feat: working on sharing server

modules/config/instances/config/torrent.nix

@@ -28,6 +28,9 @@ in
     "torrent"
     "p2p"
   ];
+  ports = {
+    port0 = 3030;
+  };
   interface = {
     id = "vm-${name}";
     mac = "02:00:00:00:56:07";

modules/nixos/default.nix

@@ -13,14 +13,11 @@ in
           ivpn
           network
           ollamaMars
-          # plasma
           plymouth
-          # sddm
           tuios
           wireguard
           microvm
           defenseio
-          # midnight
           ;
       };
     };
@@ -36,7 +33,6 @@ in
           wireguard
           microvm
           defenseio
-          # midnight
           ;
       };
     };
@@ -46,7 +42,6 @@ in
         inherit (modules)
           microvm
           defenseio
-          # midnight
           ;
       };
     };
@@ -58,6 +53,7 @@ in
           caddy
           ceresOpenCloud
           comfyui
+          defenseio
           firefly-iii
           forgejo
           jellyfin
@@ -67,10 +63,10 @@ in
           projectSite
           restic
           sambaCeres
+          torrent
           vaultwarden
           website
           zookeeper
-          defenseio
           ;
       };
     };
@@ -82,8 +78,6 @@ in
           caddy
           logrotate
           microvm
-          # midnight
-          # opencloud
           sambaEris
           postgresEris
           defenseio

modules/nixos/guests/torrent/default.nix

@@ -1,16 +1,19 @@
 {
   config,
   flake,
-  pkgs,
   ...
 }:
 let
   inherit (flake.config.people) user0;
   inherit (flake.config.services) instances;
   serviceCfg = instances.torrent;
-  host = instances.torrent;
+  host = instances.torrent.domains.url0;
+  dns0 = instances.web.dns.provider0;
+  dns0Path = "dns/${dns0}";
+
 in
 {
+
   microvm.vms.${serviceCfg.name} = {
     autostart = true;
     config = {
@@ -18,7 +21,10 @@ in
 
       networking.firewall.allowedTCPPorts = [
         22
-        80
+        serviceCfg.ports.port0
+      ];
+      imports = [
+        ./rqbit.nix
       ];
 
       services = {
@@ -42,13 +48,14 @@ in
         network = {
           enable = true;
           networks."10-enp" = {
-            matchConfig.Name = "enp0s5";
+            matchConfig.Name = "enp0s4";
             addresses = [ { Address = "${serviceCfg.interface.ip}/24"; } ];
             gateway = [ serviceCfg.interface.gate ];
           };
         };
         tmpfiles.rules = [
           "d ${serviceCfg.varPaths.path0} 755 ${serviceCfg.name} ${serviceCfg.name} -"
+          "d ${serviceCfg.varPaths.path0}/downloads 755 ${serviceCfg.name} ${serviceCfg.name} -"
         ];
       };
 
@@ -62,6 +69,18 @@ in
             id = serviceCfg.interface.id;
             mac = serviceCfg.interface.mac;
           }
+          {
+            type = "user";
+            id = serviceCfg.interface.idUser;
+            mac = serviceCfg.interface.macUser;
+          }
+        ];
+        forwardPorts = [
+          {
+            from = "host";
+            host.port = serviceCfg.interface.ssh;
+            guest.port = 22;
+          }
         ];
 
         shares = [
@@ -77,13 +96,12 @@ in
             source = serviceCfg.mntPaths.path0;
             tag = "${serviceCfg.name}_data";
           }
-          {
-            mountPoint = "/run/secrets";
-            proto = "virtiofs";
-            source = "/run/secrets/${serviceCfg.name}";
-            tag = "host_secrets";
-          }
-
+          # {
+          #   mountPoint = "/run/secrets";
+          #   proto = "virtiofs";
+          #   source = "/run/secrets/${serviceCfg.name}";
+          #   tag = "host_secrets";
+          # }
         ];
       };
       environment.systemPackages = [ ];
@@ -99,9 +117,7 @@ in
               {$CADDY_AUTH_USER} {$CADDY_AUTH_PASSWORD_HASH}
             }
 
-            reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} {
-              header_up X-Real-IP {remote_host}
-            }
+            reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0}
 
             tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
 
@@ -120,17 +136,21 @@ in
     };
   };
 
-  security.acme.certs.${host} = {
-    dnsProvider = instances.web.dns.provider1;
-    environmentFile = config.sops.secrets."dns/${instances.web.dns.provider1}".path;
+  security.acme.certs."${host}" = {
+    dnsProvider = dns0;
+    environmentFile = config.sops.secrets.${dns0Path}.path;
+    group = "caddy";
   };
 
+  users.users.caddy.extraGroups = [ "acme" ];
+
   systemd = {
     services.caddy = {
       serviceConfig = {
         EnvironmentFile = config.sops.secrets."caddy/${serviceCfg.name}-auth".path;
       };
     };
+
     tmpfiles.rules = [
       "d ${serviceCfg.mntPaths.path0} 0755 microvm wheel - -"
       "d ${serviceCfg.secretPaths.path0}/caddy 755 caddy caddy -"

