feat: started working on torrent VM

modules/config/instances/config/torrent.nix

@@ -0,0 +1,54 @@
+{ moduleFunctions }:
+let
+  inherit (moduleFunctions.instancesFunctions)
+    domain0
+    sslPath
+    varPath
+    mntPath
+    secretPath
+    ;
+  label = "Rqbit";
+  name = "rqbit";
+  subdomain = "share";
+  domain = "${subdomain}.${domain0}";
+  secrets = "${secretPath}/${name}";
+  ssl = "${sslPath}/${domain}";
+in
+{
+  label = label;
+  name = name;
+  short = label;
+  domains = {
+    url0 = domain;
+  };
+  subdomain = name;
+  tags = [
+    name
+    "rqbit"
+    "torrent"
+    "p2p"
+  ];
+  interface = {
+    id = "vm-${name}";
+    mac = "02:00:00:00:56:07";
+    idUser = "vmuser-${name}";
+    macUser = "02:00:00:00:00:07";
+    ip = "192.168.50.117";
+    gate = "192.168.50.1";
+    ssh = 2207;
+  };
+  ssl = {
+    path = ssl;
+    cert = "${ssl}/fullchain.pem";
+    key = "${ssl}/key.pem";
+  };
+  varPaths = {
+    path0 = "${varPath}/${name}";
+  };
+  mntPaths = {
+    path0 = "${mntPath}/${name}";
+  };
+  secretPaths = {
+    path0 = secrets;
+  };
+}

modules/home/cli/utilities/rqbit/default.nix

@@ -1,11 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-{
-  home.packages = builtins.attrValues {
-    inherit (pkgs)
-      rqbit
-      ;
-  };
-}

modules/nixos/guests/defenseio/default.nix

@@ -41,11 +41,11 @@ in
         autostart = true;
         config =
           let
-            ceresCpu = 40;
+            ceresCpu = 35;
             erisCpu = 5;
             marsCpu = 18;
-            deimosCpu = 5;
-            phobosCpu = 5;
+            deimosCpu = 4;
+            phobosCpu = 4;
 
             macAddress = "02:00:00:00:00:${macOctet}";
             workers = deviceLogic ceresCpu erisCpu marsCpu deimosCpu phobosCpu;
@@ -78,7 +78,7 @@ in
                   num = num: (num * 1024);
                   ceresRam = num 50;
                   erisRam = num 7;
-                  marsRam = num 22;
+                  marsRam = num 30;
                   deimosRam = num 7;
                   phobosRam = num 7;
                 in

