declare qbittorrent

hosts/server/configuration.nix

@@ -9,7 +9,6 @@ let
   lidarrMbGapId = 968;
   qbittorrentRouteTable = 200;
   serverInterface = config.my.interfaces.server;
-  jawzUid = config.users.users.jawz.uid;
 in
 {
   imports = [
@@ -100,71 +99,85 @@ in
       interfaces.wg0.allowedTCPPorts = [ config.my.servers.nextcloud.port ];
     };
   };
-  systemd.services.qbittorrent-vpn-routing = lib.mkIf config.my.secureHost {
-    description = "Route qBittorrent user traffic through the VPS WireGuard tunnel";
-    wantedBy = [ "multi-user.target" ];
-    after = [ "network-online.target" ];
-    wants = [ "network-online.target" ];
-    path = with pkgs; [
-      coreutils
-      gnugrep
-      iproute2
-    ];
-    script = ''
-      for _ in $(seq 1 30); do
-        if ip -4 addr show dev wg0 >/dev/null 2>&1; then
-          break
-        fi
-        sleep 1
-      done
+  systemd.services.qbittorrent-vpn-routing =
+    lib.mkIf (config.my.secureHost && config.services.qbittorrent.enable)
+      {
+        description = "Route qBittorrent user traffic through the VPS WireGuard tunnel";
+        before = [ "qbittorrent.service" ];
+        wantedBy = [ "multi-user.target" ];
+        after = [
+          "network-online.target"
+          "wireguard-wg0.service"
+        ];
+        wants = [
+          "network-online.target"
+          "wireguard-wg0.service"
+        ];
+        path = with pkgs; [
+          coreutils
+          gnugrep
+          iproute2
+          shadow
+        ];
+        script = ''
+          qbit_uid="$(id -u ${config.services.qbittorrent.user})"
 
-      if ! ip -4 addr show dev wg0 >/dev/null 2>&1; then
-        echo "wg0 is not available"
-        exit 1
-      fi
+          for _ in $(seq 1 30); do
+            if ip -4 addr show dev wg0 >/dev/null 2>&1; then
+              break
+            fi
+            sleep 1
+          done
 
-      ip -4 route replace ${config.my.subnets.wg-homelab} dev wg0 src ${config.my.ips.wg-server}
-      ip -4 route replace ${config.my.subnets.wg-friends} dev wg0 src ${config.my.ips.wg-server}
-      ip -4 route replace ${config.my.subnets.wg-guests} dev wg0 src ${config.my.ips.wg-server}
+          if ! ip -4 addr show dev wg0 >/dev/null 2>&1; then
+            echo "wg0 is not available"
+            exit 1
+          fi
 
-      ip -4 route replace table ${toString qbittorrentRouteTable} ${config.my.subnets.wg-homelab} dev wg0 src ${config.my.ips.wg-server}
-      ip -4 route replace table ${toString qbittorrentRouteTable} ${config.my.subnets.wg-friends} dev wg0 src ${config.my.ips.wg-server}
-      ip -4 route replace table ${toString qbittorrentRouteTable} ${config.my.subnets.wg-guests} dev wg0 src ${config.my.ips.wg-server}
-      ip -4 route replace table ${toString qbittorrentRouteTable} 10.88.0.0/16 dev podman0 src 10.88.0.1
-      ip -4 route replace table ${toString qbittorrentRouteTable} 192.168.100.0/24 dev ${serverInterface} src ${config.my.ips.server}
-      ip -4 route replace table ${toString qbittorrentRouteTable} ${config.my.ips.vps}/32 via ${config.my.ips.router} dev ${serverInterface} src ${config.my.ips.server}
-      ip -4 route replace table ${toString qbittorrentRouteTable} default via ${config.my.ips.wg-vps} dev wg0 src ${config.my.ips.wg-server}
+          ip -4 route replace ${config.my.subnets.wg-homelab} dev wg0 src ${config.my.ips.wg-server}
+          ip -4 route replace ${config.my.subnets.wg-friends} dev wg0 src ${config.my.ips.wg-server}
+          ip -4 route replace ${config.my.subnets.wg-guests} dev wg0 src ${config.my.ips.wg-server}
 
