# Quadlet unit: qBittorrent in FrankBook-Pro's podman machine.
#
# Install path is INSIDE the machine VM:
#   /home/core/.config/containers/systemd/qbittorrent.container
#
# Joins gluetun's network namespace (Network=gluetun.container) so all
# BitTorrent egress exits the WireGuard tunnel. It publishes NO port of its
# own — WebUI 8080 and torrent port 6881 publish on the gluetun unit.
#
# Data layout (plan-locked, verbatim paths):
#   /config  <- /Volumes/COMPLETE/qbittorrent-data   (durable config)
#   /Volumes/COMPLETE + /Volumes/INCOMPLETE same-path virtiofs passthroughs —
#   the seeded qBittorrent.conf references those literal paths:
#     Session\DefaultSavePath=/Volumes/COMPLETE
#     Session\TempPath=/Volumes/INCOMPLETE/incomplete  (in-progress disk)
#   category "Finished Torrents" -> /Volumes/COMPLETE/Finished Torrents
#   (the human review dir; nothing automated ever writes to entropy).
#
# WebUI password: generated fresh at provisioning by the deploy handler,
# stored machine-local only (conf + /home/core/Containers/qbittorrent/env).
[Unit]
Description=qBittorrent behind gluetun (FrankBook-Pro)
Wants=gluetun.service
After=gluetun.service

[Container]
ContainerName=qbittorrent
Network=gluetun.container
Image=lscr.io/linuxserver/qbittorrent:latest
Environment=PUID=0
Environment=PGID=0
Environment=TZ=America/Los_Angeles
Environment=UMASK_SET=022
Volume=/Volumes/COMPLETE/qbittorrent-data:/config
Volume=/Volumes/COMPLETE:/Volumes/COMPLETE
Volume=/Volumes/INCOMPLETE:/Volumes/INCOMPLETE

[Service]
TimeoutStartSec=900
Restart=always

[Install]
WantedBy=default.target