From c9dc3cf2e28af0ac3f123a6e082db0761069f985 Mon Sep 17 00:00:00 2001 From: Andre Date: Fri, 13 Sep 2024 11:25:39 -0400 Subject: [PATCH] Services: final qBittorrent setup with VPN --- flake.lock | 8 +-- hosts/Hevana/default.nix | 17 ++++++- modules/services/qbittorrent.nix | 86 ++++++++++++++++++-------------- secrets | 2 +- 4 files changed, 68 insertions(+), 45 deletions(-) diff --git a/flake.lock b/flake.lock index f935b29..29bf465 100644 --- a/flake.lock +++ b/flake.lock @@ -281,11 +281,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1725983898, - "narHash": "sha256-4b3A9zPpxAxLnkF9MawJNHDtOOl6ruL0r6Og1TEDGCE=", + "lastModified": 1726062873, + "narHash": "sha256-IiA3jfbR7K/B5+9byVi9BZGWTD4VSbWe8VLpp9B/iYk=", "owner": "nixos", "repo": "nixpkgs", - "rev": "1355a0cbfeac61d785b7183c0caaec1f97361b43", + "rev": "4f807e8940284ad7925ebd0a0993d2a1791acb2f", "type": "github" }, "original": { @@ -381,7 +381,7 @@ "dirtyRev": "c5b9c2a8084c913d8ae75c36f9d548f2777d0b42-dirty", "dirtyShortRev": "c5b9c2a-dirty", "lastModified": 1726097959, - "narHash": "sha256-o3nETR9jLJN/qWqDhOIhf+CqGkEBRGSywmVo4Ai5wDI=", + "narHash": "sha256-kdESoz3wOmRxcSCFC7JttpR75s+2mEoK4nSW2LZxt5o=", "type": "git", "url": "file:./secrets" }, diff --git a/hosts/Hevana/default.nix b/hosts/Hevana/default.nix index 5f50be2..3ccea64 100644 --- a/hosts/Hevana/default.nix +++ b/hosts/Hevana/default.nix @@ -1,4 +1,9 @@ -{ config, pkgs, ... }: +{ + config, + lib, + pkgs, + ... +}: let # Do not change this value! This tracks when NixOS was installed on your system. @@ -64,6 +69,9 @@ in }; }; + # Disable NetworkManager + networking.networkmanager.enable = lib.mkForce false; + # Configure the system. aux.system = { # Enable to allow unfree (e.g. closed source) packages. @@ -129,7 +137,7 @@ in home = "${services-root}/forgejo"; url = config.secrets.services.forgejo.url; actions = { - enable = true; + enable = false; token = config.secrets.services.forgejo.runner-token; }; }; @@ -185,6 +193,11 @@ in enable = true; home = "${services-root}/qbittorrent"; url = config.secrets.services.qbittorrent.url; + port = "8090"; + vpn = { + enable = true; + privateKey = config.secrets.services.protonvpn.privateKey; + }; }; ssh = { enable = true; diff --git a/modules/services/qbittorrent.nix b/modules/services/qbittorrent.nix index 81eb3ea..06f49dc 100644 --- a/modules/services/qbittorrent.nix +++ b/modules/services/qbittorrent.nix @@ -10,7 +10,6 @@ let UID = 850; GID = 850; package = pkgs.qbittorrent-nox; - port = "8090"; in { options = { @@ -27,6 +26,11 @@ in description = "The complete URL where qBittorrent is hosted."; example = "https://qbittorrent.example.com"; }; + port = lib.mkOption { + type = lib.types.str; + default = "8080"; + description = "The port to host qBittorrent on."; + }; user = lib.mkOption { type = lib.types.str; default = "qbittorrent"; @@ -37,8 +41,14 @@ in default = "qbittorrent"; description = "Group under which qBittorrent runs."; }; + vpn = { + enable = lib.mkEnableOption "Enables a VPN."; + privateKey = lib.mkOption { + type = lib.types.str; + description = "Wireguard private key."; + }; + }; }; - }; config = lib.mkIf cfg.enable { @@ -47,7 +57,7 @@ in useACMEHost = pkgs.util.getDomainFromURL cfg.url; forceSSL = true; locations."