mirror of
https://gitlab.com/upRootNutrition/dotfiles.git
synced 2025-12-07 21:42:16 -06:00
feat: added bookmarks
This commit is contained in:
Nick
parent
dda9c7dad7
commit
6c645d1dbe
6 changed files with 15 additions and 22 deletions
446
modules/nixos/guests/qbittorrent/default.nix
Executable file
446
modules/nixos/guests/qbittorrent/default.nix
Executable file
|
|
@ -0,0 +1,446 @@
|
|||
{
|
||||
config,
|
||||
flake,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services) instances;
|
||||
serviceCfg = instances.qbittorrent;
|
||||
host = instances.torrent.domains.url0;
|
||||
dns0 = instances.web.dns.provider0;
|
||||
dns0Path = "dns/${dns0}";
|
||||
torrentPort = 51820;
|
||||
vpnEndpoint = "185.111.110.1";
|
||||
localNet = "192.168.50.0/24";
|
||||
in
|
||||
{
|
||||
microvm.vms.${serviceCfg.name} = {
|
||||
autostart = true;
|
||||
config = {
|
||||
system.stateVersion = "25.05";
|
||||
|
||||
# VPN Killswitch - configured BEFORE networking starts
|
||||
boot.kernel.sysctl = {
|
||||
"net.ipv4.ip_forward" = 1;
|
||||
};
|
||||
|
||||
networking = {
|
||||
# Disable default firewall - we're doing it manually
|
||||
firewall.enable = false;
|
||||
|
||||
wg-quick.interfaces = {
|
||||
wg0 = {
|
||||
address = [ "10.2.0.2/32" ];
|
||||
dns = [ "10.2.0.1" ];
|
||||
privateKeyFile = "/run/secrets/wireguard-pass";
|
||||
|
||||
peers = [
|
||||
{
|
||||
publicKey = "QPfiwJQmt5VLEOh1ufLbi1lj6LUnwQY0tgDSh3pWx1k=";
|
||||
endpoint = "${vpnEndpoint}:${toString torrentPort}";
|
||||
allowedIPs = [
|
||||
"0.0.0.0/0"
|
||||
"::/0"
|
||||
];
|
||||
persistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
|
||||
# Now we can safely open the VPN tunnel for all traffic
|
||||
postUp = ''
|
||||
echo "VPN UP: Opening network for VPN and local traffic"
|
||||
|
||||
# Allow ALL traffic through VPN interface
|
||||
${pkgs.iptables}/bin/iptables -A INPUT -i wg0 -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -A OUTPUT -o wg0 -j ACCEPT
|
||||
|
||||
# Allow local network traffic (WebUI, management)
|
||||
${pkgs.iptables}/bin/iptables -A INPUT -i enp0s5 -s ${localNet} -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -A OUTPUT -o enp0s5 -d ${localNet} -j ACCEPT
|
||||
|
||||
# NAT for VPN
|
||||
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
|
||||
|
||||
# Allow forwarding through VPN (for port forwarding)
|
||||
${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -A FORWARD -o wg0 -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -A FORWARD -i enp0s5 -o wg0 -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -A FORWARD -o enp0s5 -i wg0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
|
||||
echo "VPN UP: Network opened for VPN and local traffic"
|
||||
'';
|
||||
|
||||
preDown = ''
|
||||
echo "VPN DOWN: Removing VPN rules, killswitch remains active"
|
||||
${pkgs.iptables}/bin/iptables -D INPUT -i wg0 -j ACCEPT 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/iptables -D OUTPUT -o wg0 -j ACCEPT 2>/dev/null || true
|
||||
|
||||
${pkgs.iptables}/bin/iptables -D INPUT -i enp0s5 -s ${localNet} -j ACCEPT 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/iptables -D OUTPUT -o enp0s5 -d ${localNet} -j ACCEPT 2>/dev/null || true
|
||||
|
||||
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o wg0 -j MASQUERADE 2>/dev/null || true
|
||||
|
||||
