nixos/qbittorrent: init #287923

fsnkty · 2024-02-11T03:14:38Z

Description of changes

create a module to use qbittorrent as a service.

blocking issues

sufficient test(s,ing)
serverConfig
- gendeepINI gets a fitting type to use for this option.
- qBittorrent.conf
  - more feedback / info on what does/does not cause qbit to "take in" new config.
  - understanding where the write permission on /var/lib/qBittorrent/qBittorrent/config/qBittorrent.conf comes from / why its possible
openFirewall

nice to haves

a better way to set CapabilityBoundingSet to restrict all.
an explanation for PrivateTmp being disabled upstream. ( Work on Systemd service unit qbittorrent/qBittorrent#6806 (comment) )
some way to generate the bizare password format used independently. (Thank you Fea)
- format conversion within the module (/on activation/ whatever else)

notes

for service hardening I don't believe any of the following can be used simply because of the services purpose.
IPAddressDeny PrivateNetwork or restriction of AF_NETLINK AF_INET or AF_INET6 address families.
ProtectSystem cant be used without entirely declarative config

in my previous attempt at this here i was advised to simply make use of the service from the package, I'm unsure how to do this.
I started with an aim to follow https://github.com/qbittorrent/qBittorrent/blob/master/dist/unix/systemd/qbittorrent-nox%40.service.in I don't understand why it sets PrivateTmp to false however and have otherwise changed it significantly with service hardening and nix(os) specifics.

testing so far has been taken from #279716
Likely to replace once I figure the testing framework myself.

Things done

Add a 👍 reaction to pull requests you find important.

fsnkty · 2024-02-11T03:21:55Z

for reference my systems config makes fairly "full" use of this module already.
https://github.com/nu-nu-ko/crystal/blob/main/mods/services/qbit.nix

the port and path options likely need to be set, they should be given a default because of this.
defaults should likely just follow upstream however it gets done.

nixos/modules/services/torrent/qbittorrent.nix

camilosampedro · 2024-02-17T05:08:00Z

@nu-nu-ko

I've added you to contributors here now that I've taken parts of your work in the tests and since you had added yourself to them in your branch I assume you're still keen to? let me know if not and ill remove of course.

If you are allowed, I'd like to be a contributor, thank you!

still unsure how to do assertions for options on other options so for now I've left it be

Do you mean during tests?

camilosampedro · 2024-02-18T00:31:25Z

I've seen this in deluge:

https://github.com/NixOS/nixpkgs/blob/nixos-23.11/nixos/modules/services/torrent/deluge.nix

When you use declarative = true, it tries to use the options that are required to be declarative, and if they are not set it errors:

The option `services.deluge.authFile' is used but not defined.

But it doesn't happen the other way, if authFile is declared and declarative = false

camilosampedro · 2024-02-18T04:23:05Z

Is it weird if there were two separate sets of options?

qbittorrent-nox
qbittorrent-nox-declarative?

camilosampedro · 2024-02-18T14:15:37Z

Also, related and unrelated. I was seeing that the web ui and other services were being unresponsive after a couple of hours.

I thought that the IO of qbittorrent was bringing the system down, but after 2 days of trying everything, it was my network device's firmware. 😅

I'll try to retest it this week.

nevivurn

Afaik, it is possible to pass in the webui and torrenting port via command line arguments, and I assume these arguments take precedence over other configuration options. This should let us implement openFirewall without forcing users to use the declarative config.

a better way to set CapabilityBoundingSet and SystemCallFilter to restrict all.

CapabilityBoundingSet is an allowlist, the strictest setting is just the empty string. Although, given that we 1) don't run qbittorrent as root, 2) set NoNewPrivileges, 3) don't set AmbientCapabilities, omitting it entirely is probably fine.

I personally think @system-service is a good enough default for SystemCallFilter.

I don't understand why it sets PrivateTmp to false

This comment in the upstream PR mentions adding torrents through the command line. Not sure if this is actually true.

ProtectSystem needs to be disabled if we aren't using declaritiveConfig

I don't think ProtectSystem should be enabled here. It will break users with per-category/torrent save paths, no matter what.

imo, we don't need lock down every option by default. Users that want to further harden their system can easily add these options in their own nixos configuration.

nevivurn

I don't see why we wouldn't set it regardless personally, leaving it empty seems to do nothing as according to systemd-analyze security qbittorrent on my system.

