diff --git a/machines/fuuko/services/prometheus.nix b/machines/fuuko/services/prometheus.nix
index 891632e..e8c025f 100644
--- a/machines/fuuko/services/prometheus.nix
+++ b/machines/fuuko/services/prometheus.nix
@@ -71,10 +71,14 @@ in
       }
       {
         job_name = "qbittorrent";
-        static_configs = mkStaticTarget "127.0.0.1:9561";
+        static_configs = mkStaticTargets [
+          "fuuko.vpn.sbruder.de:9561"
+          "okarin.vpn.sbruder.de:9561"
+        ];
         relabel_configs = lib.singleton {
           target_label = "instance";
-          replacement = "torrent.sbruder.de";
+          source_labels = lib.singleton "__address__";
+          regex = "(.*)\\.vpn\\.sbruder\\.de:9561";
         };
       }
       {
diff --git a/machines/okarin/configuration.nix b/machines/okarin/configuration.nix
index 3029d73..ba9c178 100644
--- a/machines/okarin/configuration.nix
+++ b/machines/okarin/configuration.nix
@@ -13,11 +13,17 @@
     ./services/mumble.nix
     ./services/nitter.nix
     ./services/sbruder.xyz
+    ./services/torrent.nix
   ];
 
   sbruder = {
     nginx.hardening.enable = true;
-    restic.system.enable = true;
+    restic.system = {
+      enable = true;
+      extraExcludes = [
+        "/var/lib/qbittorrent/download"
+      ];
+    };
     wireguard.home.enable = true;
   };
 
diff --git a/machines/okarin/secrets.yaml b/machines/okarin/secrets.yaml
index a4692e1..e7567b7 100644
--- a/machines/okarin/secrets.yaml
+++ b/machines/okarin/secrets.yaml
@@ -1,15 +1,16 @@
-wg-home-private-key: ENC[AES256_GCM,data:UMNY28f8D4VN86s8RqhBbfCgBzLWOmAu1Id7RyIfp1Ta/BvgtfOz70Y3hvs=,iv:ph2O/wBwwThHnNQ5sHIc9ZOC6EXHM3fv4z3esTpJuj0=,tag:pROjuUte4+OZxPlhppceWA==,type:str]
 gitea-mail: ENC[AES256_GCM,data:7pW7M9SVkdhGD1I/WQW2K/C/HQHBWGP+S0cXlo5rTaQ=,iv:fj3ercPsBhTZnGZFPVxd2wQ2wNmA3IYNz7xnf3P1Tjc=,tag:BJxcUoa+ZezGLKfHmXJJVg==,type:str]
 invidious-extra-settings: ENC[AES256_GCM,data:PVdEqmWBvz72Knq0K/oZMfC4f4ygib7QJ4tMua4CeeSFchQirD3bhHKEPxfzJ5KxIZwH3otLjB8wAFJ+fDCQsrf5owJwP+4gxPFjlpk3nFiB,iv:Q0Lmr9ZO5ijIZ4sDNo5YollD6DaHN56RyV8MJgNctHI=,tag:5W3euSI7OPJ0BYvrEZjH+g==,type:str]
 murmur-superuser: ENC[AES256_GCM,data:yPiP2Vh6Zf9OSy0hlP0DsNykbhR2VvCLzA==,iv:+GEChmJtE2bnQ35uke4QXRDO3vY3MVPz2rWDwN6EUYI=,tag:paqTIe97dF83ExwAoQnSlQ==,type:str]
+wg-home-private-key: ENC[AES256_GCM,data:UMNY28f8D4VN86s8RqhBbfCgBzLWOmAu1Id7RyIfp1Ta/BvgtfOz70Y3hvs=,iv:ph2O/wBwwThHnNQ5sHIc9ZOC6EXHM3fv4z3esTpJuj0=,tag:pROjuUte4+OZxPlhppceWA==,type:str]