${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/iptables -D FORWARD -o wg0 -j ACCEPT 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/iptables -D FORWARD -i enp0s5 -o wg0 -j ACCEPT 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/iptables -D FORWARD -o enp0s5 -i wg0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || true
|
||||
|
||||
echo "VPN DOWN: Killswitch rules remain - no internet access"
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
dhcpcd.enable = false;
|
||||
useNetworkd = true;
|
||||
};
|
||||
|
||||
services = {
|
||||
qbittorrent = {
|
||||
enable = true;
|
||||
webuiPort = serviceCfg.ports.port0;
|
||||
torrentingPort = torrentPort;
|
||||
openFirewall = false; # We're managing firewall manually
|
||||
|
||||
serverConfig = {
|
||||
LegalNotice.Accepted = true;
|
||||
|
||||
BitTorrent = {
|
||||
Session = {
|
||||
Interface = "wg0";
|
||||
InterfaceName = "wg0";
|
||||
Port = torrentPort;
|
||||
MaxConnections = -1;
|
||||
MaxConnectionsPerTorrent = -1;
|
||||
MaxUploads = -1;
|
||||
MaxUploadsPerTorrent = -1;
|
||||
QueueingSystemEnabled = false;
|
||||
uTPRateLimited = false;
|
||||
uTPEnabled = true;
|
||||
AlternativeGlobalDLSpeedLimit = 0;
|
||||
AlternativeGlobalUPSpeedLimit = 0;
|
||||
GlobalMaxInactiveSeedingMinutes = 10224;
|
||||
GlobalMaxRatio = -1;
|
||||
};
|
||||
};
|
||||
|
||||
Preferences = {
|
||||
WebUI = {
|
||||
Username = "user";
|
||||
Password_PBKDF2 = "@ByteArray(1bJKXLVSLU6kgCHbCS2lDg==:BmyrMaod6dbJqEe7Ud/JgKAxRMqzsAuEjHcTvLzIBgc5rc5Z7J2X9mbH0cDEAhXqc+O3gQxrckt8S2Gf+zlO9w==)";
|
||||
};
|
||||
|
||||
General = {
|
||||
Locale = "en";
|
||||
};
|
||||
|
||||
Downloads = {
|
||||
SavePath = "${serviceCfg.varPaths.path0}/downloads";
|
||||
TempPathEnabled = false;
|
||||
PreAllocation = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
};
|
||||
};
|
||||
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
|
||||
systemd = {
|
||||
network = {
|
||||
enable = true;
|
||||
networks."10-enp" = {
|
||||
matchConfig.Name = "enp0s5";
|
||||
addresses = [ { Address = "${serviceCfg.interface.ip}/24"; } ];
|
||||
gateway = [ serviceCfg.interface.gate ];
|
||||
};
|
||||
};
|
||||
|
||||
tmpfiles.rules = [
|
||||
"d ${serviceCfg.varPaths.path0} 755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
"d ${serviceCfg.varPaths.path0}/downloads 755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
];
|
||||
|
||||
services = {
|
||||
# Ensure qBittorrent ONLY starts after VPN is up
|
||||
qbittorrent = {
|
||||
after = [
|
||||
"wg-quick-wg0.service"
|
||||
"network-online.target"
|
||||
];
|
||||
requires = [ "wg-quick-wg0.service" ];
|
||||
wants = [ "network-online.target" ];
|
||||
bindsTo = [ "wg-quick-wg0.service" ]; # Stop if VPN stops
|
||||
|
||||
serviceConfig = {
|
||||
Restart = "on-failure";
|
||||
RestartSec = "10s";
|
||||
};
|
||||
};
|
||||
|
||||
natpmp-portforward = {
|
||||
description = "NAT-PMP Port Forwarding for VPN";
|
||||
after = [
|
||||
"wg-quick-wg0.service"
|
||||
"qbittorrent.service"
|
||||
];
|
||||
requires = [
|
||||
"wg-quick-wg0.service"
|
||||
"qbittorrent.service"
|
||||
];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
Restart = "always";
|
||||
RestartSec = "10s";
|
||||
};
|
||||
|
||||
script = ''
|
||||
PASSWORD=$(cat /run/secrets/qbittorrent-pass)
|
||||
echo "Waiting for qBittorrent to start..."
