diff --git a/dashy/conf.yml b/dashy/conf.yml
index 167b81b..992fbb4 100644
--- a/dashy/conf.yml
+++ b/dashy/conf.yml
@@ -8,12 +8,14 @@ sections:
         icon: hl-jellyfin
         url: https://jellyfin.sawyer.services
         target: newtab
-        id: 0_480_jellyfin
       - title: Transmission
         icon: hl-transmission
         url: https://transmission.sawyer.services
         target: newtab
-        id: 1_480_transmission
+      - title: Bitmagnet
+        icon: https://avatars.githubusercontent.com/u/146768397
+        url: bitmagnet.sawyer.services
+        target: newtab
     displayData:
       sortBy: default
       rows: 1
@@ -26,27 +28,22 @@ sections:
         icon: hl-portainer
         url: https://portainer.sawyer.services
         target: newtab
-        id: 0_956_portainer
       - title: Docker Registry
         icon: hl-docker
         url: https://registry.sawyer.services
         target: clipboard
-        id: 1_956_dockerregistry
       - title: Searxng
         icon: hl-searxng
         url: https://search.sawyer.services
         target: newtab
-        id: 2_956_searxng
       - title: File Browser
         icon: hl-filebrowser
         url: https://files.sawyer.services
         target: newtab
-        id: 3_956_filebrowser
       - title: Smoke Ping
         icon: hl-smokeping
         url: https://ping.sawyer.services
         target: newtab
-        id: 4_956_smokeping
     icon: fa fa-wrench
     displayData:
       sortBy: default
@@ -67,17 +64,14 @@ sections:
         icon: hl-adguardhome
         url: https://adguard.sawyer.services
         target: newtab
-        id: 0_746_adguardhome
       - title: DNS
         icon: fa fa-server
         url: tls://dns.sawyer.services:853
         target: clipboard
-        id: 1_746_dns
       - title: Traefik
         icon: hl-traefik
         url: https://traefik.sawyer.services
         target: newtab
-        id: 2_746_traefik
   - name: Tools
     icon: fa fa-server
     displayData:
@@ -91,27 +85,22 @@ sections:
         icon: hl-digital-ocean
         url: https://cloud.digitalocean.com/projects
         target: newtab
-        id: 0_529_digitalocean
       - title: Tailscale
         icon: hl-tailscale
         url: https://login.tailscale.com/admin/machines
         target: newtab
-        id: 1_529_tailscale
       - title: Homelab Github
         icon: hl-github
         url: https://github.com/LegitCamper/homelab
         target: newtab
-        id: 2_529_homelabgithub
       - title: Gateway Github
         icon: hl-github
         url: https://github.com/LegitCamper/homelab-gateway
         target: newtab
-        id: 3_529_gatewaygithub
       - title: Cloudfare
         icon: hl-cloudflare
         url: https://dash.cloudflare.com
         target: newtab
-        id: 4_529_cloudfare
   - name: AI
     displayData:
       sortBy: default
@@ -123,12 +112,10 @@ sections:
       - title: Fooocus
         url: https://fooocus.sawyer.services
         target: newtab
-        id: 0_138_fooocus
       - title: Ollama
         icon: https://ollama.com/public/ollama.png
         url: https://ollama.sawyer.services
         target: newtab
-        id: 1_138_ollama
   - name: Gaming
     displayData:
       sortBy: default
@@ -141,7 +128,6 @@ sections:
         icon: hl-minecraft
         url: mc.sawyer.services
         target: clipboard
-        id: 0_595_minecraft
 appConfig:
   language: en
   layout: auto
diff --git a/media.yml b/media.yml
index a94b271..d647c62 100644
--- a/media.yml
+++ b/media.yml
@@ -44,31 +44,97 @@ services:
 
   transmission-openvpn:
     image: haugene/transmission-openvpn
-    container_name: transmission
+    container_name: transmission-openvpn
     restart: always
     networks:
       - web
-    cap_add:
