Rework sturzbach service

modules/default.nix

@@ -42,7 +42,6 @@
     ./pipewire.nix
     ./podman.nix
     ./printers
-    ./qbittorrent
     ./remarkable.nix
     ./sdr.nix
     ./sshd.nix

modules/qbittorrent/default.nix

@@ -1,94 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.jalr.qbittorrent;
-in
-{
-  options.jalr.qbittorrent = {
-    enable = lib.mkEnableOption "the qbittorrent service";
-    homeDir = lib.mkOption {
-      type = lib.types.path;
-      default = "/var/lib/qbittorrent";
-    };
-    configDir = lib.mkOption {
-      type = lib.types.path;
-      default = "${cfg.homeDir}/config";
-    };
-    downloadDir = lib.mkOption {
-      type = lib.types.path;
-      default = "${cfg.homeDir}/download";
-    };
-    webuiPort = lib.mkOption {
-      type = lib.types.int;
-      default = 8099;
-    };
-    sopsFile = lib.mkOption {
-      type = lib.types.path;
-      default = ../../hosts/${config.networking.hostName}/secrets.yaml;
-      description = ''
-        The sops secret file that includes the htpasswd file.
-      '';
-    };
-    fqdn = lib.mkOption {
-      type = lib.types.str;
-      description = "The fqdn nginx should listen on. It must not be used for anything else.";
-    };
-  };
-
-  config = lib.mkIf cfg.enable
-    {
-      users.users.qbittorrent = {
-        group = "qbittorrent";
-        home = cfg.homeDir;
-        isSystemUser = true;
-      };
-      users.groups.qbittorrent = { };
-
-      systemd.tmpfiles.rules = [
-        "d '${cfg.downloadDir}' 0775 qbittorrent users - -"
-        "d '${cfg.homeDir}' 0771 qbittorrent qbittorrent - -"
-      ];
-
-      sops.secrets.sturzbach-htpasswd = {
-        inherit (cfg) sopsFile;
-        owner = "nginx";
-      };
-
-      systemd.services.qbittorrent = {
-        description = "qBittorrent Service";
-        wantedBy = [ "multi-user.target" ];
-
-        serviceConfig = {
-          Restart = "always";
-          ExecStart = "${pkgs.qbittorrent-nox}/bin/qbittorrent-nox --profile=${cfg.configDir} --webui-port=${toString cfg.webuiPort}";
-          User = "qbittorrent";
-          Group = "qbittorrent";
-
-          # Increase number of open file descriptors (default: 1024)
-          LimitNOFILE = 65536;
-
-          # systemd-analyze --no-pager security qbittorrent.service
-          CapabilityBoundingSet = null;
-          PrivateDevices = true;
-          PrivateTmp = true;
-          PrivateUsers = true;
-          ProtectHome = true;
-          RestrictNamespaces = true;
-          SystemCallFilter = "@system-service";
-        };
-      };
-
-      services.nginx.virtualHosts."${cfg.fqdn}" = {
-        enableACME = lib.mkDefault true;
-        forceSSL = lib.mkDefault true;
-
-        basicAuthFile = config.sops.secrets.sturzbach-htpasswd.path;
-
-        locations = {
-          "/" = {
-            proxyPass = "http://127.0.0.1:${toString cfg.webuiPort}";
-            proxyWebsockets = true;
-          };
-        };
-      };
-    };
-}