-      while ip -4 rule show | grep -q 'uidrange ${toString jawzUid}-${toString jawzUid} lookup ${toString qbittorrentRouteTable}'; do
-        ip -4 rule del uidrange ${toString jawzUid}-${toString jawzUid} lookup ${toString qbittorrentRouteTable}
-      done
+          ip -4 route replace table ${toString qbittorrentRouteTable} ${config.my.subnets.wg-homelab} dev wg0 src ${config.my.ips.wg-server}
+          ip -4 route replace table ${toString qbittorrentRouteTable} ${config.my.subnets.wg-friends} dev wg0 src ${config.my.ips.wg-server}
+          ip -4 route replace table ${toString qbittorrentRouteTable} ${config.my.subnets.wg-guests} dev wg0 src ${config.my.ips.wg-server}
+          ip -4 route replace table ${toString qbittorrentRouteTable} 10.88.0.0/16 dev podman0 src 10.88.0.1
+          ip -4 route replace table ${toString qbittorrentRouteTable} 192.168.100.0/24 dev ${serverInterface} src ${config.my.ips.server}
+          ip -4 route replace table ${toString qbittorrentRouteTable} ${config.my.ips.vps}/32 via ${config.my.ips.router} dev ${serverInterface} src ${config.my.ips.server}
+          ip -4 route replace table ${toString qbittorrentRouteTable} default via ${config.my.ips.wg-vps} dev wg0 src ${config.my.ips.wg-server}
 
-      while ip -4 rule show | grep -q 'from ${config.my.ips.wg-server} lookup ${toString qbittorrentRouteTable}'; do
-        ip -4 rule del from ${config.my.ips.wg-server}/32 lookup ${toString qbittorrentRouteTable}
-      done
+          while ip -4 rule show | grep -q "uidrange ''${qbit_uid}-''${qbit_uid} lookup ${toString qbittorrentRouteTable}"; do
+            ip -4 rule del uidrange "''${qbit_uid}-''${qbit_uid}" lookup ${toString qbittorrentRouteTable}
+          done
 
-      ip -4 rule add from ${config.my.ips.wg-server}/32 lookup ${toString qbittorrentRouteTable} priority 9999
-      ip -4 rule add uidrange ${toString jawzUid}-${toString jawzUid} lookup ${toString qbittorrentRouteTable} priority 10000
-    '';
-    preStop = ''
-      while ip -4 rule show | grep -q 'from ${config.my.ips.wg-server} lookup ${toString qbittorrentRouteTable}'; do
-        ip -4 rule del from ${config.my.ips.wg-server}/32 lookup ${toString qbittorrentRouteTable} || true
-      done
+          while ip -4 rule show | grep -q 'from ${config.my.ips.wg-server} lookup ${toString qbittorrentRouteTable}'; do
+            ip -4 rule del from ${config.my.ips.wg-server}/32 lookup ${toString qbittorrentRouteTable}
+          done
 
-      while ip -4 rule show | grep -q 'uidrange ${toString jawzUid}-${toString jawzUid} lookup ${toString qbittorrentRouteTable}'; do
-        ip -4 rule del uidrange ${toString jawzUid}-${toString jawzUid} lookup ${toString qbittorrentRouteTable} || true
-      done
+          ip -4 rule add from ${config.my.ips.wg-server}/32 lookup ${toString qbittorrentRouteTable} priority 9999
+          ip -4 rule add uidrange "''${qbit_uid}-''${qbit_uid}" lookup ${toString qbittorrentRouteTable} priority 10000
+        '';
+        preStop = ''
+          qbit_uid="$(id -u ${config.services.qbittorrent.user})"
 
-      ip -4 route del ${config.my.subnets.wg-homelab} dev wg0 || true
-      ip -4 route del ${config.my.subnets.wg-friends} dev wg0 || true
-      ip -4 route del ${config.my.subnets.wg-guests} dev wg0 || true
-      ip -4 route flush table ${toString qbittorrentRouteTable} || true
-    '';
-    serviceConfig = {
-      RemainAfterExit = true;
-      Type = "oneshot";
-    };
-  };
+          while ip -4 rule show | grep -q 'from ${config.my.ips.wg-server} lookup ${toString qbittorrentRouteTable}'; do
+            ip -4 rule del from ${config.my.ips.wg-server}/32 lookup ${toString qbittorrentRouteTable} || true
+          done
+
+          while ip -4 rule show | grep -q "uidrange ''${qbit_uid}-''${qbit_uid} lookup ${toString qbittorrentRouteTable}"; do
+            ip -4 rule del uidrange "''${qbit_uid}-''${qbit_uid}" lookup ${toString qbittorrentRouteTable} || true
+          done
+
+          ip -4 route del ${config.my.subnets.wg-homelab} dev wg0 || true
+          ip -4 route del ${config.my.subnets.wg-friends} dev wg0 || true
+          ip -4 route del ${config.my.subnets.wg-guests} dev wg0 || true
+          ip -4 route flush table ${toString qbittorrentRouteTable} || true
+        '';
+        serviceConfig = {
+          RemainAfterExit = true;
+          Type = "oneshot";
+        };
+      };
   users.users.jawz.packages = builtins.attrValues {
     inherit (pkgs) podman-compose attic-client;
   };