|
||||
sleep 10
|
||||
|
||||
while true; do
|
||||
echo "Requesting port forwarding from VPN..."
|
||||
|
||||
UDP_OUTPUT=$(${pkgs.libnatpmp}/bin/natpmpc -a 1 0 udp 60 -g 10.2.0.1 2>&1)
|
||||
UDP_PORT=$(echo "$UDP_OUTPUT" | ${pkgs.gnugrep}/bin/grep "Mapped public port" | ${pkgs.gawk}/bin/awk '{print $4}' | head -1)
|
||||
|
||||
TCP_OUTPUT=$(${pkgs.libnatpmp}/bin/natpmpc -a 1 0 tcp 60 -g 10.2.0.1 2>&1)
|
||||
TCP_PORT=$(echo "$TCP_OUTPUT" | ${pkgs.gnugrep}/bin/grep "Mapped public port" | ${pkgs.gawk}/bin/awk '{print $4}' | head -1)
|
||||
|
||||
if [ -n "$UDP_PORT" ] && [ -n "$TCP_PORT" ]; then
|
||||
echo "Port forwarding successful: UDP=$UDP_PORT, TCP=$TCP_PORT"
|
||||
|
||||
# Clean up old dynamic rules
|
||||
${pkgs.iptables}/bin/iptables -t nat -D PREROUTING -i enp0s5 -s ${localNet} -p tcp -j DNAT 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/iptables -t nat -D PREROUTING -i enp0s5 -s ${localNet} -p udp -j DNAT 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/iptables -D FORWARD -i enp0s5 -o wg0 -p tcp -j ACCEPT 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/iptables -D FORWARD -i enp0s5 -o wg0 -p udp -j ACCEPT 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -o enp0s5 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || true
|
||||
|
||||
# DNAT: Forward LAN traffic to qBittorrent on WireGuard interface
|
||||
${pkgs.iptables}/bin/iptables -t nat -A PREROUTING -i enp0s5 -s ${localNet} -p tcp --dport "$TCP_PORT" -j DNAT --to-destination 10.2.0.2:"$TCP_PORT"
|
||||
${pkgs.iptables}/bin/iptables -t nat -A PREROUTING -i enp0s5 -s ${localNet} -p udp --dport "$UDP_PORT" -j DNAT --to-destination 10.2.0.2:"$UDP_PORT"
|
||||
|
||||
# Allow forwarding for these specific ports
|
||||
${pkgs.iptables}/bin/iptables -A FORWARD -i enp0s5 -o wg0 -d 10.2.0.2 -p tcp --dport "$TCP_PORT" -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -A FORWARD -i enp0s5 -o wg0 -d 10.2.0.2 -p udp --dport "$UDP_PORT" -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -o enp0s5 -s 10.2.0.2 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
|
||||
echo "Firewall forwarding rules updated for ports: UDP=$UDP_PORT, TCP=$TCP_PORT"
|
||||
|
||||
# Update qBittorrent listening port via API
|
||||
echo "Logging into qBittorrent API..."
|
||||
COOKIE=$(${pkgs.curl}/bin/curl -s -i \
|
||||
--header "Referer: http://localhost:${toString serviceCfg.ports.port0}" \
|
||||
--data "username=user&password=$PASSWORD" \
|
||||
"http://localhost:${toString serviceCfg.ports.port0}/api/v2/auth/login" | \
|
||||
${pkgs.gnugrep}/bin/grep -i "set-cookie" | ${pkgs.gawk}/bin/awk -F'SID=|;' '{print $2}')
|
||||
|
||||
if [ -n "$COOKIE" ]; then
|
||||
echo "Authentication successful, updating port..."
