qbittorrent + qbit_manage migrated to nixpkgs

hosts/server/configuration.nix

@@ -8,7 +8,10 @@
 let
   lidarrMbGapId = 968;
   qbittorrentRouteTable = 200;
+  qbitUser = config.services.qbittorrent.user;
   serverInterface = config.my.interfaces.server;
+  wgInterface = "wg0";
+  wgServerIp = config.my.ips.wg-server;
 in
 {
   imports = [
@@ -29,7 +32,7 @@ in
     network.firewall = {
       enabledServicePorts = true;
       additionalPorts = [
-        2049 # idk
+        2049
         config.my.ports.syncthingGui
         config.my.ports.syncthingRelay
         config.my.ports.sonarqube
@@ -75,9 +78,9 @@ in
     iproute2.rttablesExtraConfig = ''
       ${toString qbittorrentRouteTable} qbittorrent
     '';
-    wireguard.interfaces.wg0 = lib.mkIf config.my.secureHost {
+    wireguard.interfaces.${wgInterface} = lib.mkIf config.my.secureHost {
       allowedIPsAsRoutes = false;
-      ips = [ "${config.my.ips.wg-server}/32" ];
+      ips = [ "${wgServerIp}/32" ];
       privateKeyFile = config.sops.secrets."server/private".path;
       peers = [
         {
@@ -96,97 +99,101 @@ in
     };
     firewall = {
       allowedUDPPorts = config.networking.firewall.allowedTCPPorts;
-      interfaces.wg0.allowedTCPPorts = [ config.my.servers.nextcloud.port ];
+      interfaces.${wgInterface}.allowedTCPPorts = [ config.my.servers.nextcloud.port ];
     };
   };
-  systemd.services.qbittorrent-vpn-routing =
-    lib.mkIf (config.my.secureHost && config.services.qbittorrent.enable)
-      {
-        description = "Route qBittorrent user traffic through the VPS WireGuard tunnel";
-        before = [ "qbittorrent.service" ];
-        wantedBy = [ "multi-user.target" ];
-        after = [
-          "network-online.target"
-          "wireguard-wg0.service"
-        ];
-        wants = [
-          "network-online.target"
-          "wireguard-wg0.service"
-        ];
-        path = with pkgs; [
-          coreutils
-          gnugrep
-          iproute2
-          shadow
-        ];
-        script = ''
-          qbit_uid="$(id -u ${config.services.qbittorrent.user})"
+  systemd.services = {
+    qbittorrent-vpn-routing = lib.mkIf (config.my.secureHost && config.services.qbittorrent.enable) {
+      description = "Route qBittorrent user traffic through the VPS WireGuard tunnel";
+      before = [ "qbittorrent.service" ];
+      wantedBy = [ "multi-user.target" ];
+      after = [
+        "network-online.target"
+        "wireguard-${wgInterface}.service"
+      ];
+      wants = [
+        "network-online.target"
+        "wireguard-${wgInterface}.service"
+      ];
+      path = with pkgs; [
+        coreutils
+        gnugrep
+        iproute2
+        shadow
+      ];
+      script = ''
+        qbit_uid="$(id -u ${qbitUser})"
 
-          for _ in $(seq 1 30); do
-            if ip -4 addr show dev wg0 >/dev/null 2>&1; then
-              break
-            fi
-            sleep 1
-          done
-
-          if ! ip -4 addr show dev wg0 >/dev/null 2>&1; then
-            echo "wg0 is not available"
-            exit 1
+        for _ in $(seq 1 30); do
+          if ip -4 addr show dev ${wgInterface} >/dev/null 2>&1; then
+            break
           fi
+          sleep 1
+        done
 
-          ip -4 route replace ${config.my.subnets.wg-homelab} dev wg0 src ${config.my.ips.wg-server}
-          ip -4 route replace ${config.my.subnets.wg-friends} dev wg0 src ${config.my.ips.wg-server}
-          ip -4 route replace ${config.my.subnets.wg-guests} dev wg0 src ${config.my.ips.wg-server}
+        if ! ip -4 addr show dev ${wgInterface} >/dev/null 2>&1; then
+          echo "${wgInterface} is not available"
+          exit 1
+        fi
 