👍

I agree to some extent, id much rather every service does at least up to "breaks as little as possible"

I completely agree, we can enable everything that probably won't break users.

There are still a couple options left that I feel like are a tad bit too opinionated, namely

non-default torrenting port
umask 0066

nixos/modules/services/torrent/qbittorrent.nix

nevivurn · 2024-02-20T09:48:18Z

an empty list isn't equivalent sooo 😅

Ah, did not realize the empty list wasn't doing anything. "" should work.

there is no default? its randomly selected from within a range from what i can tell. the non default web port is questionable.. but I think defaulting to 8080 is kinda dumb, happy to change it.

The bittorrent port is chosen randomly by default, and it is quite unexpected for nixos to fix an arbitrary port number by default. Similar with the web port, I don't see a reason for the NixOS module to deviate from the upstream default. With this module, it would be trivial for users to change it as needed, anyway.

umask 0066

how is this opinionated? in what case may this break something?

I think this would break users trying to access downloaded files without needing to run as the qbittorrent user, likely a common use case. Plus, if we're going for paranoid settings, why is it not 0077?

Redhawk18 · 2024-08-27T17:11:05Z

@fsnkty Can you merge this? I already started my own pr since this has been open for 6 months with little to no activity.

I do not have permission to merge this. I'm also not willing to since it's unfinished, please see the Todo list in the description.

I'd encourage you to look into the issues with this PR before duplicating work on another but do as you wish afaict the scope of our two PR's isn't the same so please keep that in mind.

I won't be able to work on this for some time so would love to see someone else take it on, e.g.. rebase on something up to date n see how the Todo list holds up

Glad to see your active, for me I'm just trying to get the ground work for this pr finish. I choose not to look into settings because it seems like it just increases the complexity of this pr by 100 or 1000 fold. I'm trying to keep my pr simple so it can get merge and then everyone can argue over complex setting options in a new pr after the service is already merged. You should check out my pr aswell! 😄

alexandru0-dev · 2024-08-27T17:11:58Z

@fsnkty @Redhawk18 aren't both PR try to achieve the same thing no?
qbittorent-nox is just headless qbittorent.
It's named differently so you don't have to compile the GUI but apparently both PR are implementing the same service
Correct me if I'm mistaken

fsnkty · 2024-08-27T17:14:32Z

@fsnkty @Redhawk18 aren't both PR try to achieve the same thing no?
qbittorent-nox is just headless qbittorent.
It's named differently so you don't have to compile the GUI but apparently both PR are implementing the same service
Correct me if I'm mistaken

yes both PR's create a service for qbit, difference afaict is this PR uses nix for configuration, their PR leaves it up to the user to do so manually

alexandru0-dev · 2024-08-27T17:23:03Z

@fsnkty as I expected

@Redhawk18 why the rush?

Personally I use this module in my nix config and it works great, it may be a more complex PR and being not upstream it's probably not as plug and play as you would like but I don't see why the need for another PR but that's just my opinion

If you want to use nox with this module just override the pkg config to qbittorrent-nox which is also something that this PR by default should use if it's intended to use headless

@fsnkty if we want to contribute, can we submit patches in case here? Or should we make a PR to your branch?

fsnkty · 2024-08-27T17:29:29Z

@fsnkty as I expected

@Redhawk18 why the rush?

Personally I use this module in my nix config and it works great, it may be a more complex PR and being not upstream it's probably not as plug and play as you would like but I don't see why the need for another PR but that's just my opinion

If you want to use nox with this module just override the pkg config to qbittorrent-nox which is also something that this PR by default should use if it's intended to use headless

@fsnkty if we want to contribute, can we submit patches in case here? Or should we make a PR to your branch?

either is fine but please understand I don't have the time or ability to work on or test this for the time being (3weeks+ minimum)

I'd love to see someone take on guiding this PR in the meantime if they're able to do so faster than me ^^``

Redhawk18 · 2024-08-27T18:59:37Z

@fsnkty as I expected

@Redhawk18 why the rush?

