1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

{ lib, config, ... }:
let
  enable = true;
  port = 7248;
in
lib.mkIf enable {
  age.secrets.mullvad.file = ../../secrets/mullvad.age;

  vpnNamespaces.mullvad = {
    enable = true;
    wireguardConfigFile = config.age.secrets.mullvad.path;
    portMappings = [
      {
        from = port;
        to = port;
      }
    ];
  };

  systemd.services.qbittorrent.vpnConfinement = {
    enable = true;
    vpnNamespace = "mullvad";
  };

  services = {
    qbittorrent = {
      enable = true;
      webuiPort = port;
    };
    tailproxy.qbittorrent = {
      enable = true;
      hostname = "qbittorrent";
      host = config.vpnNamespaces.mullvad.namespaceAddress;
      inherit port;
      authKey = "tskey-auth-kV7j5FHHHh11CNTRL-wPSNdNQqza8kXxzpnZXha8B7JCvdwCAy"; # One-time key
    };
  };
}