try torrent setup

nixos/celestia/configuration.nix

@@ -38,6 +38,7 @@ in {
   sops.secrets."restic_ssh_key" = {};
   sops.secrets."restic_documents_repository_password" = {};
   sops.secrets."restic_images_repository_password" = {};
+  sops.secrets."protonvpn_wg_private_key" = {};
 
   imports = [
     ./hardware-configuration.nix
@@ -268,6 +269,10 @@ in {
           subdomain = "immich";
           port = 2283;
         }
+        {
+          subdomain = "qbittorrent";
+          port = 8080;
+        }
       ];
     };
 
@@ -467,6 +472,40 @@ in {
             "/tank/dump:/output"
           ];
         };
+
+        gluetun = {
+          image = "docker.io/qmcgaw/gluetun";
+          autoStart = true;
+          environment = {
+            VPN_SERVICE_PROVIDER = "protonvpn";
+            VPN_TYPE = "wireguard";
+            SERVER_COUNTRIES = "Switzerland";
+            WIREGUARD_ADDRESSES = "10.2.0.2/32";
+            DNS_ADDRESS = "10.2.0.1";
+          };
+          environmentFiles = [
+            config.sops.secrets."protonvpn_wg_private_key".path
+          ];
+          capabilities = {
+            NET_ADMIN = true;
+          };
+          devices = ["/dev/net/tun"];
+          ports = ["127.0.0.1:8080:8080"];
+        };
+
+        qbittorrent = {
+          image = "lscr.io/linuxserver/qbittorrent:latest";
+          autoStart = false;
+          networks = ["container:gluetun"];
+          environment = {
+            WEBUI_PORT = "8080";
+          };
+          dependsOn = ["gluetun"];
+          volumes = [
+            "/var/lib/qbittorrent:/config"
+            "/tank/dump/torrent:/downloads"
+          ];
+        };
       };
     };
   };
@@ -494,6 +533,10 @@ in {
       StateDirectory = "dnscrypt-proxy";
     };
 
+    podman-qbittorrent.serviceConfig = {
+      StateDirectory = "qbittorrent";
+    };
+
     ensure-radarr-perms = ensure-perms "/tank/video/movie" "radarr" "nas";
     ensure-sonarr-perms = ensure-perms "/tank/video/series" "sonarr" "nas";
     ensure-lidarr-perms = ensure-perms "/tank/audio" "lidarr" "nas";

nixos/celestia/secrets.yaml

@@ -5,6 +5,7 @@ photoprism-password-file: ENC[AES256_GCM,data:a0fqrjRDc2M=,iv:H/kLPIJsti8QsOJjwP
 restic_ssh_key: ENC[AES256_GCM,data:NK7WXhnnueZ6kVZJnjShZ/QaNXINrJ6+youN3EPBmNjiLBTJHFg4LVR3MCU1GaK2HJpbz3qEJa/kto9LPONRR0F6LO6/7U17O0fdzF7Ca7u4xHI7uKBE6x9/dhd5MHJ2yQpEUwJnTB6i/++OcbSfTJmp062jTgWxdarngt6skx0m5JIlu6lhLKyFzGa+cBIesFItredQ2SJroUC4rK3CiQLutuaBlhw90wys3T2uTtRRgzQ08AF90+JY5jqflZposQPT0ox+xEegOyZ4UJxX2WToxD998N7/eETxo2E94zL/5f2mGoubDxwPTZp8cPX+1g85tFjhn361OSgHBwgRRT3rs/js1xZkQQO2McKPyGZVHOzQ0GSrpvxiSiUZk8/49eynEkWUsY2YXQxvl3/s6r/Toh9Wbr9mo3X67A2phTx1beEnU8XMwWS/5ZnqtFNHvxC6tfkAIwblNvCc9mTigSYhOji9TBpcZNOCumY/MYzGSCzxSFXcOnsKZKjxdE3ByHFKcMvJ+uiaav000MbdplOOsYLCSpdQAAZH,iv:JFcu2GO8k7awfB8RV17tcFj5KhXmUxnzjnoEdmMaqxc=,tag:awy4njmuS/l5CCFqWdsy3A==,type:str]
 restic_documents_repository_password: ENC[AES256_GCM,data:rcQ5PsvJW2i3e2v1FqbqCOoqiblqFDsqRifzY6YxIKZTNSNrRPgqUduqei/0aSGJTNG+zYS4YRCooCZ/E7mYFg==,iv:IO6OGY+Dfai0Hl/NWT7bqqhTkfhXlUqqnJyQjm87fSw=,tag:K3D112tm+kC5OpEF2t+oZQ==,type:str]
 restic_images_repository_password: ENC[AES256_GCM,data:yNWUqZ9ddkfD15mO7NocUYwqNWPaTHXfLkMNq7yy5xgSG4I3G01mFTt5qCPbZ0n+Y6DFlhDQBLAC5SwOvVNggA==,iv:LqA7TG9TS7eyHZ/xqF+L1w5imPdogQGH0DyokaQj4Bc=,tag:1OLRp7VO8Lfy1nQcUr3OWA==,type:str]
+protonvpn_wg_private_key: ENC[AES256_GCM,data:vLf0t5wz8FvQ1hTYTWJNkeXJLFXgaSpWEpKTrhoa9nScQO0bt5Q9mZqkupOvQrrnaao2QE77qLBLzalODY5vKT/6,iv:y2iipZwQZo2iLpZ6CjZsRM5/bIL6UxuPa3e57+rs59k=,tag:rz+GN1/1lDJl1xxbGYjl+A==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -20,8 +21,8 @@ sops:
             K0RaVVNSczZBcDNtaXhGem5iQnlVTDAK+XogkPQD2xYQ7sW8DwAXaaLA/ftw6vZM
             wsNs0uun9dgGjZIXcU6AIsrJeUiWBl5zgc6CCd/ad/3QxpmKj1p9Mg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-18T18:21:19Z"
-    mac: ENC[AES256_GCM,data:3QqYfYJpIb1kcd6Kh92BbfQIBrsniet3HYVR56V5g/eHRwJpy526A8Gpntc0vdu7Adpv/bbaaPzmCTeanhEXwXB38iXnEsWSsUBn/KyT0bhIi7HcXNfRM6al7cWA6YBwSyy12ElD0Bf/fX2ptUId39tOj3yr7Rg4VaXMr9gEsMk=,iv:s5LlkeHcjoqWeQDBQmoOTZWI7L18bJi/yz3yv8uGoSM=,tag:FH/CbzCyqBp1ebeKIPox8g==,type:str]
+    lastmodified: "2025-02-12T20:41:17Z"
+    mac: ENC[AES256_GCM,data:9HLQtNfOkSSXCXe5KSpluYc1S5CIgQDer0hojBzY0wxUBkE5IzGjCjWXh9oo8OYJs9Dr/pkPBYm1Id7kqeOUbdEU7uZ0sjozrO18F9pSAYM/BbsrUcFrQ6/J+MTs1A4OQrvJFMd1JPHggve+faJv3iGblJQ2spLt4fiHwByKAbk=,iv:Y1HsdA7KFvd4SsNuinyL6DAMPbUOPOAiXMLB9ReZLG0=,tag:XRWQu32CG5JAaWrxRao17g==,type:str]
     pgp:
         - created_at: "2024-01-25T08:00:56Z"
           enc: |-
@@ -36,4 +37,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: 5FA64909521A5C85992F26E0F819AEFF941BB849
     unencrypted_suffix: _unencrypted
-    version: 3.9.1
+    version: 3.9.2