modules/nixos/guests/torrent/default.nix

@@ -0,0 +1,141 @@
+{
+  config,
+  flake,
+  pkgs,
+  ...
+}:
+let
+  inherit (flake.config.people) user0;
+  inherit (flake.config.services) instances;
+  serviceCfg = instances.torrent;
+  host = instances.torrent;
+in
+{
+  microvm.vms.${serviceCfg.name} = {
+    autostart = true;
+    config = {
+      system.stateVersion = "25.05";
+
+      networking.firewall.allowedTCPPorts = [
+        22
+        80
+      ];
+
+      services = {
+        rqbit = {
+          enable = true;
+          dataDir = "/var/lib/rqbit/downloads";
+          listenAddress = "0.0.0.0";
+          openFirewall = true;
+          extraArgs = [ ];
+        };
+
+        openssh = {
+          enable = true;
+          settings.PasswordAuthentication = false;
+        };
+      };
+
+      users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
+
+      systemd = {
+        network = {
+          enable = true;
+          networks."10-enp" = {
+            matchConfig.Name = "enp0s5";
+            addresses = [ { Address = "${serviceCfg.interface.ip}/24"; } ];
+            gateway = [ serviceCfg.interface.gate ];
+          };
+        };
+        tmpfiles.rules = [
+          "d ${serviceCfg.varPaths.path0} 755 ${serviceCfg.name} ${serviceCfg.name} -"
+        ];
+      };
+
+      microvm = {
+        vcpu = 4;
+        mem = 1024 * 4;
+        hypervisor = "qemu";
+        interfaces = [
+          {
+            type = "tap";
+            id = serviceCfg.interface.id;
+            mac = serviceCfg.interface.mac;
+          }
+        ];
+
+        shares = [
+          {
+            source = "/nix/store";
+            mountPoint = "/nix/.ro-store";
+            tag = "ro-store";
+            proto = "virtiofs";
+          }
+          {
+            mountPoint = "/var/lib/${serviceCfg.name}";
+            proto = "virtiofs";
+            source = serviceCfg.mntPaths.path0;
+            tag = "${serviceCfg.name}_data";
+          }
+          {
+            mountPoint = "/run/secrets";
+            proto = "virtiofs";
+            source = "/run/secrets/${serviceCfg.name}";
+            tag = "host_secrets";
+          }
+
+        ];
+      };
+      environment.systemPackages = [ ];
+    };
+  };
+
+  services = {
+    caddy = {
+      virtualHosts = {
+        "${host}" = {
+          extraConfig = ''
+            basic_auth {
+              {$CADDY_AUTH_USER} {$CADDY_AUTH_PASSWORD_HASH}
+            }
+
+            reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} {
+              header_up X-Real-IP {remote_host}
+            }
+
+            tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
+
+            encode zstd gzip
+          '';
+        };
+      };
+    };
+  };
+
+  sops.secrets = {
+    "caddy/${serviceCfg.name}-auth" = {
+      owner = "caddy";
+      group = "caddy";
+      mode = "0400";
+    };
+  };
+
+  security.acme.certs.${host} = {
+    dnsProvider = instances.web.dns.provider1;
+    environmentFile = config.sops.secrets."dns/${instances.web.dns.provider1}".path;
+  };
+
+  systemd = {
+    services.caddy = {
+      serviceConfig = {
+        EnvironmentFile = config.sops.secrets."caddy/${serviceCfg.name}-auth".path;
+      };
+    };
+    tmpfiles.rules = [
+      "d ${serviceCfg.mntPaths.path0} 0755 microvm wheel - -"
+      "d ${serviceCfg.secretPaths.path0}/caddy 755 caddy caddy -"
+      "d /var/log/caddy 755 caddy caddy -"
+
+    ];
+  };
+}

modules/nixos/guests/torrent/rqbit.nix

@@ -0,0 +1,116 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+with lib;
+
+let
+  cfg = config.services.rqbit;
+in
+{
+  options.services.rqbit = {
+    enable = mkEnableOption "rqbit BitTorrent client";
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.rqbit;
+      defaultText = literalExpression "pkgs.rqbit";
+      description = "The rqbit package to use.";
+    };
+
+    dataDir = mkOption {
+      type = types.path;
+      default = "/var/lib/rqbit";
+      description = "Directory to store downloaded torrents.";
+    };
+
+    listenAddress = mkOption {
+      type = types.str;
+      default = "127.0.0.1";
+      description = "IP address to listen on for the web UI and API.";
+    };
+
+    listenPort = mkOption {
+      type = types.port;
+      default = 3030;
+      description = "Port for the web UI and API.";
+    };
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Open the firewall for the web UI port.";
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "rqbit";
+      description = "User account under which rqbit runs.";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "rqbit";
+      description = "Group under which rqbit runs.";
+    };
+
+    extraArgs = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = "Extra command-line arguments to pass to rqbit.";
+      example = literalExpression ''[ "--upnp" "--enable-upnp-server" ]'';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.rqbit = {
+      description = "rqbit BitTorrent Client";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        User = cfg.user;
+        Group = cfg.group;
+
+        Environment = [
+          "XDG_CACHE_HOME=/var/lib/rqbit/.cache"
+          "XDG_DATA_HOME=/var/lib/rqbit/.local/share"
+        ];
+
+        ExecStart = ''
+          ${cfg.package}/bin/rqbit \
+            --http-api-listen-addr ${cfg.listenAddress}:${toString cfg.listenPort} \
+            ${concatStringsSep " " cfg.extraArgs} \
+            server start ${cfg.dataDir}
+        '';
+        Restart = "on-failure";
+
+        StateDirectory = "rqbit";
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectSystem = "strict";
+        ReadWritePaths = [ cfg.dataDir ];
+      };
+    };
+
+    users.users = mkIf (cfg.user == "rqbit") {
+      rqbit = {
+        isSystemUser = true;
+        group = cfg.group;
+        description = "rqbit BitTorrent client user";
+      };
+    };
+
+    users.groups = mkIf (cfg.group == "rqbit") {
+      rqbit = { };
+    };
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.listenPort ];
+    };
+  };
+}