Personally I use this module in my nix config and it works great, it may be a more complex PR and being not upstream it's probably not as plug and play as you would like but I don't see why the need for another PR but that's just my opinion

If you want to use nox with this module just override the pkg config to qbittorrent-nox which is also something that this PR by default should use if it's intended to use headless

@fsnkty if we want to contribute, can we submit patches in case here? Or should we make a PR to your branch?

I don't know if this would work with qbittorrent, this was just meant for the webui in this doc page here.
https://github.com/qbittorrent/qBittorrent/wiki/Running-qBittorrent-without-X-server-(WebUI-only,-systemd-service-set-up,-Ubuntu-15.04-or-newer)

Redhawk18 · 2024-08-27T19:02:31Z

I'd love to see someone take on guiding this PR in the meantime if they're able to do so faster than me ^^``

Thanks man, If you have time if you could approve or give suggestions on my pr. It feels like this pr may have bitten off more than it can chew. But I understand these things are very complex and everyone has to agree on what is done. We can open a pr in the future trying to implement settings.

alexandru0-dev · 2024-08-27T19:05:13Z

If you want to use nox with this module just override the pkg config to qbittorrent-nox which is also something that this PR by default should use if it's intended to use headless

ERRATA: this option already uses qbittorrent-nox as the default package

@Redhawk18

Redhawk18 · 2024-08-27T19:07:19Z

If you want to use nox with this module just override the pkg config to qbittorrent-nox which is also something that this PR by default should use if it's intended to use headless

ERRATA: this option already uses qbittorrent-nox as the default package

@Redhawk18

But this pr is incomplete, very complex with settings, and the author is not able to work on it.

poperigby · 2024-09-04T01:32:05Z

meta.mainProgram isn't being set correctly. I'm still getting this warning when building my system:

trace: evaluation warning: getExe: Package "qbittorrent-nox-4.6.5" does not have the meta.mainProgram attribute. We'll assume that the main program has the same name for now, but this behavior is deprecated, because it leads to surprising errors when the assumption does not hold. If the package has a main program, please set `meta.mainProgram` in its definition to make this warning go away. Otherwise, if the package does not have a main program, or if you don't control its definition, use getExe' to specify the name to the program, such as lib.getExe' foo "bar".

alexandru0-dev · 2024-09-04T06:43:45Z

@poperigby if I'm not mistaken it's the qbittorent package that has that warning, and it's not caused by the option itself and a discussion here wouldn't be relevant.
Can you create another issue if there isn't already one?

fsnkty · 2024-09-04T06:48:20Z

@poperigby if I'm not mistaken it's the qbittorent package that has that warning, and it's not caused by the option itself and a discussion here wouldn't be relevant.
Can you create another issue if there isn't already one?

this PR does try to change meta.mainprogram for qbit to work here, I'm assuming it's a small issue but can't look into it
no seperate issue needed, though if you want to improve that part of the package seperately that'd be fine

alexandru0-dev · 2024-09-04T07:00:36Z

this PR does try to change meta.mainprogram for qbit to work here, I'm assuming it's a small issue but can't look into it

After a second look you're completely right, I was checking the files on my phone and completely missed the changes to the package

fsnkty · 2024-09-20T08:49:59Z

still unsure on exactly when I'll be able to get back to working on this but at worst sometime in 2-3 months 💀
as always if anyone's able and willing to "take over" this work as it is now, be my guest.
otherwise anyone still currently using this module, now is the best time to explain your experience problematic or not, simply knowing what's already working is helpful etc.

fsnkty · 2024-09-26T03:31:59Z

meta.mainProgram isn't being set correctly. I'm still getting this warning when building my system:

trace: evaluation warning: getExe: Package "qbittorrent-nox-4.6.5" does not have the meta.mainProgram attribute. We'll assume that the main program has the same name for now, but this behavior is deprecated, because it leads to surprising errors when the assumption does not hold. If the package has a main program, please set `meta.mainProgram` in its definition to make this warning go away. Otherwise, if the package does not have a main program, or if you don't control its definition, use getExe' to specify the name to the program, such as lib.getExe' foo "bar".

unable to replicate please link to the code that encountered this.