|
||||
${pkgs.curl}/bin/curl -s \
|
||||
--cookie "SID=$COOKIE" \
|
||||
--data "json={\"listen_port\":$UDP_PORT}" \
|
||||
"http://localhost:${toString serviceCfg.ports.port0}/api/v2/app/setPreferences"
|
||||
|
||||
echo "Updated qBittorrent listening port to $UDP_PORT"
|
||||
else
|
||||
echo "WARNING: Failed to authenticate with qBittorrent API"
|
||||
fi
|
||||
else
|
||||
echo "ERROR: Failed to get forwarded ports"
|
||||
echo "UDP output: $UDP_OUTPUT"
|
||||
echo "TCP output: $TCP_OUTPUT"
|
||||
fi
|
||||
|
||||
sleep 45
|
||||
done
|
||||
'';
|
||||
};
|
||||
killswitch-init = {
|
||||
description = "Initialize VPN Killswitch Before Network";
|
||||
wantedBy = [ "network-pre.target" ];
|
||||
before = [
|
||||
"network-pre.target"
|
||||
"network.target"
|
||||
];
|
||||
after = [ "systemd-modules-load.service" ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
|
||||
script = ''
|
||||
echo "KILLSWITCH: Setting up firewall rules BEFORE network services"
|
||||
|
||||
# Default DROP everything
|
||||
${pkgs.iptables}/bin/iptables -P INPUT DROP
|
||||
${pkgs.iptables}/bin/iptables -P OUTPUT DROP
|
||||
${pkgs.iptables}/bin/iptables -P FORWARD DROP
|
||||
|
||||
${pkgs.iptables}/bin/iptables -F
|
||||
${pkgs.iptables}/bin/iptables -t nat -F
|
||||
${pkgs.iptables}/bin/iptables -X
|
||||
|
||||
# Allow loopback
|
||||
${pkgs.iptables}/bin/iptables -A INPUT -i lo -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -A OUTPUT -o lo -j ACCEPT
|
||||
|
||||
# CRITICAL: Only allow WireGuard endpoint traffic before VPN is up
|
||||
${pkgs.iptables}/bin/iptables -A OUTPUT -o enp0s5 -p udp --dport ${toString torrentPort} -d ${vpnEndpoint} -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -A INPUT -i enp0s5 -p udp --sport ${toString torrentPort} -s ${vpnEndpoint} -j ACCEPT
|
||||
|
||||
# Allow SSH from local network (for management)
|
||||
${pkgs.iptables}/bin/iptables -A INPUT -i enp0s5 -s ${localNet} -p tcp --dport 22 -j ACCEPT
|
||||
${pkgs.iptables}/bin/iptables -A OUTPUT -o enp0s5 -d ${localNet} -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
||||
|
||||
# Block IPv6 completely
|
||||
${pkgs.iptables}/bin/ip6tables -P INPUT DROP 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/ip6tables -P OUTPUT DROP 2>/dev/null || true
|
||||
${pkgs.iptables}/bin/ip6tables -P FORWARD DROP 2>/dev/null || true
|
||||
|
||||
echo "KILLSWITCH: Initialized - Network locked down"
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
microvm = {
|
||||
vcpu = 1;
|
||||
mem = 1024 * 1;
|
||||
hypervisor = "qemu";
|
||||
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = serviceCfg.interface.id;
|
||||
mac = serviceCfg.interface.mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = serviceCfg.interface.idUser;
|
||||
mac = serviceCfg.interface.macUser;
|
||||
}
|
||||
];
|
||||
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = serviceCfg.interface.ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
|
||||
shares = [
|
||||
{
|
||||
source = "/nix/store";
|
||||
mountPoint = "/nix/.ro-store";
|
||||
tag = "ro-store";
|
||||
proto = "virtiofs";
|
||||
}
|
||||
{
|
||||
mountPoint = serviceCfg.varPaths.path0;
|
||||
proto = "virtiofs";
|
||||
source = serviceCfg.mntPaths.path0;
