server.nix/services/qbittorrent.nix

{ config, inputs, ... }: {
  imports = [
    inputs.common-modules.nixosModules.qbittorrent-nox
  ];

  services = {
    qbittorrent-nox = {
      enable = true;
      openFirewall = true;
      webuiPort = 4010;
      torrentingPort = 43125;
      extraArgs = [
        "--confirm-legal-notice"
      ];
    };

    caddy.virtualHosts."http://qbittorrent.internal".extraConfig = ''
      @local remote_ip private_ranges 100.64.0.0/10
      reverse_proxy @local :${toString config.services.qbittorrent-nox.webuiPort}
    '';

    borgbackup.jobs."borgbase".paths = [
      config.services.qbittorrent-nox.profileDir
    ];
  };
}