qBittorrent-nox Service Setup

Posted on In Views: Word count in article: 370 Reading time ≈ 1 mins.
Notes on qBittorrent-nox Service Setup, covering linux, vps, qbittorrent, pt, systemd.

qBittorrent-nox Service Setup

This note records a qbittorrent-nox setup for a VPS.

Example values:

  • service user: qbittorrent
  • config home: /var/lib/qbittorrent
  • download directory: /data/downloads
  • Web UI port: 18080
  • BT listen port: 45000

Caddy reverse proxy is covered in the separate Caddy note. This article only covers qBittorrent itself.

Install

1
sudo apt install qbittorrent-nox

On Arch Linux:

1
sudo pacman -S qbittorrent-nox

Do Not Run It As Root

Running a network-facing P2P daemon as root is asking for pain. If qBittorrent ever has an RCE or a bad plugin/script interaction, root turns that bug into full machine compromise.

Create a dedicated user:

1
2
3
sudo useradd -r -m -d /var/lib/qbittorrent -s /usr/sbin/nologin qbittorrent
sudo mkdir -p /data/downloads
sudo chown -R qbittorrent:qbittorrent /data/downloads

systemd Unit

Create /etc/systemd/system/qbittorrent-nox.service:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
[Unit]
Description=qBittorrent-nox service
Documentation=man:qbittorrent-nox(1)
Wants=network-online.target
After=network-online.target nss-lookup.target

[Service]
Type=simple
User=qbittorrent
Group=qbittorrent
ExecStart=/usr/bin/qbittorrent-nox --profile=/var/lib/qbittorrent --webui-port=18080
TimeoutStopSec=1800
Restart=on-failure

ProtectSystem=full
ProtectHome=true
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target

Enable it:

1
2
3
sudo systemctl daemon-reload
sudo systemctl enable --now qbittorrent-nox
sudo systemctl status qbittorrent-nox

Web UI Binding

Stop the service before editing the config, otherwise qBittorrent may overwrite your changes:

1
2
sudo systemctl stop qbittorrent-nox
sudo find /var/lib/qbittorrent -name "qBittorrent.conf"

Edit the config file, usually under:

1
/var/lib/qbittorrent/qBittorrent/config/qBittorrent.conf

Force the Web UI to localhost:

1
2
3
4
[Preferences]
WebUI\Address=127.0.0.1
WebUI\Port=18080
WebUI\HostHeaderValidation=true

Keep Host header validation enabled. If the reverse proxy preserves a public Host header, add only your actual UI hostname to the allowed server domains in your installed version’s Web UI settings (the config key is commonly WebUI\ServerDomains). Check the version’s UI/documentation rather than disabling validation or using a wildcard. Localhost binding alone is not a replacement for Host checks.

Start it again:

1
sudo systemctl start qbittorrent-nox

On recent qBittorrent versions, the initial random password may appear in logs:

1
journalctl -u qbittorrent-nox -e | grep -i password

Change it immediately after logging in.