|
||||
tag = "${serviceCfg.name}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets/torrent";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
];
|
||||
};
|
||||
environment.systemPackages = builtins.attrValues {
|
||||
inherit (pkgs)
|
||||
conntrack-tools
|
||||
gawk
|
||||
iptables
|
||||
libnatpmp
|
||||
speedtest-go
|
||||
wireguard-tools
|
||||
;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Host configuration remains the same
|
||||
services = {
|
||||
caddy = {
|
||||
virtualHosts = {
|
||||
"${host}" = {
|
||||
extraConfig = ''
|
||||
basic_auth {
|
||||
{$CADDY_AUTH_USER} {$CADDY_AUTH_PASSWORD_HASH}
|
||||
}
|
||||
reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0}
|
||||
|
||||
tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
|
||||
|
||||
encode zstd gzip
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
sops.secrets = {
|
||||
"caddy/share-auth" = {
|
||||
owner = "caddy";
|
||||
group = "caddy";
|
||||
mode = "0400";
|
||||
};
|
||||
"torrent/wireguard-pass" = {
|
||||
owner = "root";
|
||||
mode = "0400";
|
||||
};
|
||||
"torrent/qbittorrent-pass" = {
|
||||
owner = "root";
|
||||
mode = "0400";
|
||||
};
|
||||
};
|
||||
|
||||
security.acme.certs."${host}" = {
|
||||
dnsProvider = dns0;
|
||||
environmentFile = config.sops.secrets.${dns0Path}.path;
|
||||
group = "caddy";
|
||||
};
|
||||
|
||||
users.users.caddy.extraGroups = [ "acme" ];
|
||||
|
||||
systemd = {
|
||||
services.caddy = {
|
||||
serviceConfig = {
|
||||
EnvironmentFile = config.sops.secrets."caddy/share-auth".path;
|
||||
};
|
||||
};
|
||||
|
||||
tmpfiles.rules = [
|
||||
"d ${serviceCfg.mntPaths.path0} 0755 microvm wheel - -"
|
||||
"d ${serviceCfg.secretPaths.path0}/caddy 755 caddy caddy -"
|
||||
"d /var/log/caddy 755 caddy caddy -"
|
||||
];
|
||||
};
|
||||
|
||||
networking.firewall = {
|
||||
allowedTCPPorts = [
|
||||
38834
|
||||
torrentPort
|
||||
];
|
||||
allowedUDPPorts = [
|
||||
38834
|
||||
torrentPort
|
||||
];
|
||||
};
|
||||
}
|
||||
359
modules/nixos/guests/qbittorrent/rqbit.nix
Executable file
359
modules/nixos/guests/qbittorrent/rqbit.nix
Executable file
|
|
@ -0,0 +1,359 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
with lib;
|
||||
let
|
||||
cfg = config.services.rqbit;
|
||||
in
|
||||
{
|
||||
options.services.rqbit = {
|
||||
enable = mkEnableOption "rqbit BitTorrent client";
|
||||
|
||||
package = mkOption {
|
||||
type = types.package;
|
||||
default = pkgs.rqbit;
|
||||
defaultText = literalExpression "pkgs.rqbit";
|
||||
description = "The rqbit package to use.";
|
||||
};
|
||||
|
||||
dataDir = mkOption {
|
||||
type = types.path;
|
||||
default = "/var/lib/rqbit";
|
||||
description = "Directory to store downloaded torrents.";
|
||||
};
|
||||
|
||||
# HTTP API Configuration
|
||||
httpApi = {
|
||||
listenAddress = mkOption {
|
||||
type = types.str;
|
||||
default = "127.0.0.1";
|
||||
description = "IP address to listen on for the web UI and API.";
|
||||
};
|
||||
|
||||
listenPort = mkOption {
|
||||
type = types.port;
|
||||
default = 3030;
|
||||
description = "Port for the web UI and API.";
|
||||
};
|
||||
|
||||
openFirewall = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = "Open the firewall for the web UI port.";
