qBittorrent-nox Service Setup

posted
read
190 words · 1 min
tags
#linux#vps#qbittorrent#pt#systemd
contents

This note records a qbittorrent-nox setup for a VPS.

Example values:

  • service user: qbittorrent
  • config home: /var/lib/qbittorrent
  • download directory: /data/downloads
  • Web UI port: 18080
  • BT listen port: 45000

Caddy reverse proxy is covered in the separate Caddy note. This article only covers qBittorrent itself.

Install

Terminal window
sudo apt install qbittorrent-nox

On Arch Linux:

Terminal window
sudo pacman -S qbittorrent-nox

Do Not Run It As Root

Running a network-facing P2P daemon as root is asking for pain. If qBittorrent ever has an RCE or a bad plugin/script interaction, root turns that bug into full machine compromise.

Create a dedicated user:

Terminal window
sudo useradd -r -m -d /var/lib/qbittorrent -s /usr/sbin/nologin qbittorrent
sudo mkdir -p /data/downloads
sudo chown -R qbittorrent:qbittorrent /data/downloads

systemd Unit

Create /etc/systemd/system/qbittorrent-nox.service:

[Unit]
Description=qBittorrent-nox service
Documentation=man:qbittorrent-nox(1)
Wants=network-online.target
After=network-online.target nss-lookup.target


[Service]
Type=simple
User=qbittorrent
Group=qbittorrent
ExecStart=/usr/bin/qbittorrent-nox --profile=/var/lib/qbittorrent --webui-port=18080
TimeoutStopSec=1800
Restart=on-failure


ProtectSystem=full
ProtectHome=true
NoNewPrivileges=true


[Install]
WantedBy=multi-user.target

Enable it:

Terminal window
sudo systemctl daemon-reload
sudo systemctl enable --now qbittorrent-nox
sudo systemctl status qbittorrent-nox

Web UI Binding

Stop the service before editing the config, otherwise qBittorrent may overwrite your changes:

Terminal window
sudo systemctl stop qbittorrent-nox
sudo find /var/lib/qbittorrent -name "qBittorrent.conf"

Edit the config file, usually under:

/var/lib/qbittorrent/qBittorrent/config/qBittorrent.conf

Force the Web UI to localhost:

[Preferences]
WebUI\Address=127.0.0.1
WebUI\Port=18080
WebUI\HostHeaderValidation=true

Keep Host header validation enabled. If the reverse proxy preserves a public Host header, add only your actual UI hostname to the allowed server domains in your installed version’s Web UI settings (the config key is commonly WebUI\ServerDomains). Check the version’s UI/documentation rather than disabling validation or using a wildcard. Localhost binding alone is not a replacement for Host checks.

Start it again:

Terminal window
sudo systemctl start qbittorrent-nox

On recent qBittorrent versions, the initial random password may appear in logs:

Terminal window
journalctl -u qbittorrent-nox -e | grep -i password

Change it immediately after logging in.