@fsnkty wouldn't it be best to make torrentingPort default to null? Then people wouldn't have to set it if they didn't want to.

isn't not giving the option a default null already? it is nullOr port

fsnkty · 2024-09-26T03:34:53Z

testing this again on the unstable branch of nixpkgs I'm more confident this is functional and just missing some quality / reassurance things
the type and testing would be nice but both require a little more time in learning than I can afford to spare atm.

poperigby · 2024-09-27T18:45:21Z

unable to replicate please link to the code that encountered this.

This is my configuration which gives that warning: https://gist.github.com/poperigby/8e669dd14165320a81d714b673e84eae

isn't not giving the option a default null already? it is nullOr port

I don't think so, because not specifying torrentingPort makes it fail to evaluate saying that it's used but not defined, meaning there's no default value.

fsnkty · 2024-10-03T05:51:49Z

unable to replicate please link to the code that encountered this.

This is my configuration which gives that warning: https://gist.github.com/poperigby/8e669dd14165320a81d714b673e84eae

isn't not giving the option a default null already? it is nullOr port

I don't think so, because not specifying torrentingPort makes it fail to evaluate saying that it's used but not defined, meaning there's no default value.

Yeah you need to use the package from this PR. e.g.. setting config.services.qbittorrent.package = inputs.qbit.legacyPackages.${pkgs.system}.qbittorrent-nox

nevivurn · 2024-10-03T06:47:38Z

Even when we allow null with nullOr, we still need to set the default value as null otherwise users get the used but not defined. A value being null (by default or otherwise) is different from it never being set at all.

optional torretingPort firewall feathecutie's improved genDeepINI update desc for Password_PBKDF2 & misc openFirewall mkEnableOption remove `.` from mkEnableOption desc update maintainer name & reword openFirewall desc

fsnkty · 2024-10-08T01:00:43Z

No longer thousands of commits behind 👍
seems to work the exact same, love to see it.

fsnkty · 2024-10-08T01:07:05Z

@fsnkty wouldn't it be best to make torrentingPort default to null? Then people wouldn't have to set it if they didn't want to.

ok that commit is named poorly, should be "default null torrentingPort" but whatever itll get squashed xP
but yeah good catch, should be alright to not specify a torrenting port now 👍

fsnkty · 2024-10-08T01:55:53Z

edit: misread comment timeline but these questions still nice to know

anyone aware of qbit writing global section config values?
also anyone aware of config value depth greater than 5?

silly copy n paste mistake return stickybit

fsnkty · 2024-10-08T03:48:00Z

alright for now I have no clue why qbit is seemingly able to enable write permissions on that file.
if you want to reapply from config you can

stop the qbit service
remove the file /var/lib/qBittorrent/qBittorrent/config/qBittorrent.conf
apply new system config

its hacky but for now thats whatever.
fyi custom webuis work, e.g..

serverConfig = { 
  Preferences = {
    WebUI = {
      AlternativeUIEnabled = true;
      RootFolder = "${pkgs.fetchzip {
        url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.7.2/vuetorrent.zip";
        hash = "sha256-bJyI7RvVCf0M5vs8Qi+uAHv74CWxSDZ0Bb6zWJ4x4CM=";
      }}";
    };
  };
};

github-actions bot added 6.topic: nixos 8.has: module (update) labels Feb 11, 2024

fsnkty mentioned this pull request Feb 11, 2024

Create qbittorrent-nox service #279716

Closed

13 tasks

fsnkty force-pushed the init-nixos-qbittorrent branch from d4984ad to dc84cc2 Compare February 11, 2024 03:42

ofborg bot added 10.rebuild-darwin: 0 10.rebuild-linux: 1-10 labels Feb 11, 2024

fsnkty force-pushed the init-nixos-qbittorrent branch from dc84cc2 to 35bc83d Compare February 17, 2024 01:19

camilosampedro reviewed Feb 17, 2024

View reviewed changes

nixos/modules/services/torrent/qbittorrent.nix Outdated Show resolved Hide resolved

github-actions bot added 8.has: documentation 8.has: changelog labels Feb 17, 2024

This comment was marked as outdated.