|
||||
};
|
||||
};
|
||||
|
||||
# BitTorrent TCP Configuration
|
||||
tcp = {
|
||||
minPort = mkOption {
|
||||
type = types.port;
|
||||
default = 4240;
|
||||
description = "Minimum port for incoming BitTorrent connections.";
|
||||
};
|
||||
|
||||
maxPort = mkOption {
|
||||
type = types.port;
|
||||
default = 4260;
|
||||
description = "Maximum port for incoming BitTorrent connections.";
|
||||
};
|
||||
|
||||
disable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = "Disable listening for incoming TCP connections.";
|
||||
};
|
||||
|
||||
openFirewall = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = "Open firewall ports for incoming BitTorrent connections.";
|
||||
};
|
||||
};
|
||||
|
||||
# DHT Configuration
|
||||
dht = {
|
||||
disable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = "Disable DHT (Distributed Hash Table) for peer discovery.";
|
||||
};
|
||||
|
||||
disablePersistence = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = "Disable DHT state persistence (useful for multiple instances).";
|
||||
};
|
||||
};
|
||||
|
||||
# UPnP Configuration
|
||||
upnp = {
|
||||
disablePortForward = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = "Disable UPnP port forwarding.";
|
||||
};
|
||||
|
||||
enableServer = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = "Enable UPnP Media Server to stream torrents.";
|
||||
};
|
||||
|
||||
serverFriendlyName = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default = null;
|
||||
description = "Friendly name for the UPnP server.";
|
||||
example = "rqbit Media Server";
|
||||
};
|
||||
};
|
||||
|
||||
# Rate Limiting
|
||||
rateLimit = {
|
||||
download = mkOption {
|
||||
type = types.nullOr types.int;
|
||||
default = null;
|
||||
description = "Download rate limit in bytes per second.";
|
||||
example = 1048576; # 1 MB/s
|
||||
};
|
||||
|
||||
upload = mkOption {
|
||||
type = types.nullOr types.int;
|
||||
default = null;
|
||||
description = "Upload rate limit in bytes per second.";
|
||||
example = 524288; # 512 KB/s
|
||||
};
|
||||
};
|
||||
|
||||
# Logging Configuration
|
||||
logging = {
|
||||
level = mkOption {
|
||||
type = types.nullOr (
|
||||
types.enum [
|
||||
"trace"
|
||||
"debug"
|
||||
"info"
|
||||
"warn"
|
||||
"error"
|
||||
]
|
||||
);
|
||||
default = null;
|
||||
description = "Console log level.";
|
||||
};
|
||||
|
||||
file = mkOption {
|
||||
type = types.nullOr types.path;
|
||||
default = null;
|
||||
description = "Log file path (in addition to console logging).";
|
||||
example = "/var/log/rqbit/rqbit.log";
|
||||
};
|
||||
|
||||
fileRustLog = mkOption {
|
||||
type = types.str;
|
||||
default = "librqbit=debug,info";
|
||||
description = "RUST_LOG value for the log file.";
|
||||
};
|
||||
};
|
||||
|
||||
# Performance Configuration
|
||||
performance = {
|
||||
workerThreads = mkOption {
|
||||
type = types.nullOr types.ints.positive;
|
||||
default = null;
|
||||
description = "Number of worker threads for the executor.";
|
||||
};
|
||||
|
||||
maxBlockingThreads = mkOption {
|
||||
type = types.ints.positive;
|
||||
default = 8;
|
||||
description = "Maximum blocking threads for disk I/O operations.";
