feat: working on sharing server

modules/nixos/guests/torrent/default.nix

@@ -1,16 +1,19 @@
 {
   config,
   flake,
-  pkgs,
   ...
 }:
 let
   inherit (flake.config.people) user0;
   inherit (flake.config.services) instances;
   serviceCfg = instances.torrent;
-  host = instances.torrent;
+  host = instances.torrent.domains.url0;
+  dns0 = instances.web.dns.provider0;
+  dns0Path = "dns/${dns0}";
+
 in
 {
+
   microvm.vms.${serviceCfg.name} = {
     autostart = true;
     config = {
@@ -18,7 +21,10 @@ in
 
       networking.firewall.allowedTCPPorts = [
         22
-        80
+        serviceCfg.ports.port0
+      ];
+      imports = [
+        ./rqbit.nix
       ];
 
       services = {
@@ -42,13 +48,14 @@ in
         network = {
           enable = true;
           networks."10-enp" = {
-            matchConfig.Name = "enp0s5";
+            matchConfig.Name = "enp0s4";
             addresses = [ { Address = "${serviceCfg.interface.ip}/24"; } ];
             gateway = [ serviceCfg.interface.gate ];
           };
         };
         tmpfiles.rules = [
           "d ${serviceCfg.varPaths.path0} 755 ${serviceCfg.name} ${serviceCfg.name} -"
+          "d ${serviceCfg.varPaths.path0}/downloads 755 ${serviceCfg.name} ${serviceCfg.name} -"
         ];
       };
 
@@ -62,6 +69,18 @@ in
             id = serviceCfg.interface.id;
             mac = serviceCfg.interface.mac;
           }
+          {
+            type = "user";
+            id = serviceCfg.interface.idUser;
+            mac = serviceCfg.interface.macUser;
+          }
+        ];
+        forwardPorts = [
+          {
+            from = "host";
+            host.port = serviceCfg.interface.ssh;
+            guest.port = 22;
+          }
         ];
 
         shares = [
@@ -77,13 +96,12 @@ in
             source = serviceCfg.mntPaths.path0;
             tag = "${serviceCfg.name}_data";
           }
-          {
-            mountPoint = "/run/secrets";
-            proto = "virtiofs";
-            source = "/run/secrets/${serviceCfg.name}";
-            tag = "host_secrets";
-          }
-
+          # {
+          #   mountPoint = "/run/secrets";
+          #   proto = "virtiofs";
+          #   source = "/run/secrets/${serviceCfg.name}";
+          #   tag = "host_secrets";
+          # }
         ];
       };
       environment.systemPackages = [ ];
@@ -99,9 +117,7 @@ in
               {$CADDY_AUTH_USER} {$CADDY_AUTH_PASSWORD_HASH}
             }
 
-            reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} {
-              header_up X-Real-IP {remote_host}
-            }
+            reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0}
 
             tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
 
@@ -120,17 +136,21 @@ in
     };
   };
 
-  security.acme.certs.${host} = {
-    dnsProvider = instances.web.dns.provider1;
-    environmentFile = config.sops.secrets."dns/${instances.web.dns.provider1}".path;
+  security.acme.certs."${host}" = {
+    dnsProvider = dns0;
+    environmentFile = config.sops.secrets.${dns0Path}.path;
+    group = "caddy";
   };
 
+  users.users.caddy.extraGroups = [ "acme" ];
+
   systemd = {
     services.caddy = {
       serviceConfig = {
         EnvironmentFile = config.sops.secrets."caddy/${serviceCfg.name}-auth".path;
       };
     };
+
     tmpfiles.rules = [
       "d ${serviceCfg.mntPaths.path0} 0755 microvm wheel - -"
       "d ${serviceCfg.secretPaths.path0}/caddy 755 caddy caddy -"