Sign in to view

nevivurn reviewed Feb 19, 2024

View reviewed changes

fsnkty force-pushed the init-nixos-qbittorrent branch from d60b403 to bc0a267 Compare February 20, 2024 04:26

This comment was marked as outdated.

Sign in to view

nevivurn reviewed Feb 20, 2024

View reviewed changes

nixos/modules/services/torrent/qbittorrent.nix Outdated Show resolved Hide resolved

This comment was marked as outdated.

Sign in to view

fsnkty force-pushed the init-nixos-qbittorrent branch from e3913e0 to c289233 Compare February 24, 2024 12:16

wegank added the 2.status: merge conflict label Mar 20, 2024

fsnkty force-pushed the init-nixos-qbittorrent branch from c289233 to 07d92b9 Compare March 27, 2024 23:34

github-actions bot removed 8.has: documentation 8.has: changelog labels Mar 27, 2024

fsnkty force-pushed the init-nixos-qbittorrent branch from 07d92b9 to aa2f5a4 Compare March 27, 2024 23:38

fsnkty added 2 commits October 8, 2024 13:54

qbittorrent: add meta.mainProgram

4ae9aa4

nixos/qbittorrent: init service module

eb14b05

optional torretingPort firewall feathecutie's improved genDeepINI update desc for Password_PBKDF2 & misc openFirewall mkEnableOption remove `.` from mkEnableOption desc update maintainer name & reword openFirewall desc

fsnkty force-pushed the init-nixos-qbittorrent branch from ddcebe9 to eb14b05 Compare October 8, 2024 00:56

nixos/qbittorrent: allow null torrentingPort

3a440c2

fsnkty force-pushed the init-nixos-qbittorrent branch from 4a44075 to 06914f9 Compare October 8, 2024 03:33

only set config if not null and remove write perm

ed44619

silly copy n paste mistake return stickybit

fsnkty force-pushed the init-nixos-qbittorrent branch from 06914f9 to ed44619 Compare October 8, 2024 03:42

nixos/qbittorrent: init #287923

Are you sure you want to change the base?

nixos/qbittorrent: init #287923

Conversation

fsnkty commented Feb 11, 2024 • edited Loading

Description of changes

blocking issues

nice to haves

notes

Things done

fsnkty commented Feb 11, 2024 • edited Loading

This comment was marked as outdated.

camilosampedro commented Feb 17, 2024

This comment was marked as outdated.

camilosampedro commented Feb 18, 2024 • edited Loading

This comment was marked as outdated.

camilosampedro commented Feb 18, 2024

camilosampedro commented Feb 18, 2024

nevivurn left a comment

Choose a reason for hiding this comment

This comment was marked as outdated.

nevivurn left a comment

Choose a reason for hiding this comment

This comment was marked as outdated.

nevivurn commented Feb 20, 2024

Redhawk18 commented Aug 27, 2024

alexandru0-dev commented Aug 27, 2024

fsnkty commented Aug 27, 2024

alexandru0-dev commented Aug 27, 2024

fsnkty commented Aug 27, 2024

Redhawk18 commented Aug 27, 2024

Redhawk18 commented Aug 27, 2024

alexandru0-dev commented Aug 27, 2024

Redhawk18 commented Aug 27, 2024

poperigby commented Sep 4, 2024

alexandru0-dev commented Sep 4, 2024

fsnkty commented Sep 4, 2024

alexandru0-dev commented Sep 4, 2024 • edited Loading

fsnkty commented Sep 20, 2024

fsnkty commented Sep 26, 2024

fsnkty commented Sep 26, 2024

poperigby commented Sep 27, 2024

fsnkty commented Oct 3, 2024

nevivurn commented Oct 3, 2024

fsnkty commented Oct 8, 2024

fsnkty commented Oct 8, 2024

fsnkty commented Oct 8, 2024 • edited Loading

fsnkty commented Oct 8, 2024 • edited Loading

fsnkty commented Feb 11, 2024 •

edited

Loading

fsnkty commented Feb 11, 2024 •

edited

Loading

camilosampedro commented Feb 18, 2024 •

edited

Loading

alexandru0-dev commented Sep 4, 2024 •

edited

Loading

fsnkty commented Oct 8, 2024 •

edited

Loading

fsnkty commented Oct 8, 2024 •

edited

Loading