|
||||
};
|
||||
|
||||
singleThreadRuntime = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = "Use tokio's single-threaded runtime (for debugging).";
|
||||
};
|
||||
|
||||
concurrentInitLimit = mkOption {
|
||||
type = types.ints.positive;
|
||||
default = 5;
|
||||
description = "Maximum number of torrents that can initialize simultaneously.";
|
||||
};
|
||||
};
|
||||
|
||||
# Peer Configuration
|
||||
peer = {
|
||||
connectTimeout = mkOption {
|
||||
type = types.str;
|
||||
default = "2s";
|
||||
description = "Peer connection timeout.";
|
||||
example = "1.5s";
|
||||
};
|
||||
|
||||
readWriteTimeout = mkOption {
|
||||
type = types.str;
|
||||
default = "10s";
|
||||
description = "Peer read/write timeout.";
|
||||
example = "5s";
|
||||
};
|
||||
};
|
||||
|
||||
# Tracker Configuration
|
||||
tracker = {
|
||||
refreshInterval = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default = null;
|
||||
description = "Force a specific tracker refresh interval.";
|
||||
example = "30s";
|
||||
};
|
||||
|
||||
trackersFile = mkOption {
|
||||
type = types.nullOr types.path;
|
||||
default = null;
|
||||
description = "File with tracker URLs to use for all torrents.";
|
||||
};
|
||||
};
|
||||
|
||||
# Advanced Options
|
||||
socksProxy = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default = null;
|
||||
description = "SOCKS5 proxy URL.";
|
||||
example = "socks5://user:pass@localhost:1080";
|
||||
};
|
||||
|
||||
blocklistUrl = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default = null;
|
||||
description = "URL to download a P2P blocklist from.";
|
||||
example = "https://example.com/blocklist.txt";
|
||||
};
|
||||
|
||||
umask = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default = null;
|
||||
description = "Set the process umask for file creation permissions.";
|
||||
example = "022";
|
||||
};
|
||||
|
||||
# User/Group Configuration
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
default = "rqbit";
|
||||
description = "User account under which rqbit runs.";
|
||||
};
|
||||
|
||||
group = mkOption {
|
||||
type = types.str;
|
||||
default = "rqbit";
|
||||
description = "Group under which rqbit runs.";
|
||||
};
|
||||
|
||||
extraArgs = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ ];
|
||||
description = "Extra command-line arguments to pass to rqbit.";
|
||||
example = literalExpression ''[ "--experimental-mmap-storage" ]'';
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
systemd.services.rqbit = {
|
||||
description = "rqbit BitTorrent Client";
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
preStart = mkIf (cfg.logging.file != null) ''
|
||||
mkdir -p $(dirname ${cfg.logging.file})
|
||||
chown ${cfg.user}:${cfg.group} $(dirname ${cfg.logging.file})
|
||||
'';
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
Environment = [
|
||||
"XDG_CACHE_HOME=${cfg.dataDir}/.cache"
|
||||
"XDG_DATA_HOME=${cfg.dataDir}/.local/share"
|
||||
];
|
||||
ExecStart =
|
||||
let
|
||||
args = [
|
||||
"${cfg.package}/bin/rqbit"
|
||||
"--http-api-listen-addr ${cfg.httpApi.listenAddress}:${toString cfg.httpApi.listenPort}"
|
||||
]
|
||||
++ optional (cfg.logging.level != null) "-v ${cfg.logging.level}"
