nazuna: Enable torrent

machines/nazuna/configuration.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ lib, pkgs, ... }:
 
 {
   imports = [
@@ -7,10 +7,32 @@
   ];
 
   sbruder = {
+    nginx.hardening.enable = true;
     wireguard.home.enable = true;
   };
 
   networking.hostName = "nazuna";
 
   system.stateVersion = "23.05";
+
+  services.nginx = {
+    enable = true;
+
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+  };
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+  systemd.services.nginx.serviceConfig.SupplementaryGroups = lib.singleton "keys";
+
+  sbruder.qbittorrent = {
+    enable = true;
+    fqdn = "sturzbach.sbruder.de";
+  };
+
+  services.nginx.virtualHosts."sturzbach.sbruder.de" = {
+    enableACME = true;
+    forceSSL = true;
+  };
 }

machines/nazuna/secrets.yaml

@@ -1,12 +1,13 @@
 wg-home-private-key: ENC[AES256_GCM,data:fqdPyTa/0Ixr0sO8m06Q1xoAFYBA3q2P4Ho7k6AZBakcKvaXyqFiaISsIuk=,iv:tFANTuH8NHs7cHGduzn66njpCfK1tyydRlBCwv/ffyQ=,tag:Q+dBhMjjHG0cZlfindxBhQ==,type:str]
+wg-qbittorrent-private-key: ENC[AES256_GCM,data:ui0klTtpg1DYl2A1R1PbGngnv0WFY7/qjcTdUpmpTiZVmxJxCdMId/ussvo=,iv:2vpZN1rjipjdBQKRAKv9Qf5EP1PSUBGKWg9j78WoXLs=,tag:WxNLrGNCa9ozYJjN9xRK6w==,type:str]
 sops:
     kms: []
     gcp_kms: []
     azure_kv: []
     hc_vault: []
     age: []
-    lastmodified: "2023-10-04T14:03:02Z"
-    mac: ENC[AES256_GCM,data:hq5V3kGoTgox9/tJRvLk6hhfG4b9V31ACMOhWVI4kEdWUKJ+o5NvRfh7ITgkNpwR1LYMGQBl/b2bhQEGt6QLYG7zd0QL/htOY8rT7u9QAp6EnZxpIYMzEkDjLzT6xLdSiUVl1XgmObkoHagkZARkBk2IWrzsrdxFklS5vjaWzEA=,iv:pM2qoSHOojQ8PaYKoWOagsZol+bNEUDJeuPh+T6v5HM=,tag:rOMaP5hSEzCNm98Vei1jdQ==,type:str]
+    lastmodified: "2023-10-04T14:34:22Z"
+    mac: ENC[AES256_GCM,data:LjETyB9nqN6y/mevYOGXSkWNCNtu/fTXazy3VmZANNQCTuP5J5j6QmS3o9u+VCmrLpntpeNa+BT5VSbHgdlN70zdvgSZFhKSw/cn66L+dfO9bqUwDVDN2S8RSE6RGbFz4oYxS950JHEOKPyD8svtlT8xLq9seeMcvwp+KcSZqMY=,iv:70PeKVRqKj/6/o46TAzICQZDi83m4qPTTR1K3S6JiOo=,tag:9rQR9e9ZGYMgbklV9lWdLA==,type:str]
     pgp:
         - created_at: "2023-10-04T14:02:47Z"
           enc: |-

machines/renge/services/prometheus.nix

@@ -76,6 +76,7 @@ in
         job_name = "qbittorrent";
         static_configs = mkStaticTargets [
           "fuuko.vpn.sbruder.de:9561"
+          "nazuna.vpn.sbruder.de:9561"
         ];
         relabel_configs = lib.singleton {
           target_label = "instance";

modules/media-proxy.nix

@@ -5,6 +5,7 @@ let
     "media" = config.sops.secrets.media-proxy-auth.path;
     "media-sb" = config.sops.secrets.media-proxy-auth.path;
     "torrent" = config.sops.secrets.torrent-proxy-auth.path;
+    "sturzbach" = config.sops.secrets.torrent-proxy-auth.path;
   };
 in
 {