Add qBittorrent

hosts/plexy/default.nix

@@ -70,6 +70,8 @@
       5201 # iperf3
       8096 # Jellyfin
       15835 # Glance
+      15836 # qBittorrent (Web UI)
+      17650 # qBittorrent (torrent)
     ];
   };
 
@@ -83,6 +85,7 @@
     secrets = {
       "vaultwarden.env" = { };
       "rsyncd.secrets" = { };
+      "qbittorrent.webui-pswd" = { };
     };
   };
 
@@ -120,6 +123,13 @@
             "auth users" = "wekuz";
             "secrets file" = config.sops.secrets."rsyncd.secrets".path;
           };
+          torrents = {
+            path = "/storage/torrents";
+            comment = "Torrents storage";
+            "read only" = false;
+            "auth users" = "wekuz";
+            "secrets file" = config.sops.secrets."rsyncd.secrets".path;
+          };
         };
       };
     };
@@ -147,6 +157,81 @@
       enable = true;
       package = pkgs.unstable.seerr;
     };
+    qbittorrent = {
+      enable = true;
+      torrentingPort = 17650;
+      webuiPort = 15836;
+      serverConfig = {
+        Application.FileLogger = {
+          Enabled = true;
+          Path = "/var/log/qBittorrent";
+          Backup = true;
+          MaxSizeBytes = 65536;
+          DeleteOld = true;
+          Age = 14;
+          AgeType = 0;
+        };
+        BitTorrent.Session = {
+          AddTorrentStopped = false;
+          Preallocation = true;
+          AddExtensionToIncompleteFiles = false;
+          DisableAutoTMMByDefault = false;
+
+          MaxConnections = 1000;
+          MaxConnectionsPerTorrent = 200;
+          MaxUploads = 64;
+          MaxUploadsPerTorrent = 26;
+
+          GlobalDLSpeedLimit = 6000;
+          GlobalUPSpeedLimit = 6000;
+          AlternativeGlobalDLSpeedLimit = 0;
+          AlternativeGlobalUPSpeedLimit = 0;
+          BandwidthSchedulerEnabled = true;
+          DefaultSavePath = "/storage/torrents";
+
+          MaxActiveCheckingTorrents = 1;
+
+          QueueingSystemEnabled = true;
+          MaxActiveDownloads = 3;
+          MaxActiveUploads = 10;
+          MaxActiveTorrents = 200;
+          IgnoreSlowTorrentsForQueueing = true;
+          SlowTorrentsDownloadRate = 500;
+          SlowTorrentsUploadRate = 100;
+          SlowTorrentsInactivityTimer = 60;
+
+          GlobalMaxRatio = -1;
+          GlobalMaxSeedingMinutes = -1;
+          GlobalMaxInactiveSeedingMinutes = -1;
+          ShareLimitAction = "Stop";
+
+          Interface = "";
+          InterfaceAddress = "";
+          InterfaceName = "";
+        };
+        Network = {
+          PortForwardingEnabled = false;
+        };
+        Preferences = {
+          General = {
+            Locale = "en";
+            StatusbarExternalIPDisplayed = true;
+          };
+          Scheduler = {
+            end_time = "@Variant(\0\0\0\xf\x1\x65\xe@)"; # 02:00
+            start_time = "@Variant(\0\0\0\xf\0m\xdd\0)"; # 06:30
+          };
+          WebUI = {
+            Address = "*";
+            Username = "admin";
+            Password_PBKDF2 = builtins.readFile config.sops.secrets."qbittorrent.webui-pswd".path;
+            LocalHostAuth = false;
+          };
+        };
+        Core.AutoDeleteAddedTorrentFile = "never";
+        LegalNotice.Accepted = true;
+      };
+    };
   };
 
   environment.variables.EDITOR = "nvim";
@@ -173,12 +258,18 @@
           "media"
         ];
       };
+      qbittorrent = {
+        extraGroups = [
+          "media"
+        ];
+      };
     };
   };
 
