fix a load of stuff

.just/machine.just

@@ -11,4 +11,10 @@
     cd .. && just vars _check {{ machine }}
     echo ""
     just assert '-d "../systems/x86_64-linux/{{ machine }}"' "Machine {{ machine }} does not exist, must be one of: $(ls ../systems/x86_64-linux/ | sed ':a;N;$!ba;s/\n/, /g')"
-    nixos-rebuild switch -L --sudo --target-host {{ machine }} --build-host {{ machine }} --flake ..#{{ machine }} --log-format internal-json -v |& nom --json
+    nixos-rebuild switch -L --sudo --target-host {{ machine }} --flake ..#{{ machine }} --log-format internal-json -v |& nom --json
+
+[doc('Check if target machine builds')]
+[no-exit-message]
+@check machine:
+    just assert '-d "../systems/x86_64-linux/{{ machine }}"' "Machine {{ machine }} does not exist, must be one of: $(ls ../systems/x86_64-linux/ | sed ':a;N;$!ba;s/\n/, /g')"
+    nix build ..#nixosConfigurations.{{ machine }}.config.system.build.toplevel

modules/nixos/services/media/servarr/default.nix

@@ -80,18 +80,7 @@ in {
             enable = true;
             openFirewall = true;
             webuiPort = 2008;
-
+            serverConfig = lib.mkForce {};
-            serverConfig = {
-              LegalNotice.Accepted = true;
-
-              Prefecences.WebUI = {
-                AlternativeUIEnabled = true;
-                RootFolder = "''${pkgs.vuetorrent}/share/vuetorrent";
-
-                Username = "admin";
-                Password_PBKDF2 = "@ByteArray(Yhyk8fzgSHuKcgcmIxhYzg==:9njltqI5znb98+n+eOqUvpe4xYj6Dcub994o2fe9kpTa1fczMdHf/fNoifLaGmEf69xkTNSztEuh6BqcR4/CbQ==)"; #config.sops.secrets."qbittorrent/password_hash".path;
-              };
-            };
 
             user = "qbittorrent";
             group = "media";
@@ -246,7 +235,7 @@ in {
                           host = "localhost";
                           api_key = lib.tfRef "var.sabnzbd_api_key";
                           url_base = "/";
-                          port = 8080;
+                          port = 2009;
                         };
                       };
                     }
@@ -425,7 +414,7 @@ in {
             # Sleep for a bit to give the service a chance to start up
             sleep 5s
 
-            if [ "$(systemctl is-active ${service})" != "active" ]; then
+            if [ "$(systemctl is-active "${service}")" != "active" ]; then
               echo "${service} is not running"
               exit 1
             fi
@@ -464,6 +453,18 @@ in {
       }))
       |> lib.mkMerge;
 
+    system.activationScripts.qbittorrent-config = {
+      deps = lib.optional (!config.sops.useSystemdActivation) "setupSecrets";
+      # TODO: If sops-nix is switched to systemd activation, add a systemd unit
+      # for this install step that runs after sops-install-secrets.service,
+      # because this activation-script dependency only orders against setupSecrets.
+      text = ''
+        install -Dm0600 -o ${config.services.qbittorrent.user} -g ${config.services.qbittorrent.group} \
+          ${config.sops.templates."qbittorrent/qBittorrent.conf".path} \
+          ${config.services.qbittorrent.profileDir}/qBittorrent/config/qBittorrent.conf
+      '';
+    };
+
     users =
       cfg
       |> lib.mapAttrsToList (service: {enable, ...}: (mkIf enable {
@@ -532,6 +533,22 @@ in {
                 sabnzbd_api_key = "${config.sops.placeholder."sabnzbd/apikey"}"
               '';
             };
+            "qbittorrent/qBittorrent.conf" = {
+              owner = "qbittorrent";
+              group = "media";
+              mode = "0600";
+              restartUnits = ["qbittorrent.service"];
+              content = ''
+                [LegalNotice]
+                Accepted=true
+
+                [Preferences]
+                WebUI\AlternativeUIEnabled=true
+                WebUI\RootFolder=${pkgs.vuetorrent}/share/vuetorrent
+                WebUI\Username=admin
+                WebUI\Password_PBKDF2=${config.sops.placeholder."qbittorrent/password_hash"}
+              '';
+            };
             "sabnzbd/config.ini" = {
               owner = "sabnzbd";
               group = "media";