-          ip -4 route replace table ${toString qbittorrentRouteTable} ${config.my.subnets.wg-homelab} dev wg0 src ${config.my.ips.wg-server}
-          ip -4 route replace table ${toString qbittorrentRouteTable} ${config.my.subnets.wg-friends} dev wg0 src ${config.my.ips.wg-server}
-          ip -4 route replace table ${toString qbittorrentRouteTable} ${config.my.subnets.wg-guests} dev wg0 src ${config.my.ips.wg-server}
-          ip -4 route replace table ${toString qbittorrentRouteTable} 10.88.0.0/16 dev podman0 src 10.88.0.1
-          ip -4 route replace table ${toString qbittorrentRouteTable} 192.168.100.0/24 dev ${serverInterface} src ${config.my.ips.server}
-          ip -4 route replace table ${toString qbittorrentRouteTable} ${config.my.ips.vps}/32 via ${config.my.ips.router} dev ${serverInterface} src ${config.my.ips.server}
-          ip -4 route replace table ${toString qbittorrentRouteTable} default via ${config.my.ips.wg-vps} dev wg0 src ${config.my.ips.wg-server}
+        ip -4 route replace ${config.my.subnets.wg-homelab} dev ${wgInterface} src ${wgServerIp}
+        ip -4 route replace ${config.my.subnets.wg-friends} dev ${wgInterface} src ${wgServerIp}
+        ip -4 route replace ${config.my.subnets.wg-guests} dev ${wgInterface} src ${wgServerIp}
 
-          while ip -4 rule show | grep -q "uidrange ''${qbit_uid}-''${qbit_uid} lookup ${toString qbittorrentRouteTable}"; do
-            ip -4 rule del uidrange "''${qbit_uid}-''${qbit_uid}" lookup ${toString qbittorrentRouteTable}
-          done
+        ip -4 route replace table ${toString qbittorrentRouteTable} ${config.my.subnets.wg-homelab} dev ${wgInterface} src ${wgServerIp}
+        ip -4 route replace table ${toString qbittorrentRouteTable} ${config.my.subnets.wg-friends} dev ${wgInterface} src ${wgServerIp}
+        ip -4 route replace table ${toString qbittorrentRouteTable} ${config.my.subnets.wg-guests} dev ${wgInterface} src ${wgServerIp}
+        ip -4 route replace table ${toString qbittorrentRouteTable} 10.88.0.0/16 dev podman0 src 10.88.0.1
+        ip -4 route replace table ${toString qbittorrentRouteTable} 192.168.100.0/24 dev ${serverInterface} src ${config.my.ips.server}
+        ip -4 route replace table ${toString qbittorrentRouteTable} ${config.my.ips.vps}/32 via ${config.my.ips.router} dev ${serverInterface} src ${config.my.ips.server}
+        ip -4 route replace table ${toString qbittorrentRouteTable} default via ${config.my.ips.wg-vps} dev ${wgInterface} src ${wgServerIp}
 
-          while ip -4 rule show | grep -q 'from ${config.my.ips.wg-server} lookup ${toString qbittorrentRouteTable}'; do
-            ip -4 rule del from ${config.my.ips.wg-server}/32 lookup ${toString qbittorrentRouteTable}
-          done
+        while ip -4 rule show | grep -q "uidrange ''${qbit_uid}-''${qbit_uid} lookup ${toString qbittorrentRouteTable}"; do
+          ip -4 rule del uidrange "''${qbit_uid}-''${qbit_uid}" lookup ${toString qbittorrentRouteTable}
+        done
 
-          ip -4 rule add from ${config.my.ips.wg-server}/32 lookup ${toString qbittorrentRouteTable} priority 9999
-          ip -4 rule add uidrange "''${qbit_uid}-''${qbit_uid}" lookup ${toString qbittorrentRouteTable} priority 10000
-        '';
-        preStop = ''
-          qbit_uid="$(id -u ${config.services.qbittorrent.user})"
+        while ip -4 rule show | grep -q 'from ${wgServerIp} lookup ${toString qbittorrentRouteTable}'; do
+          ip -4 rule del from ${wgServerIp}/32 lookup ${toString qbittorrentRouteTable}
+        done
 
