How to Install qBittorrent (Web UI) on Ubuntu 24.04

A well-tuned qBittorrent server is the heart of any self-hosted media stack. It downloads legally distributed content -- Linux ISOs, public-domain films, academic datasets, Creative Commons music -- at line speed, seeds back to the community, and hands finished files off to Sonarr, Radarr, Jellyfin, and the rest of the Arr ecosystem. This guide walks through a production-grade install of qbittorrent-nox on Ubuntu 24.04, including a dedicated system user, a hardened systemd service, an Nginx reverse proxy with Let's Encrypt TLS, the VueTorrent alternative UI, and two approaches to binding traffic through a WireGuard VPN.

Looking for an affordable seedbox VPS? The CloudCore Starter plan at EUR 7.99/month gives you enough CPU, RAM, and bandwidth to run qBittorrent alongside the Arr stack. Deploy in 60 seconds and start seeding Linux ISOs the same afternoon.

Table of Contents

Why Self-Host a Torrent Client?

BitTorrent is one of the most efficient file distribution protocols ever invented, and a significant volume of legitimate content travels over it every day. A self-hosted torrent client on a VPS -- sometimes called a seedbox -- is useful for many fully legal workflows:

• Linux distributions. Every major distro -- Ubuntu, Debian, Fedora, Arch, NixOS, Tails, Proxmox VE -- publishes official ISOs as torrents. Downloading via BitTorrent reduces load on mirrors and lets you seed back to the community.
• Public-domain media. The Internet Archive and LibriVox distribute public-domain films, audiobooks, and recordings through BitTorrent.
• Creative Commons content. Artists, podcasters, and filmmakers use torrents to distribute CC-licensed work without hotlinking costs.
• Academic datasets. Large scientific datasets (genomics, machine learning, astronomy) are frequently mirrored via torrent for bandwidth efficiency. Academic Torrents hosts terabytes of openly licensed data.
• Your own backups. Create a private torrent of your photo library and seed it from your seedbox to your home NAS as a bandwidth-efficient sync mechanism.
• Software archival. Projects like the Internet Archive's Software Library release abandonware and historically significant software through BitTorrent.

Legal reminder. qBittorrent is legal everywhere. The content you move through it is what matters. This guide assumes you are downloading and seeding legal content. When in doubt, stick to Linux ISOs and Creative Commons material and always honour your VPS provider's acceptable use policy.

Prerequisites

Before you begin, make sure you have:

• A VPS running Ubuntu 24.04 LTS with sudo access
• SSH access to your server
• At least 2 GB of RAM (qBittorrent is light, but Nginx, Fail2ban, and the Arr stack add up)
• At least 40 GB of storage for the OS plus downloads, more if you plan to seed long-term
• A domain name pointed at your server's IP (required for Let's Encrypt TLS)

Recommended plan: CloudCore Starter (EUR 7.99/month)

The CloudCore Starter plan gives you 4 vCPU, 6 GB RAM, 100 GB NVMe, and unmetered bandwidth at EUR 7.99/month. That is plenty for qBittorrent plus the entire Arr stack on a single box. Scale up to a larger plan once your library outgrows 100 GB.

Connect to your server via SSH:

ssh root@your-server-ip

Step 1: Update the System

Start with a fully patched system. This avoids dependency resolution quirks and keeps you clear of known kernel vulnerabilities.

sudo apt update && sudo apt upgrade -y

If the kernel was updated, reboot:

sudo reboot

Reconnect via SSH after a minute.

Step 2: Install qbittorrent-nox

Ubuntu 24.04 ships qBittorrent 4.6 in the universe repository. The -nox suffix means "no X" -- a headless build without the Qt GUI, which is exactly what you want on a server.

sudo apt install -y qbittorrent-nox

Confirm the version:

qbittorrent-nox --version

Expected output:

qBittorrent 4.6.4

If you need the very latest qBittorrent release, add the upstream PPA instead of the distro package:

sudo add-apt-repository ppa:qbittorrent-team/qbittorrent-stable
sudo apt update
sudo apt install -y qbittorrent-nox

For most users the distro package is fine and receives security fixes via Ubuntu's normal update stream.

Step 3: Create a Dedicated qbittorrent User

Do not run qBittorrent as root or as your personal user. A dedicated system account limits blast radius if the Web UI is ever exploited and makes file permissions on the Downloads folder straightforward.

Create the user and a home directory for state:

sudo adduser --system --group --home /var/lib/qbittorrent qbittorrent

Flags explained:

• --system -- creates a UID below 1000 with no login shell (no interactive login possible)
• --group -- creates a matching qbittorrent group
• --home /var/lib/qbittorrent -- standard FHS location for service state

sudo -u qbittorrent mkdir -p /var/lib/qbittorrent/.config/qBittorrent
sudo -u qbittorrent mkdir -p /var/lib/qbittorrent/Downloads
sudo -u qbittorrent mkdir -p /var/lib/qbittorrent/Downloads/incomplete

The sudo -u qbittorrent prefix makes sure every directory is owned by the service account from the start. No chown -R cleanup later.

