1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

{ lib, pkgs, ... }:
let
  enable = true;
  port = 7248;

  killSwitchRuleset = pkgs.writeText "qbittorrent-mullvad-only.nft" ''
    table inet qbittorrent_mullvad_only {
      chain output {
        type filter hook output priority -50; policy accept;
        meta skuid "qbittorrent" oifname != "wg-mullvad" oifname != "lo" drop
      }
    }
  '';
in
lib.mkIf enable {
  services = {
    qbittorrent = {
      enable = true;
      openFirewall = true;
      webuiPort = port;
    };
    tailproxy.qbittorrent = {
      enable = true;
      hostname = "qbittorrent";
      inherit port;
      authKey = "tskey-auth-kV7j5FHHHh11CNTRL-wPSNdNQqza8kXxzpnZXha8B7JCvdwCAy"; # One-time key
    };
  };

  systemd.services.qbittorrent-mullvad-only = {
    description = "Restrict qBittorrent's egress to the Mullvad tunnel only";
    wantedBy = [ "multi-user.target" ];
    after = [ "network-pre.target" ];
    before = [ "qbittorrent.service" ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      ExecStart = pkgs.writeShellScript "qbittorrent-mullvad-only-start" ''
        ${pkgs.nftables}/bin/nft delete table inet qbittorrent_mullvad_only 2>/dev/null || true
        ${pkgs.nftables}/bin/nft -f ${killSwitchRuleset}
      '';
    };
  };
}