.is`)
-        - traefik.http.routers.jellyfin.tls=true
-        - traefik.http.routers.jellyfin.tls.certresolver=letsencrypt
-        - traefik.http.routers.jellyfin.service=jellyfin
-        - traefik.http.services.jellyfin.loadbalancer.server.port=8096
-        - traefik.docker.network=traefik
diff --git a/docker_swarm/roles/media/docker-stack.yml.j2 b/docker_swarm/roles/media/docker-stack.yml.j2
new file mode 100644
index 0000000..930f017
--- /dev/null
+++ b/docker_swarm/roles/media/docker-stack.yml.j2
@@ -0,0 +1,92 @@
+# vi: ft=yaml
+version: '3.5'
+
+networks:
+  traefik:
+    external: true
+
+volumes:
+  media:
+    driver_opts:
+      type: "nfs"
+      o: "addr=lewis.dmz,nolock,soft,rw"
+      device: ":/mnt/data/nfs/media"
+  jellyfin_config:
+    driver_opts:
+      type: "nfs"
+      o: "addr=lewis.dmz,nolock,soft,rw"
+      device: ":/mnt/data/nfs/jellyfin/config"
+  transmission_config:
+    driver_opts:
+      type: "nfs"
+      o: "addr=lewis.dmz,nolock,soft,rw"
+      device: ":/mnt/data/nfs/transmission/config"
+  jellyfin_cache:
+
+services:
+  jellyfin:
+    image: jellyfin/jellyfin:10.8.13-1
+    network_mode: 'host'
+    volumes:
+      - jellyfin_cache:/cache
+      - type: volume
+        source: jellyfin_config
+        target: /config
+        volume:
+          nocopy: true
+      - type: volume
+        source: media
+        target: /media
+        volume:
+          nocopy: true
+    # Alternative address used for autodiscovery
+    environment:
+      - JELLYFIN_PublishedServerUrl=http://media.kun.is:444
+    # Optional - may be necessary for docker healthcheck to pass if running in host network mode
+    # extra_hosts:
+    #   - "host.docker.internal:host-gateway"
+    networks:
+      - traefik
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.jellyfin.entrypoints=websecure
+        - traefik.http.routers.jellyfin.rule=Host(`media.kun.is`)
+        - traefik.http.routers.jellyfin.tls=true
+        - traefik.http.routers.jellyfin.tls.certresolver=letsencrypt
+        - traefik.http.routers.jellyfin.service=jellyfin
+        - traefik.http.services.jellyfin.loadbalancer.server.port=8096
+        - traefik.docker.network=traefik
+
+  # TODO: port forward torrent ports:
+  # - 51413:51413
+  # - 51413:51413/udp
+  transmission:
+    image: lscr.io/linuxserver/transmission:latest
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Amsterdam
+    volumes:
+      - type: volume
+        source: transmission_config
+        target: /config
+        volume:
+          nocopy: true
+      - type: volume
+        source: media
+        target: /media
+        volume:
+          nocopy: true
+    networks:
+      - traefik
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.transmission.entrypoints=localsecure
+        - traefik.http.routers.transmission.rule=Host(`transmission.kun.is`)
+        - traefik.http.routers.transmission.tls=true
+        - traefik.http.routers.transmission.tls.certresolver=letsencrypt
+        - traefik.http.routers.transmission.service=transmission
+        - traefik.http.services.transmission.loadbalancer.server.port=9091
+        - traefik.docker.network=traefik
diff --git a/docker_swarm/roles/jellyfin/tasks/main.yml b/docker_swarm/roles/media/tasks/main.yml
similarity index 88%
rename from docker_swarm/roles/jellyfin/tasks/main.yml
rename to docker_swarm/roles/media/tasks/main.yml
index 255d462..e95449b 100644
--- a/docker_swarm/roles/jellyfin/tasks/main.yml
+++ b/docker_swarm/roles/media/tasks/main.yml
@@ -1,5 +1,5 @@
 - name: Deploy Docker stack
   docker_stack:
-    name: jellyfin
+    name: media
     compose:
       - "{{ lookup('template', '{{ role_path }}/docker-stack.yml.j2') | from_yaml }}"
diff --git a/nixos/modules/data-sharing.nix b/nixos/modules/data-sharing.nix
index b19eb0b..da52114 100644
--- a/nixos/modules/data-sharing.nix
+++ b/nixos/modules/data-sharing.nix
@@ -17,7 +17,12 @@ let
     "/paperless-ngx/data"
     "/paperless-ngx/redisdata"
     "/media"
+    "/media/books"
+    "/media/movies"
+    "/media/music"
+    "/media/shows"
     "/jellyfin/config"
+    "/transmission/config"
   ];
 
   nfsExports = lib.strings.concatLines (