From e2cbadf78d857864b2bd2480980324a02093bb47 Mon Sep 17 00:00:00 2001
From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com>
Date: Fri, 27 Feb 2026 13:39:26 -0600
Subject: killswitch exception for webui

---
 hosts/ganymede/nixos.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix
index c6d7bd1..373b0d2 100644
--- a/hosts/ganymede/nixos.nix
+++ b/hosts/ganymede/nixos.nix
@@ -62,11 +62,14 @@
   networking.firewall.extraCommands =
     # bash
     ''
-      # Allow qbittorrent traffic over wg0
+      # Allow qbittorrent to talk to itself (WebUI on 127.0.0.1)
+      iptables -A OUTPUT -o lo -m owner --uid-owner qbittorrent -j ACCEPT
+
+      # Allow all qbittorrent traffic over WireGuard
       iptables -A OUTPUT -o wg0 -m owner --uid-owner qbittorrent -j ACCEPT
 
-      # Drop qbittorrent traffic over anything else
-      iptables -A OUTPUT ! -o wg0 -m owner --uid-owner qbittorrent -j REJECT
+      # Block everything else from qbittorrent user (kill switch)
+      iptables -A OUTPUT -m owner --uid-owner qbittorrent -j REJECT
     '';
 
   services.fail2ban.enable = true;
-- 
cgit v1.3.1