94 lines
2.6 KiB
Nix
94 lines
2.6 KiB
Nix
{ config, inputs, lib, pkgs, ... }:
|
|
let
|
|
cfg = config.jalr.qbittorrent;
|
|
in
|
|
{
|
|
options.jalr.qbittorrent = {
|
|
enable = lib.mkEnableOption "the qbittorrent service";
|
|
homeDir = lib.mkOption {
|
|
type = lib.types.path;
|
|
default = "/var/lib/qbittorrent";
|
|
};
|
|
configDir = lib.mkOption {
|
|
type = lib.types.path;
|
|
default = "${cfg.homeDir}/config";
|
|
};
|
|
downloadDir = lib.mkOption {
|
|
type = lib.types.path;
|
|
default = "${cfg.homeDir}/download";
|
|
};
|
|
webuiPort = lib.mkOption {
|
|
type = lib.types.int;
|
|
default = 8099;
|
|
};
|
|
sopsFile = lib.mkOption {
|
|
type = lib.types.path;
|
|
default = ../../hosts/${config.networking.hostName}/secrets.yaml;
|
|
description = ''
|
|
The sops secret file that includes the htpasswd file.
|
|
'';
|
|
};
|
|
fqdn = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = "The fqdn nginx should listen on. It must not be used for anything else.";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable
|
|
{
|
|
users.users.qbittorrent = {
|
|
group = "qbittorrent";
|
|
home = cfg.homeDir;
|
|
isSystemUser = true;
|
|
};
|
|
users.groups.qbittorrent = { };
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d '${cfg.downloadDir}' 0775 qbittorrent users - -"
|
|
"d '${cfg.homeDir}' 0771 qbittorrent qbittorrent - -"
|
|
];
|
|
|
|
sops.secrets.sturzbach-htpasswd = {
|
|
inherit (cfg) sopsFile;
|
|
owner = "nginx";
|
|
};
|
|
|
|
systemd.services.qbittorrent = {
|
|
description = "qBittorrent Service";
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
serviceConfig = {
|
|
Restart = "always";
|
|
ExecStart = "${pkgs.master.qbittorrent-nox}/bin/qbittorrent-nox --profile=${cfg.configDir} --webui-port=${toString cfg.webuiPort}";
|
|
User = "qbittorrent";
|
|
Group = "qbittorrent";
|
|
|
|
# Increase number of open file descriptors (default: 1024)
|
|
LimitNOFILE = 65536;
|
|
|
|
# systemd-analyze --no-pager security qbittorrent.service
|
|
CapabilityBoundingSet = null;
|
|
PrivateDevices = true;
|
|
PrivateTmp = true;
|
|
PrivateUsers = true;
|
|
ProtectHome = true;
|
|
RestrictNamespaces = true;
|
|
SystemCallFilter = "@system-service";
|
|
};
|
|
};
|
|
|
|
services.nginx.virtualHosts."${cfg.fqdn}" = {
|
|
enableACME = lib.mkDefault true;
|
|
forceSSL = lib.mkDefault true;
|
|
|
|
basicAuthFile = config.sops.secrets.sturzbach-htpasswd.path;
|
|
|
|
locations = {
|
|
"/" = {
|
|
proxyPass = "http://127.0.0.1:${toString cfg.webuiPort}";
|
|
proxyWebsockets = true;
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|