docs: add qBittorrent documented section, merge Authentik fixes

infrastructure.org

@@ -1298,6 +1298,48 @@ services:
       timeout: 10s
       retries: 3
 #+END_SRC
+** qBittorrent — Torrent Client
+
+qBittorrent downloads via BitTorrent, routed through Gluetun VPN. Web UI
+at port 8200. Theme.park styling via DOCKER_MODS. Uses Gluetun's network
+namespace so other *arr services reach it at =gluetun:8200=.
+
+#+BEGIN_SRC yaml :tangle /docker/compose/services/qbittorrent.yaml
+services:
+  qbittorrent:
+    image: lscr.io/linuxserver/qbittorrent:latest
+    container_name: qbittorrent
+    restart: unless-stopped
+    depends_on:
+      gluetun:
+        condition: service_healthy
+        restart: true
+    healthcheck:
+      test: ["CMD", "sh", "-c", "cat /proc/net/route | grep -q tun0 || exit 1"]
+      interval: 30s
+      retries: 2
+      start_period: 10s
+    volumes:
+      - ${FOLDER_FOR_MEDIA:?err}:/library
+      - ${FOLDER_FOR_DATA:?err}/qbittorrent:/config
+    environment:
+      - PUID=${PUID:?err}
+      - PGID=${PGID:?err}
+      - UMASK=${UMASK:?err}
+      - TZ=${TIMEZONE:?err}
+      - WEBUI_PORT=${WEBUI_PORT_QBITTORRENT:?err}
+      - QBT_PROFILE=/config
+      - DOCKER_MODS=ghcr.io/themepark-dev/theme.park:qbittorrent
+      - TP_THEME=${TP_THEME:?err}
+    network_mode: service:gluetun
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.qbittorrent.service=qbittorrent
+      - traefik.http.routers.qbittorrent.rule=Host(`qbittorrent.${CLOUDFLARE_DNS_ZONE:?err}`)
+      - traefik.http.routers.qbittorrent.middlewares=authentik-forwardauth@file,security-headers@file
+      - traefik.http.services.qbittorrent.loadbalancer.server.scheme=http
+      - traefik.http.services.qbittorrent.loadbalancer.server.port=${WEBUI_PORT_QBITTORRENT:?err}
+#+END_SRC
 
 ** Remaining Services
 
@@ -1322,7 +1364,7 @@ definition, environment, volumes, and Traefik labels.
 - =jellyfin.yaml, jellyseerr.yaml= — Media server + request manager
 - =lazylibrarian.yaml, lidarr.yaml, mylar.yaml= — Ebook, music, comic managers
 - =prowlarr.yaml, radarr.yaml, sonarr.yaml, whisparr.yaml= — *arr indexer + library managers
-- =qbittorrent.yaml, sabnzbd.yaml= — Torrent and usenet clients
+- =sabnzbd.yaml= — Usenet client
 - =stash.yaml= — Adult content library manager
 - =tdarr.yaml, tdarr-node.yaml= — Media transcoding automation
 - =tubearchivist.yaml= — YouTube archiving (Tube Archivist)