-          while ip -4 rule show | grep -q 'from ${config.my.ips.wg-server} lookup ${toString qbittorrentRouteTable}'; do
-            ip -4 rule del from ${config.my.ips.wg-server}/32 lookup ${toString qbittorrentRouteTable} || true
-          done
+        ip -4 rule add from ${wgServerIp}/32 lookup ${toString qbittorrentRouteTable} priority 9999
+        ip -4 rule add uidrange "''${qbit_uid}-''${qbit_uid}" lookup ${toString qbittorrentRouteTable} priority 10000
+      '';
+      preStop = ''
+        qbit_uid="$(id -u ${qbitUser})"
 
-          while ip -4 rule show | grep -q "uidrange ''${qbit_uid}-''${qbit_uid} lookup ${toString qbittorrentRouteTable}"; do
-            ip -4 rule del uidrange "''${qbit_uid}-''${qbit_uid}" lookup ${toString qbittorrentRouteTable} || true
-          done
+        while ip -4 rule show | grep -q 'from ${wgServerIp} lookup ${toString qbittorrentRouteTable}'; do
+          ip -4 rule del from ${wgServerIp}/32 lookup ${toString qbittorrentRouteTable} || true
+        done
 
-          ip -4 route del ${config.my.subnets.wg-homelab} dev wg0 || true
-          ip -4 route del ${config.my.subnets.wg-friends} dev wg0 || true
-          ip -4 route del ${config.my.subnets.wg-guests} dev wg0 || true
-          ip -4 route flush table ${toString qbittorrentRouteTable} || true
-        '';
-        serviceConfig = {
-          RemainAfterExit = true;
-          Type = "oneshot";
-        };
+        while ip -4 rule show | grep -q "uidrange ''${qbit_uid}-''${qbit_uid} lookup ${toString qbittorrentRouteTable}"; do
+          ip -4 rule del uidrange "''${qbit_uid}-''${qbit_uid}" lookup ${toString qbittorrentRouteTable} || true
+        done
+
+        ip -4 route del ${config.my.subnets.wg-homelab} dev ${wgInterface} || true
+        ip -4 route del ${config.my.subnets.wg-friends} dev ${wgInterface} || true
+        ip -4 route del ${config.my.subnets.wg-guests} dev ${wgInterface} || true
+        ip -4 route flush table ${toString qbittorrentRouteTable} || true
+      '';
+      serviceConfig = {
+        RemainAfterExit = true;
+        Type = "oneshot";
       };
-  users.users.jawz.packages = builtins.attrValues {
-    inherit (pkgs) podman-compose attic-client;
+    };
   };
-  users.groups.lidarr-mb-gap.gid = lidarrMbGapId;
-  users.users.lidarr-mb-gap = {
-    uid = lidarrMbGapId;
-    isSystemUser = true;
-    group = "lidarr-mb-gap";
-    home = "/var/lib/lidarr-mb-gap";
+  users = {
+    groups.lidarr-mb-gap.gid = lidarrMbGapId;
+    users = {
+      jawz.packages = builtins.attrValues {
+        inherit (pkgs) podman-compose attic-client;
+      };
+      lidarr-mb-gap = {
+        uid = lidarrMbGapId;
+        isSystemUser = true;
+        group = "lidarr-mb-gap";
+        home = "/var/lib/lidarr-mb-gap";
+      };
+    };
   };
   services = {
     btrfs.autoScrub = {

hosts/vps/configuration.nix

@@ -22,14 +22,16 @@ let
     wgHomelab = config.my.subnets.wg-homelab;
   };
   ports = {
-    inherit (config.my.ports) giteaSsh;
-    inherit (config.my.ports) qbittorrent;
-    inherit (config.my.ports) ssh;
+    inherit (config.my.ports)
+      giteaSsh
+      qbittorrent
+      ssh
+      wg
+      ;
     web = [
       80
       443
     ];
-    inherit (config.my.ports) wg;
     syncthing = config.my.ports.syncthingRelay;
     synapseFederation = config.my.ports.synapseSsl;
   };