qbittorrent
qBittorrent stack with optional VPN routing through Gluetun:
- Gluetun: VPN client for containers
- qBittorrent: BitTorrent client
- qui: Alternative qBittorrent interface
By default, qBittorrent routes all traffic through Gluetun. To run qBittorrent without a VPN, set gluetun.enable = false.
Examples
Base
{config, ...}: {
nps.stacks.qbittorrent = {
enable = true;
gluetun = {
vpnProvider = "airvpn";
wireguardPrivateKeyFile = config.sops.secrets."gluetun/wg_pk".path;
wireguardPresharedKeyFile = config.sops.secrets."gluetun/wg_psk".path;
wireguardAddressesFile = config.sops.secrets."gluetun/wg_address".path;
};
};
}Full
{config, ...}: {
nps.stacks.qbittorrent = {
enable = true;
gluetun = {
vpnProvider = "airvpn";
wireguardPrivateKeyFile = config.sops.secrets."gluetun/wg_pk".path;
wireguardPresharedKeyFile = config.sops.secrets."gluetun/wg_psk".path;
wireguardAddressesFile = config.sops.secrets."gluetun/wg_address".path;
extraEnv = {
FIREWALL_VPN_INPUT_PORTS.fromFile = config.sops.secrets."qbittorrent/torrenting_port".path;
};
};
extraEnv = {
TORRENTING_PORT.fromFile = config.sops.secrets."qbittorrent/torrenting_port".path;
};
qui = {
enable = true;
oidc = {
enable = true;
clientSecretFile = config.sops.secrets."qui/authelia/client_secret".path;
};
};
};
}Notes
Other stacks can route their containers through the Gluetun VPN by setting network = ["container:gluetun"] and dependsOnContainer = ["gluetun"] on the container. To instead expose qBittorrent/Gluetun on another stack's network, set nps.containers.gluetun.network = ["<stack>"] (or nps.containers.qbittorrent.network when Gluetun is disabled).
Stack Options
nps.stacks.qbittorrent.enable
Whether to enable qbittorrent.
nps.stacks.qbittorrent.extraEnv
Extra environment variables to set for the container. Variables can be either set directly or sourced from a file (e.g. for secrets).
See https://docs.linuxserver.io/images/docker-qbittorrent/#environment-variables-e
attribute set of (null or boolean or signed integer or string or absolute path or (submodule)){ }{
TORRENTING_PORT = "6881";
}nps.stacks.qbittorrent.gluetun.enable
Whether to enable Gluetun.
nps.stacks.qbittorrent.gluetun.extraEnv
Extra environment variables to set for the container. Variables can be either set directly or sourced from a file (e.g. for secrets).
See https://github.com/qdm12/gluetun-wiki/tree/main/setup/options
attribute set of (null or boolean or signed integer or string or absolute path or (submodule)){ }{
HTTPPROXY_PASSWORD = {
fromFile = "/run/secrets/http_proxy_password";
};
HTTP_CONTROL_SERVER_LOG = "off";
SERVER_NAMES = "Alderamin,Alderamin";
}nps.stacks.qbittorrent.gluetun.settings
Additional Gluetun configuration settings
See https://github.com/qdm12/gluetun-wiki/blob/main/setup/advanced/control-server.md#configuration
nps.stacks.qbittorrent.gluetun.vpnProvider
The VPN provider to use with Gluetun.
nps.stacks.qbittorrent.gluetun.wireguardAddressesFile
Path to the file containing the Wireguard addresses. Will be used to set the WIREGUARD_ADDRESSES environment variable.
nps.stacks.qbittorrent.gluetun.wireguardPresharedKeyFile
Path to the file containing the Wireguard pre-shared key. Will be used to set the WIREGUARD_PRESHARED_KEY environment variable.
nps.stacks.qbittorrent.gluetun.wireguardPrivateKeyFile
Path to the file containing the Wireguard private key. Will be used to set the WIREGUARD_PRIVATE_KEY environment variable.
nps.stacks.qbittorrent.qui.adminPasswordFile
Path to the file containing the admin password. If set, an admin user will be created automatically.
nps.stacks.qbittorrent.qui.adminUsername
Admin username to access the dashboard.
nps.stacks.qbittorrent.qui.enable
Whether to enable qui.
nps.stacks.qbittorrent.qui.oidc.clientSecretFile
The file containing the client secret for the OIDC client that will be registered in Authelia.
For examples on how to generate a client secret, see
https://www.authelia.com/integration/openid-connect/frequently-asked-questions/#client-secret
stringconfig.sops.secrets."immich/authelia/client_secret".path"nps.stacks.qbittorrent.qui.oidc.clientSecretHash
The client secret hash. For examples on how to generate a client secret, see https://www.authelia.com/integration/openid-connect/frequently-asked-questions/#client-secret
The value can be passed in multiple ways:
- As a literal string
- As an absolute path to a file containing the hash (
toFile) - As an absolute oath to a file containing the client_secret, in which case the hash will be automatically computed (
toHash) - As
null
If left unset (null), the client secret will be read from the file specified in the clientSecretFile option and hashed automatically before being passed to the Authelia container.
null or string or (submodule)null# Literal String:
"$pbkdf2-sha512$310000$cbOAIWbfz3vCVXIPIp6d2A$J0klwULa6TvPRCU1HAfuKua/dMKTl8gbTYJz2N73ejGUu0LUGz/y3kwmJLuKuAYGg3WQOT0q9ZzVHHUvpKpgvQ"
# Client secret hash stored in a file
{ fromFile = config.sops.secrets."immich/client_secret_hash".path; }
# Client secret stored in a file: Hash will be computed dynamically
{ toHash = config.sops.secrets."immich/client_secret".path; }
# Null (default): Hash will be computed automatically based on the clientSecretFile option
# Equivalent to { toHash = cfg.oidc.clientSecretFile; }
nullnps.stacks.qbittorrent.qui.oidc.enable
Whether to enable OIDC login with Authelia. This will register an OIDC client in Authelia and setup the necessary configuration.
For details, see:
nps.stacks.qbittorrent.qui.oidc.userGroup
Users of this group will be able to log in