aires/nix-configuration
aires/nix-configuration
1
0
Fork 0
Code Actions Activity

Services: final qBittorrent setup with VPN

Browse source
This commit is contained in:
Aires 2024-09-13 11:25:39 -04:00
parent 6672f57db8
commit c9dc3cf2e2
4 changed files with 68 additions and 45 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
flake.lock
View file

@ -281,11 +281,11 @@
},
"nixpkgs-unstable": {
"locked": {
"lastModified": 1725983898,
"narHash": "sha256-4b3A9zPpxAxLnkF9MawJNHDtOOl6ruL0r6Og1TEDGCE=",
"lastModified": 1726062873,
"narHash": "sha256-IiA3jfbR7K/B5+9byVi9BZGWTD4VSbWe8VLpp9B/iYk=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "1355a0cbfeac61d785b7183c0caaec1f97361b43",
"rev": "4f807e8940284ad7925ebd0a0993d2a1791acb2f",
"type": "github"
},
"original": {
@ -381,7 +381,7 @@
"dirtyRev": "c5b9c2a8084c913d8ae75c36f9d548f2777d0b42-dirty",
"dirtyShortRev": "c5b9c2a-dirty",
"lastModified": 1726097959,
"narHash": "sha256-o3nETR9jLJN/qWqDhOIhf+CqGkEBRGSywmVo4Ai5wDI=",
"narHash": "sha256-kdESoz3wOmRxcSCFC7JttpR75s+2mEoK4nSW2LZxt5o=",
"type": "git",
"url": "file:./secrets"
},

17
hosts/Hevana/default.nix
View file

@ -1,4 +1,9 @@
{ config, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
# Do not change this value! This tracks when NixOS was installed on your system.
@ -64,6 +69,9 @@ in
};
};
# Disable NetworkManager
networking.networkmanager.enable = lib.mkForce false;
# Configure the system.
aux.system = {
# Enable to allow unfree (e.g. closed source) packages.
@ -129,7 +137,7 @@ in
home = "${services-root}/forgejo";
url = config.secrets.services.forgejo.url;
actions = {
enable = true;
enable = false;
token = config.secrets.services.forgejo.runner-token;
};
};
@ -185,6 +193,11 @@ in
enable = true;
home = "${services-root}/qbittorrent";
url = config.secrets.services.qbittorrent.url;
port = "8090";
vpn = {
enable = true;
privateKey = config.secrets.services.protonvpn.privateKey;
};
};
ssh = {
enable = true;

82
modules/services/qbittorrent.nix
View file

@ -10,7 +10,6 @@ let
UID = 850;
GID = 850;
package = pkgs.qbittorrent-nox;
port = "8090";
in
{
options = {
@ -27,6 +26,11 @@ in
description = "The complete URL where qBittorrent is hosted.";
example = "https://qbittorrent.example.com";
};
port = lib.mkOption {
type = lib.types.str;
default = "8080";
description = "The port to host qBittorrent on.";
};
user = lib.mkOption {
type = lib.types.str;
default = "qbittorrent";
@ -37,8 +41,14 @@ in
default = "qbittorrent";
description = "Group under which qBittorrent runs.";
};
vpn = {
enable = lib.mkEnableOption "Enables a VPN.";
privateKey = lib.mkOption {
type = lib.types.str;
description = "Wireguard private key.";
};
};
};
};
config = lib.mkIf cfg.enable {
@ -47,7 +57,7 @@ in
useACMEHost = pkgs.util.getDomainFromURL cfg.url;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:${port}";
proxyPass = "http://127.0.0.1:${cfg.port}";
extraConfig = ''
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Host $host;
@ -58,41 +68,41 @@ in
};
};
systemd.services.qbittorrent = {
# based on the plex.nix service module and
# https://github.com/qbittorrent/qBittorrent/blob/master/dist/unix/systemd/qbittorrent-nox%40.service.in
description = "qBittorrent service";
documentation = [ "man:qbittorrent-nox(1)" ];
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
unitConfig.RequiresMountsFor = cfg.home;
serviceConfig = {
Type = "simple";
User = cfg.user;
Group = cfg.group;
# Run the pre-start script with full permissions (the "!" prefix) so it
# can create the data directory if necessary.
ExecStartPre =
let
preStartScript = pkgs.writeScript "qbittorrent-run-prestart" ''
#!${pkgs.bash}/bin/bash
# Create data directory if it doesn't exist
if ! test -d "$QBT_PROFILE"; then
echo "Creating initial qBittorrent data directory in: $QBT_PROFILE"
install -d -m 0755 -o "${cfg.user}" -g "${cfg.group}" "$QBT_PROFILE"
fi
'';
in
"!${preStartScript}";
ExecStart = "${package}/bin/qbittorrent-nox";
virtualisation = {
podman.autoPrune.enable = true;
oci-containers.containers = {
qbittorrent = {
image = "lscr.io/linuxserver/qbittorrent:latest";
environment = {
PUID = (builtins.toString UID);
PGID = (builtins.toString GID);
WEBUI_PORT = "${cfg.port}";
};
volumes = [
"${cfg.home}:/config"
"${cfg.home}/qBittorrent/downloads:/downloads"
];
# Forward ports to gluetun if VPN is enabled. Otherwise, open ports directly
extraOptions = lib.mkIf cfg.vpn.enable [ "--network=container:gluetun" ];
dependsOn = lib.mkIf cfg.vpn.enable [ "gluetun" ];
ports = lib.mkIf (!cfg.vpn.enable) [ "${cfg.port}:${cfg.port}" ];
};
gluetun = lib.mkIf cfg.vpn.enable {
image = "qmcgaw/gluetun:latest";
extraOptions = [
"--cap-add=NET_ADMIN"
"--device=/dev/net/tun"
];
environment = {
QBT_PROFILE = cfg.home;
QBT_WEBUI_PORT = port;
VPN_SERVICE_PROVIDER = "protonvpn";
VPN_TYPE = "wireguard";
WIREGUARD_PRIVATE_KEY = config.secrets.services.protonvpn.privateKey;
SERVER_COUNTRIES = "Netherlands";
TZ = "America/New_York";
};
ports = [ "${cfg.port}:${cfg.port}" ];
};
};
};
@ -106,6 +116,6 @@ in
groups.${cfg.group}.gid = GID;
};
systemd.services.nginx.wants = [ config.systemd.services.qbittorrent.name ];
systemd.services.nginx.wants = [ config.systemd.services.podman-qbittorrent.name ];
};
}

2
secrets

@ -1 +1 @@
Subproject commit 2fc0eb462b4f2333ac0d9eb9cb2405e05afe66f7
Subproject commit 98c890dfd160353f4f1b2490263edf3deeb43a27