|
||||
++ optional (cfg.logging.file != null) "--log-file ${cfg.logging.file}"
|
||||
++ optional (cfg.logging.file != null) "--log-file-rust-log ${cfg.logging.fileRustLog}"
|
||||
++ optional (cfg.tracker.refreshInterval != null) "-i ${cfg.tracker.refreshInterval}"
|
||||
++ optional cfg.performance.singleThreadRuntime "-s"
|
||||
++ optional cfg.dht.disable "--disable-dht"
|
||||
++ optional cfg.dht.disablePersistence "--disable-dht-persistence"
|
||||
++ optional (cfg.peer.connectTimeout != "2s") "--peer-connect-timeout ${cfg.peer.connectTimeout}"
|
||||
++ optional (
|
||||
cfg.peer.readWriteTimeout != "10s"
|
||||
) "--peer-read-write-timeout ${cfg.peer.readWriteTimeout}"
|
||||
++ optional (cfg.performance.workerThreads != null) "-t ${toString cfg.performance.workerThreads}"
|
||||
++ optional cfg.tcp.disable "--disable-tcp-listen"
|
||||
++ optional (cfg.tcp.minPort != 4240) "--tcp-min-port ${toString cfg.tcp.minPort}"
|
||||
++ optional (cfg.tcp.maxPort != 4260) "--tcp-max-port ${toString cfg.tcp.maxPort}"
|
||||
++ optional cfg.upnp.disablePortForward "--disable-upnp-port-forward"
|
||||
++ optional cfg.upnp.enableServer "--enable-upnp-server"
|
||||
++ optional (
|
||||
cfg.upnp.serverFriendlyName != null
|
||||
) "--upnp-server-friendly-name '${cfg.upnp.serverFriendlyName}'"
|
||||
++ optional (
|
||||
cfg.performance.maxBlockingThreads != 8
|
||||
) "--max-blocking-threads ${toString cfg.performance.maxBlockingThreads}"
|
||||
++ optional (cfg.socksProxy != null) "--socks-url ${cfg.socksProxy}"
|
||||
++ optional (
|
||||
cfg.performance.concurrentInitLimit != 5
|
||||
) "--concurrent-init-limit ${toString cfg.performance.concurrentInitLimit}"
|
||||
++ optional (cfg.umask != null) "--umask ${cfg.umask}"
|
||||
++ optional (
|
||||
cfg.rateLimit.download != null
|
||||
) "--ratelimit-download ${toString cfg.rateLimit.download}"
|
||||
++ optional (cfg.rateLimit.upload != null) "--ratelimit-upload ${toString cfg.rateLimit.upload}"
|
||||
++ optional (cfg.blocklistUrl != null) "--blocklist-url ${cfg.blocklistUrl}"
|
||||
++ optional (cfg.tracker.trackersFile != null) "--trackers-filename ${cfg.tracker.trackersFile}"
|
||||
++ cfg.extraArgs
|
||||
++ [
|
||||
"server"
|
||||
"start"
|
||||
cfg.dataDir
|
||||
];
|
||||
in
|
||||
concatStringsSep " " args;
|
||||
Restart = "on-failure";
|
||||
StateDirectory = "rqbit";
|
||||
NoNewPrivileges = true;
|
||||
PrivateTmp = true;
|
||||
ProtectSystem = "strict";
|
||||
ReadWritePaths = [ cfg.dataDir ] ++ optional (cfg.logging.file != null) (dirOf cfg.logging.file);
|
||||
};
|
||||
};
|
||||
|
||||
users.users = mkIf (cfg.user == "rqbit") {
|
||||
rqbit = {
|
||||
isSystemUser = true;
|
||||
group = cfg.group;
|
||||
description = "rqbit BitTorrent client user";
|
||||
};
|
||||
};
|
||||
|
||||
users.groups = mkIf (cfg.group == "rqbit") {
|
||||
rqbit = { };
|
||||
};
|
||||
|
||||
networking.firewall = mkIf (cfg.httpApi.openFirewall || cfg.tcp.openFirewall) {
|
||||
allowedTCPPorts = optional cfg.httpApi.openFirewall cfg.httpApi.listenPort;
|
||||
allowedTCPPortRanges = optional cfg.tcp.openFirewall {
|
||||
from = cfg.tcp.minPort;
|
||||
to = cfg.tcp.maxPort;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue