1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

{ lib, pkgs, ... }:
let
  enable = true;
  port = 7248;

  mullvadBypassMark = "0x6d6f6c65";
  mullvadBypassCtMark = "0x00000f41";

  ruleset = pkgs.writeText "qbittorrent-mullvad-scope.nft" ''
    table inet qbittorrent_mullvad_scope {
      chain output {
        type route hook output priority 0; policy accept;
        meta skuid != "qbittorrent" meta mark set ${mullvadBypassMark} ct mark set ${mullvadBypassCtMark}
        meta skuid "qbittorrent" oifname != "wg-mullvad" oifname != "lo" drop
      }
    }
  '';
in
lib.mkIf enable {
  services = {
    qbittorrent = {
      enable = true;
      openFirewall = true;
      webuiPort = port;
    };
    tailproxy.qbittorrent = {
      enable = true;
      hostname = "qbittorrent";
      inherit port;
      authKey = "tskey-auth-kV7j5FHHHh11CNTRL-wPSNdNQqza8kXxzpnZXha8B7JCvdwCAy"; # One-time key
    };
  };

  systemd.services.qbittorrent-mullvad-scope = {
    description = "Scope the Mullvad tunnel to qBittorrent only";
    wantedBy = [ "multi-user.target" ];
    after = [ "network-pre.target" ];
    before = [
      "qbittorrent.service"
      "mullvad-daemon.service"
    ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      ExecStart = pkgs.writeShellScript "qbittorrent-mullvad-scope-start" ''
        ${pkgs.nftables}/bin/nft delete table inet qbittorrent_mullvad_scope 2>/dev/null || true
        ${pkgs.nftables}/bin/nft -f ${ruleset}
      '';
    };
  };
}