   systemd.tmpfiles.rules = [
     "d /storage 0755 root root -"
     "d /storage/media 2775 wekuz media -"
+    "d /storage/torrents 2775 wekuz media -"
   ];
 
   system.stateVersion = "25.11";

hosts/plexy/secrets.yaml

@@ -1,5 +1,6 @@
 vaultwarden.env: ENC[AES256_GCM,data:PLNb5cFoJaOyUo5U/gpXH0RGVwwQxL3kCE/OLw7MaLWazuBGHIPUEhH+kDMP2cfF916D63w8Ddgb/oH+lHGCw235YwgoqZ9yjWYPG4VB2Jdw+17LeCbirdh3zv8nNzFnSZDJmhz5Pj82+iswju6sYO/H7UfZ3aeASWonKW9LGHVltKSY1rAVhZRu4SvhqPiAxNpEzN0/EDTl46RIxrgEoUraN+Ie8fh1wU9SKevExkPU3NXGO1gG2tWRxclMPgc=,iv:es40/5HpBAhOy2xmU/yCUD43fVVsAXk6qJ3OasKjK3U=,tag:bneErU9pPZkQ2VzbQ1NrJA==,type:str]
 rsyncd.secrets: ENC[AES256_GCM,data:VjHRoZa6/lDtCheKSJyM,iv:kxygNaKOuK0iH/bFY/uKxcbMcYSR8nWDUx+4aDNqTMk=,tag:uYYPWAPCWtvLLGwmOWyH+A==,type:str]
+qbittorrent.webui-pswd: ENC[AES256_GCM,data:NDtnaNKCaO+lmwQvSoHg1fibtffl5Y51mcIbLlMzE3BwLP60Fa4zysYlRZqBgWPNQKHli7BkJqcWZXQt0JkQva0L3c1ijG3190CjjXSwqxeCotwcBLvTyNCydMgs8BRotGnR+52bSZKazglqfo4XGklIf+44Im0WopumOrBX,iv:oGXfsGnUFXhPCdNpVHWI1iia3xZCt7baTsG7JJl1EYw=,tag:cgU3bg2R1PVcyTM71+GIcQ==,type:str]
 sops:
     age:
         - recipient: age1sqssntfzzlhcgp0wuf9wmeavg0hmwmq349npsq8vaxj9sxey5s9ssc82sw
@@ -11,7 +12,7 @@ sops:
             eDUxR1V0ZEFSYnZTYnYzakFydEliaFUKoa/gHecAy01vTk7I02KMGGPHZBql5K48
             hkLDjoWK9dkGRX8kqRd028cuMCQRenLpULEECWp6oV+evUdMf7wRtg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-03T15:46:07Z"
+    lastmodified: "2026-04-10T17:50:47Z"
-    mac: ENC[AES256_GCM,data:gh9Voy28Lo4G1qwQ7/WVAt/L3SAXIY5bs5fdCE0Oywi0ZV4YTJI5VCAcfxuE0Fc3DXdHF0/LORGjKa2l0yp5msMdBVpzI46FBiwYvU+w7EfEoEmhu0yMLf0SZmXkVLEq8u2uVFHGVbR1dOKcdFef+qTIGTlz4cE9VQ01xg/nh7g=,iv:fasXOAm2hjB4ULKT4vPOFnFpAcEgSeNvNM7Zrnk6MvM=,tag:1hWtpuTVdC3H8flA1m0Z0A==,type:str]
+    mac: ENC[AES256_GCM,data:lvT+DIwAEjMQpdjpAvFFIk58nfGl5Mk/m7Q7SaQzqNisCbJ2q330IPhOCOeaoh8k91cLDg2Wz/doJOFAGE6Qbqp+3dKtFOxgPP6bJ0+WNdq+0ZtsL2uAaZHz4Cuy4eZDul184eC2lKLru2FCv1SkLGdT5an2MjcxrpeJqYgOUxY=,iv:IPIR5OBQj8FDwIL4t3yAJeLGu+qhHp9BVJheri2R8d0=,tag:8+r7fK7FWjZtf4F9OSHngw==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.12.2