-        - NET_ADMIN
     volumes:
       - ${DRIVE}/:/data
     env_file:
       - ./secrets/homelab.env
     environment:
       - OPENVPN_OPTS=--pull-filter ignore ifconfig-ipv6
+    devices:
+      - /dev/net/tun:/dev/net/tun
+    cap_add:
+      - NET_ADMIN
+    expose:
+      # any ports needed to expose services through traefik need to be defined here
+      - 9091 # transmission
+      - 3333 # bitmagnet
     ports:
-      - 9091:9091
+      # BitTorrent ports:
+      - "3334:3334/tcp"
+      - "3334:3334/udp"
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=web"
+      - "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https"
+      # transmission
       - "traefik.http.routers.transmission.entrypoints=http"
-      - "traefik.http.routers.transmission.rule=Host(`transmission.${DOMAIN}`) || Host(`torrent.${DOMAIN}`) "
+      - "traefik.http.routers.transmission.rule=Host(`transmission.${DOMAIN}`) || Host(`torrent.${DOMAIN}`)"
       - "traefik.http.middlewares.transmission-https-redirect.redirectscheme.scheme=https"
-      - "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https"
       - "traefik.http.routers.transmission.middlewares=transmission-https-redirect"
       - "traefik.http.routers.transmission-secure.entrypoints=https"
-      - "traefik.http.routers.transmission-secure.rule=Host(`transmission.${DOMAIN}`) || Host(`torrent.${DOMAIN}`) "
+      - "traefik.http.routers.transmission-secure.rule=Host(`transmission.${DOMAIN}`) || Host(`torrent.${DOMAIN}`)"
       - "traefik.http.routers.transmission-secure.tls=true"
       - "traefik.http.routers.transmission-secure.tls.certresolver=${DNS}"
       - "traefik.http.services.transmission-secure.loadbalancer.server.port=9091"
+      - "traefik.http.routers.transmission-secure.service=transmission-secure"
       - "traefik.http.routers.transmission-secure.middlewares=forward-auth"
+      # bitmagnet
+      - "traefik.http.routers.bitmagnet.entrypoints=http"
+      - "traefik.http.routers.bitmagnet.rule=Host(`bitmagnet.${DOMAIN}`)"
+      - "traefik.http.middlewares.bitmagnet-https-redirect.redirectscheme.scheme=https"
+      - "traefik.http.routers.bitmagnet.middlewares=bitmagnet-https-redirect"
+      - "traefik.http.routers.bitmagnet-secure.entrypoints=https"
+      - "traefik.http.routers.bitmagnet-secure.rule=Host(`bitmagnet.${DOMAIN}`)"
+      - "traefik.http.routers.bitmagnet-secure.tls=true"
+      - "traefik.http.routers.bitmagnet-secure.tls.certresolver=${DNS}"
+      - "traefik.http.services.bitmagnet-secure.loadbalancer.server.port=3333"
+      - "traefik.http.routers.bitmagnet-secure.service=bitmagnet-secure"
+      - "traefik.http.routers.bitmagnet-secure.middlewares=forward-auth"
+
+  bitmagnet:
+    image: ghcr.io/bitmagnet-io/bitmagnet:latest
+    restart: always
+    container_name: bitmagnet
+    network_mode: "service:transmission-openvpn"
+    # webui on port 3333
+    env_file:
+      - ./secrets/homelab.env
+    environment:
+      # uses this name because ports are exposed through transmission
+      - POSTGRES_HOST=localhost
+    command:
+      - worker
+      - run
+      - --keys=http_server
+      - --keys=queue_server
+      - --keys=dht_crawler
+    labels:
+      - "traefik.enable=false"
+    depends_on:
+      postgres:
+        condition: service_healthy
+
+  postgres:
+    image: postgres:16-alpine
+    container_name: bitmagnet-postgres
+    network_mode: "service:transmission-openvpn"
+    volumes:
+      - ./data/postgres:/var/lib/postgresql/data
+    restart: always
+    env_file:
+      - ./secrets/homelab.env
+    environment:
+      - POSTGRES_DB=bitmagnet
+    shm_size: 1g
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - pg_isready
+      start_period: 20s
+      interval: 10s
+    labels:
+      - "traefik.enable=false"