/" = { - proxyPass = "http://127.0.0.1:${port}"; + proxyPass = "http://127.0.0.1:${cfg.port}"; extraConfig = '' proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-Host $host; @@ -58,41 +68,41 @@ in }; }; - systemd.services.qbittorrent = { - # based on the plex.nix service module and - # https://github.com/qbittorrent/qBittorrent/blob/master/dist/unix/systemd/qbittorrent-nox%40.service.in - description = "qBittorrent service"; - documentation = [ "man:qbittorrent-nox(1)" ]; - after = [ "network.target" ]; - wantedBy = [ "multi-user.target" ]; - unitConfig.RequiresMountsFor = cfg.home; + virtualisation = { + podman.autoPrune.enable = true; + oci-containers.containers = { + qbittorrent = { + image = "lscr.io/linuxserver/qbittorrent:latest"; + environment = { + PUID = (builtins.toString UID); + PGID = (builtins.toString GID); + WEBUI_PORT = "${cfg.port}"; + }; + volumes = [ + "${cfg.home}:/config" + "${cfg.home}/qBittorrent/downloads:/downloads" + ]; + # Forward ports to gluetun if VPN is enabled. Otherwise, open ports directly + extraOptions = lib.mkIf cfg.vpn.enable [ "--network=container:gluetun" ]; + dependsOn = lib.mkIf cfg.vpn.enable [ "gluetun" ]; + ports = lib.mkIf (!cfg.vpn.enable) [ "${cfg.port}:${cfg.port}" ]; + }; - serviceConfig = { - Type = "simple"; - User = cfg.user; - Group = cfg.group; - - # Run the pre-start script with full permissions (the "!" prefix) so it - # can create the data directory if necessary. - ExecStartPre = - let - preStartScript = pkgs.writeScript "qbittorrent-run-prestart" '' - #!${pkgs.bash}/bin/bash - - # Create data directory if it doesn't exist - if ! test -d "$QBT_PROFILE"; then - echo "Creating initial qBittorrent data directory in: $QBT_PROFILE" - install -d -m 0755 -o "${cfg.user}" -g "${cfg.group}" "$QBT_PROFILE" - fi - ''; - in - "!${preStartScript}"; - ExecStart = "${package}/bin/qbittorrent-nox"; - }; - - environment = { - QBT_PROFILE = cfg.home; - QBT_WEBUI_PORT = port; + gluetun = lib.mkIf cfg.vpn.enable { + image = "qmcgaw/gluetun:latest"; + extraOptions = [ + "--cap-add=NET_ADMIN" + "--device=/dev/net/tun" + ]; + environment = { + VPN_SERVICE_PROVIDER = "protonvpn"; + VPN_TYPE = "wireguard"; + WIREGUARD_PRIVATE_KEY = config.secrets.services.protonvpn.privateKey; + SERVER_COUNTRIES = "Netherlands"; + TZ = "America/New_York"; + }; + ports = [ "${cfg.port}:${cfg.port}" ]; + }; }; }; @@ -106,6 +116,6 @@ in groups.${cfg.group}.gid = GID; }; - systemd.services.nginx.wants = [ config.systemd.services.qbittorrent.name ]; + systemd.services.nginx.wants = [ config.systemd.services.podman-qbittorrent.name ]; }; } diff --git a/secrets b/secrets index 2fc0eb4..98c890d 160000 --- a/secrets +++ b/secrets @@ -1 +1 @@ -Subproject commit 2fc0eb462b4f2333ac0d9eb9cb2405e05afe66f7 +Subproject commit 98c890dfd160353f4f1b2490263edf3deeb43a27