upRootNutrition/dotfiles
upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-12-07 05:27:13 -06:00
Code Issues Projects 1 Releases Packages Wiki Activity Actions

feat: had to go with qbittorrent (testing ivpn)

Browse source
This commit is contained in:
Nick 2025-11-26 03:29:06 -06:00
parent 0d43e3650a
commit 3e438a6842
5 changed files with 393 additions and 71 deletions
Download patch file Download diff file Expand all files Collapse all files

136
modules/nixos/guests/torrent/default.nix
View file

@ -1,6 +1,7 @@
{
config,
flake,
pkgs,
...
}:
let
@ -10,30 +11,94 @@ let
host = instances.torrent.domains.url0;
dns0 = instances.web.dns.provider0;
dns0Path = "dns/${dns0}";
torrentPort = 2049;
in
{
microvm.vms.${serviceCfg.name} = {
autostart = true;
config = {
system.stateVersion = "25.05";
networking.firewall.allowedTCPPorts = [
22
serviceCfg.ports.port0
];
imports = [
./rqbit.nix
];
networking = {
wg-quick.interfaces = {
wg0 = {
address = [
"172.22.116.126/32"
"fd00:4956:504e:ffff::ac16:747e/128"
];
dns = [ "172.16.0.1" ];
privateKeyFile = "/run/secrets/wireguard-pass";
peers = [
{
publicKey = "hku9gjamhoii8OvxZgx+TdUDIkOAQYFu39qbav2AyUQ=";
endpoint = "89.187.181.116:${builtins.toString torrentPort}";
allowedIPs = [
"0.0.0.0/0"
"::/0"
];
persistentKeepalive = 25;
}
];
};
};
firewall = {
enable = true;
allowedTCPPorts = [
22
torrentPort
serviceCfg.ports.port0
];
allowedUDPPorts = [
torrentPort
];
};
dhcpcd.enable = false;
useNetworkd = true;
};
# imports = [
# ./rqbit.nix
# ];
services = {
rqbit = {
qbittorrent = {
enable = true;
dataDir = "/var/lib/rqbit/downloads";
listenAddress = "0.0.0.0";
webuiPort = serviceCfg.ports.port0;
torrentingPort = torrentPort;
openFirewall = true;
extraArgs = [ ];
serverConfig = {
LegalNotice.Accepted = true;
BitTorrent = {
Session = {
Interface = "wg0";
InterfaceName = "wg0";
MaxConnections = -1;
Port = torrentPort;
MaxConnectionsPerTorrent = -1;
MaxUploads = -1;
MaxUploadsPerTorrent = -1;
};
};
Preferences = {
WebUI = {
Username = "user";
# generate new passwords with this:
# https://codeberg.org/feathecutie/qbittorrent_password
Password_PBKDF2 = "@ByteArray(1bJKXLVSLU6kgCHbCS2lDg==:BmyrMaod6dbJqEe7Ud/JgKAxRMqzsAuEjHcTvLzIBgc5rc5Z7J2X9mbH0cDEAhXqc+O3gQxrckt8S2Gf+zlO9w==)";
};
General = {
Locale = "en";
};
Downloads = {
SavePath = "${serviceCfg.varPaths.path0}/downloads";
TempPathEnabled = false;
PreAllocation = false;
};
};
};
};
openssh = {
@ -48,21 +113,28 @@ in
network = {
enable = true;
networks."10-enp" = {
matchConfig.Name = "enp0s4";
matchConfig.Name = "enp0s5";
addresses = [ { Address = "${serviceCfg.interface.ip}/24"; } ];
gateway = [ serviceCfg.interface.gate ];
};
};
tmpfiles.rules = [
"d ${serviceCfg.varPaths.path0} 755 ${serviceCfg.name} ${serviceCfg.name} -"
"d ${serviceCfg.varPaths.path0}/downloads 755 ${serviceCfg.name} ${serviceCfg.name} -"
];
services.qbittorrent = {
after = [ "wg-quick-wg0.service" ];
requires = [ "wg-quick-wg0.service" ];
};
};
microvm = {
vcpu = 4;
mem = 1024 * 4;
vcpu = 1;
mem = 1024 * 1;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
@ -75,6 +147,7 @@ in
mac = serviceCfg.interface.macUser;
}
];
forwardPorts = [
{
from = "host";
@ -91,20 +164,24 @@ in
proto = "virtiofs";
}
{
mountPoint = "/var/lib/${serviceCfg.name}";
mountPoint = serviceCfg.varPaths.path0;
proto = "virtiofs";
source = serviceCfg.mntPaths.path0;
tag = "${serviceCfg.name}_data";
}
# {
# mountPoint = "/run/secrets";
# proto = "virtiofs";
# source = "/run/secrets/${serviceCfg.name}";
# tag = "host_secrets";
# }
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/run/secrets/proton";
tag = "host_secrets";
}
];
};
environment.systemPackages = [ ];
environment.systemPackages = with pkgs; [
wireguard-tools
speedtest-go
];
};
};
@ -116,7 +193,6 @@ in
basic_auth {
{$CADDY_AUTH_USER} {$CADDY_AUTH_PASSWORD_HASH}
}
reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0}
tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
@ -129,11 +205,15 @@ in
};
sops.secrets = {
"caddy/${serviceCfg.name}-auth" = {
"caddy/share-auth" = {
owner = "caddy";
group = "caddy";
mode = "0400";
};
"proton/wireguard-pass" = {
owner = "root";
mode = "0400";
};
};
security.acme.certs."${host}" = {
@ -147,15 +227,13 @@ in
systemd = {
services.caddy = {
serviceConfig = {
EnvironmentFile = config.sops.secrets."caddy/${serviceCfg.name}-auth".path;
EnvironmentFile = config.sops.secrets."caddy/share-auth".path;
};
};
tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0755 microvm wheel - -"
"d ${serviceCfg.secretPaths.path0}/caddy 755 caddy caddy -"
"d /var/log/caddy 755 caddy caddy -"
];
};
}