secrets/secrets.yaml

@@ -47,7 +47,7 @@ glance-jellyfin: ENC[AES256_GCM,data:ozdDKgAWkA88J2j8RtiOP/aQPAt/neUOSlAZF20g510
 opencloud:
     projectenv: ENC[AES256_GCM,data:+XCd3xScfxCN1Zl5L+4RAOjpmMPhVLSBtqH2nkEUpXhssy5EU82qAanNmqwiIJ1VrYXYovuu3XOwRKY3Ub1nsR5h1S0KUCwav2zmFKVopxF/5jVNIk6qR8Ggz/fAa1YQSW+SAnrtRGvP0Q1SERlCgnH4isVxNvWPyWCZKIgiX2Enu7hVwsJXKLYDomRWt47zzXNUzw50aFn7xPtXE/AYbMPBa+FweCrCfkaQ6i6jPvkdc6VBYTqIanD0908wB2SJA+1xvY7bYgRVB17/4a/9DuUN5J4xU84TOW7EFkvC/hWhlhC58GqQrOFyAgTP4YJHKGbLVKPlc4fcNMh5+pENpPG2fRDElCaLoJcYe6sYhaCDSegpDR/U9bgzKirnCu/hmdG+NQ3sGK/C89JL2kZT+tVT1u5JWnKGOGvLGQm73QUmnssDZVd8ubNsnd57W7siqAXY3+DN46yLrGgmTfHTRi4x2DKF8VCD9jXOxWsyoLvKYDyz09H9dI72xlCtSmcrFAt7bY7uEAWutrPCf3Kh/gq6oFUAPBEwfqhgnpgGA1vyA6o4zhxl4Rqye5YZMx2uNkxdA4wmk9KB/e7BVR/P04TSXoAV931OX7bnlw3XjSw5NTPEPnpmwZ3VPRGGkz171RiQQp+CkwUr35+DdwFrGazuv3wlwAhM19h9SRn8jikrw6PPGVehYp8mB/FhpNgqV0nM2DfjaBqE3yMfDzXH5b92t4Q=,iv:6mlHq6yh03x/FbZNu+A9QBoV6ALX1rRWuL13ItJWriI=,tag:tK6Ek2fzgPPWT8WCeU1Frw==,type:str]
 caddy:
-    rqbit-auth: ENC[AES256_GCM,data:f1RMi9uGdWP1hGZOzszC87oAhxJ12q55/XFvxQu80nxu1Zn+MfaBVYXi9imtBnaj2tONQ8/zEDsa4xCTRkr5lPCqrCYJ52UM55w+IO9YWQj9BJSF46SloLFJ8tezze4rNBbE0//ptzXGWWCo,iv:Tm7QDocZlPsz+eR48AEhAYCUgw8N0dvhP5n/TvNRVQI=,tag:k9YDt8sSnRksxKScDf11+A==,type:str]
+    rqbit-auth: ENC[AES256_GCM,data:4fLeeykasmPDtUC5wFRqWEVxRa4ntaiDU2v3AUBdUWxiRQ9EDEk3S1lWpwBtMlan3bU/QsIGVIh/hhWmWD2WdkcaKJxvPGtb9OSJ3wtxCTlI2EsWS1h3BQY4Z1Jf5VVDLR+/dj3mZNv7cu1D,iv:+fIzvbXsE7EoSrfsD1ZzKMmF1BazHre7yXQbjyKdDks=,tag:d/wFZf8szahaU9LqM7lr/g==,type:str]
     comfyui-auth: ENC[AES256_GCM,data:7VTXoRxnD0NyVCFRAjHaZswEUsFuQd/ZIwVfqGPmNNV87hn6CBYWvxvcPPFwe+uw7BmKMt+I66DyKx5ydYENTWxPocyT/rFdgdtWwNoenj+JwsUzegmMbEiH2HCZdiwKj0h1lo142mtA6zkc,iv:xT5XHCj8D4dyvglstE2oqo92fLdscCkaNMux43hJ7nQ=,tag:HgU9wAmjPvfoDXgnorB5yA==,type:str]
 wifi-home: ENC[AES256_GCM,data:5NYSCUyalDf7gZF7WaRQJCo=,iv:RkVZKsmVEBg5M28DSkBD41673iLM+dqDAAhSwjqejck=,tag:QQ17VSWOnU0bGglZq6455Q==,type:str]
 firefly-iii:
@@ -70,7 +70,7 @@ sops:
             bXBOa1VSakoyaWxpODJEOU11QUZCaUEK8Ch9Ten3DdrPHF1DTH2qei85AlHUOaLD
             aNfzakake7ej+MxJYdKEU0bcWofNMKzIlZa2uM10KZSENDP8d8qlig==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-24T08:50:25Z"
-    mac: ENC[AES256_GCM,data:bBYF/In0Wx1YVA39RRwR1sHyLlZTw+AhuSdHTevaqk5s55hyLk5Bk7Z1y/JPQiARezzoRC3tVkLI1Chuhj3IGyo34EoYUesKsvg99Gy1Y3K94VbqoeFub/nOE/Kgm6g2okyfx3jAgQ8HnLTHA4YS/u6reR77U+Engf6ASCuMNnc=,iv:wlsvXcpcgB9zTcZAjkhaIdulSM1ReaNPcQyn1HHAxAU=,tag:8JwOPmMady60wGMpM8mqmQ==,type:str]
+    lastmodified: "2025-11-25T10:47:46Z"
+    mac: ENC[AES256_GCM,data:JF264gi1QgOcPk9GVzFeWrPa9T5AuHxuYQTVLbpSoGnqJEwQCvmsYKe1guqlNRlxm11VDGSa3DB1++0fpd4Vn7ngTxQuLCkCbnBo3fU+SDxe3gYt4c21pT3qabbcIuCGTqf6fy32ZWi8BabcFN1hN+LWuSox40PugnuU5SgZdXs=,iv:dbQb4OITPZozKyprRUV9df22zu+XwAr2S28K4A4Ki5I=,tag:alTMCTyKq/Cxn21h06kkGQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0