+wg-qbittorrent-private-key: ENC[AES256_GCM,data:PIoaHruI5+jnhXx7qaB16Xc7XV9xow2lhQy2/ILVhjwt5G2CN3CpfYQKep4=,iv:ZIoKe0FEwaJD850EUcnqQqC5Jg9FtqNin+1wdN6iQq8=,tag:0YveFfJlhgU0Z3kxrSMSQw==,type:str]
 sops:
     kms: []
     gcp_kms: []
     azure_kv: []
     hc_vault: []
     age: []
-    lastmodified: "2022-03-18T15:51:55Z"
-    mac: ENC[AES256_GCM,data:hRzUVAjVSz0bbdvSU4QxMwAL57Wi9qBZLOnIeSOO7laVSC0JM0XlBau6t9hnLJRG4G8GPG32hAJ2E3lAFev6JLhEfVT7YurU8jVG5pazTUfWsKDn/Oo5sxsQG8oNAkzAYpkd7VqBl/l25g4JPeDtOpTO5FdktKfXqG886DKJER8=,iv:H1i3pwyTGMAH7xy6uIA2Cz/V9ZtHxqoBiAidLiQ8zNc=,tag:RzqzKNUQGhZv7Rzkc30ebg==,type:str]
+    lastmodified: "2022-03-18T20:26:13Z"
+    mac: ENC[AES256_GCM,data:QZeMxc5+TiIVWO3knYrjFbOHyP9QwtjLvjUAhtJf7J9mcFY04EB2AYTrObd2IzZEekAxuQ0JoPPUpbBqDlccTMgCGgSDrmfAqbWnO0wS8RRkNw7odSFj54wSBitdlH8BXUXakNedrlcpvl4x9P7WI9VrOCehs8DWvPoTYJTLU9I=,iv:lNOYNsc+tWbT7KQF/yw4LMqWsYYJtd/zGGqr3WJSXuk=,tag:O30+et2EQ0AWihKu8wuAnw==,type:str]
     pgp:
         - created_at: "2022-03-03T09:13:41Z"
           enc: |
diff --git a/machines/okarin/secrets/wireguard-qbittorrent.nix b/machines/okarin/secrets/wireguard-qbittorrent.nix
new file mode 100644
index 0000000..423892c
Binary files /dev/null and b/machines/okarin/secrets/wireguard-qbittorrent.nix differ
diff --git a/machines/okarin/services/torrent.nix b/machines/okarin/services/torrent.nix
new file mode 100644
index 0000000..6d34db8
--- /dev/null
+++ b/machines/okarin/services/torrent.nix
@@ -0,0 +1,6 @@
+{
+  sbruder.qbittorrent = {
+    enable = true;
+    fqdn = "torrent.okarin.sbruder.de";
+  };
+}
diff --git a/modules/media-proxy.nix b/modules/media-proxy.nix
index a2897e3..95c4af0 100644
--- a/modules/media-proxy.nix
+++ b/modules/media-proxy.nix
@@ -4,6 +4,7 @@ let
   services = {
     "media" = config.sops.secrets.media-proxy-auth.path;
     "torrent" = config.sops.secrets.torrent-proxy-auth.path;
+    "torrent.okarin" = config.sops.secrets.torrent-proxy-auth.path;
   };
 in
 {
diff --git a/users/simon/modules/qutebrowser/userscripts/better-nginx-index.user.js b/users/simon/modules/qutebrowser/userscripts/better-nginx-index.user.js
index 5b0866c..d4587e2 100644
--- a/users/simon/modules/qutebrowser/userscripts/better-nginx-index.user.js
+++ b/users/simon/modules/qutebrowser/userscripts/better-nginx-index.user.js
@@ -1,6 +1,6 @@
 // ==UserScript==
 // @name     nginx: Better directory index
-// @include  http://localhost:8888/torrent/download/*
+// @include  http://localhost:8888/torrent*/download/*
 // @include  https://ci.sbruder.de/nix-store/*
 // ==/UserScript==