qbittorrent: init

system/hosts/mediaserver.nix

@@ -25,9 +25,10 @@ in
     ../nixos/mediaserver-setup.nix
     (import ../nixos/wireguard-netns.nix (args // { inherit secret; }))
     ../nixos/prowlarr.nix
-    ../nixos/sabnzbd.nix
     ../nixos/sonarr.nix
     ../nixos/radarr.nix
+    ../nixos/sabnzbd.nix
+    ../nixos/qbittorrent.nix
     ../nixos/jellyfin.nix
     ../nixos/aria2.nix
 

system/nixos/qbittorrent.nix

@@ -0,0 +1,32 @@
+{ pkgs, ... }:
+
+{
+  systemd.tmpfiles.rules = [
+    "d /var/lib/qbittorrent 0750 media_user media_group"
+  ];
+
+  systemd.services.qbittorrent =
+    let
+      mounts = [ "mnt-downloads.mount" ];
+    in
+    {
+      description = "qbittorrent instance";
+      requires = mounts;
+      bindsTo = [ "wg.service" ];
+      after = [ "wg.service" ] ++ mounts;
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Type = "exec";
+        User = "media_user";
+        Group = "media_group";
+        NetworkNamespacePath = "/var/run/netns/wg";
+        BindReadOnlyPaths = [
+          "/etc/netns/wg/resolv.conf:/etc/resolv.conf:norbind"
+          "/etc/netns/wg/nsswitch.conf:/etc/nsswitch.conf:norbind"
+        ];
+        ExecStart = "${pkgs.qbittorrent-nox}/bin/qbittorrent-nox --profile=/var/lib/qbittorrent";
+        AmbientCapabilities = [ "CAP_NET_RAW" ];
+      };
+    };
+}

system/nixos/sabnzbd.nix

@@ -1,6 +1,10 @@
 { pkgs, ... }:
 
 {
+  systemd.tmpfiles.rules = [
+    "d /var/lib/sabnzbd 0700 media_user media_group"
+  ];
+
   # The nix-provided options force a sabnzbd-user to a certain degree
   systemd.services.sabnzbd =
     let