Step 4: Create the systemd Service

Create a systemd unit so qBittorrent starts on boot and restarts after crashes.

sudo tee /etc/systemd/system/qbittorrent-nox.service > /dev/null <<'EOF'
[Unit]
Description=qBittorrent-nox service
Documentation=https://github.com/qbittorrent/qBittorrent/wiki
Wants=network-online.target
After=network-online.target nss-lookup.target
[Service]
Type=exec
User=qbittorrent
Group=qbittorrent
UMask=007
ExecStart=/usr/bin/qbittorrent-nox --webui-port=8080 --profile=/var/lib/qbittorrent
Restart=on-failure
TimeoutStopSec=1800
Hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=true
ReadWritePaths=/var/lib/qbittorrent
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictNamespaces=true
RestrictRealtime=true
LockPersonality=true
[Install]
WantedBy=multi-user.target
EOF

Key flags:

• --webui-port=8080 -- explicit port, easier than clicking through the UI later
• --profile=/var/lib/qbittorrent -- everything (config, torrents, state) stays in one directory
• UMask=007 -- new files are group-writable, world-unreachable
• ReadWritePaths=/var/lib/qbittorrent -- combined with ProtectSystem=full this sandboxes writes to just the profile directory

sudo systemctl daemon-reload
sudo systemctl enable --now qbittorrent-nox.service

Verify it is running:

sudo systemctl status qbittorrent-nox.service

Expected output:

● qbittorrent-nox.service - qBittorrent-nox service
     Loaded: loaded (/etc/systemd/system/qbittorrent-nox.service; enabled)
     Active: active (running) since Thu 2026-04-16 12:00:00 UTC; 5s ago
   Main PID: 4567 (qbittorrent-nox)
      Tasks: 19 (limit: 9415)
     Memory: 58.4M

Step 5: First Login and Credentials

qBittorrent 4.6 no longer ships with a hardcoded admin / adminadmin password. On first start it prints a randomly generated temporary password to the system journal.

Grab it:

sudo journalctl -u qbittorrent-nox --no-pager | grep -i "temporary password"

Expected output:

The WebUI administrator username is: admin
The WebUI administrator password was not set. A temporary password is provided for this session: Jf7k2XqLp9Rm

Open http://your-server-ip:8080 in a browser. Log in with admin and the temporary password.

Immediately change the credentials:

You will be prompted to log in again with the new credentials.

If the Web UI will only ever be reached through Nginx, also set IP address under Web UI to 127.0.0.1. That binds qBittorrent to loopback only and makes port 8080 unreachable from the public internet even if your firewall has a bad day.

Step 6: Disable Built-In HTTPS (Prep for Reverse Proxy)

qBittorrent can terminate HTTPS itself, but once Nginx is in front it becomes pointless overhead and breaks Web Socket upgrades. Make sure HTTPS is off inside qBittorrent:

qBittorrent will only speak plain HTTP on 127.0.0.1:8080. Nginx will handle TLS on port 443 facing the internet. This is the canonical pattern for any self-hosted service behind a reverse proxy.

Step 7: Downloads and Category Mapping

Good category hygiene makes everything downstream (Sonarr, Radarr, disk migration, ratio tracking) easier.

Set the default save path and enable incomplete file routing:

Now create categories. Categories let qBittorrent save different torrent types to different folders automatically:

Step 8: Install VueTorrent as an Alternative UI

qBittorrent's default Web UI works but looks like it was styled in 2009. VueTorrent is a modern, mobile-friendly alternative that drops in with no patching.

Install as the qbittorrent user:

sudo -u qbittorrent mkdir -p /var/lib/qbittorrent/vuetorrent
cd /tmp
curl -fsSL https://github.com/WDaan/VueTorrent/releases/latest/download/vuetorrent.zip -o vuetorrent.zip
sudo -u qbittorrent unzip -q vuetorrent.zip -d /var/lib/qbittorrent/
rm vuetorrent.zip

Enable it inside qBittorrent:

Refresh the browser. You should now see VueTorrent's modern dashboard with dark mode, responsive mobile layout, and richer torrent details.

To update later, just re-download the zip and extract over the same folder.

Step 9: Nginx Reverse Proxy with TLS

A reverse proxy gives you HTTPS via Let's Encrypt, a clean URL, and a place to add rate limiting or IP allowlisting later.

Install Nginx and Certbot:

sudo apt install -y nginx certbot python3-certbot-nginx

Create the site config (replace qb.yourdomain.com with your DNS record):

sudo tee /etc/nginx/sites-available/qbittorrent > /dev/null <<'EOF'
server {
    listen 80;
    server_name qb.yourdomain.com;
    return 301 https://$host$request_uri;
}
server {
    listen 443 ssl http2;
    server_name qb.yourdomain.com;
    # Certificates inserted by certbot below
    # ssl_certificate     /etc/letsencrypt/live/qb.yourdomain.com/fullchain.pem;
    # ssl_certificate_key /etc/letsencrypt/live/qb.yourdomain.com/privkey.pem;
    # Torrent files can be large; allow bigger uploads
    client_max_body_size 100M;
    # Security headers
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options SAMEORIGIN;
    add_header Referrer-Policy no-referrer-when-downgrade;
    location / {
        proxy_pass              http://127.0.0.1:8080;
        proxy_http_version      1.1;
        proxy_set_header        Host               127.0.0.1:8080;
        proxy_set_header        X-Forwarded-Host   $http_host;
        proxy_set_header        X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Proto  $scheme;
        # Web Socket upgrades for the Web UI
        proxy_set_header        Upgrade            $http_upgrade;
        proxy_set_header        Connection         "upgrade";
        # qBittorrent CSRF check is strict about Host header
        proxy_set_header        X-Forwarded-Server $host;
        proxy_read_timeout      600s;
        proxy_send_timeout      600s;
    }
}
EOF

The Host 127.0.0.1:8080 trick is important -- qBittorrent's CSRF protection rejects requests where the Host header does not match what it bound to. Forwarding the real host in X-Forwarded-Host keeps link generation correct.

Enable the site and obtain a certificate:

sudo ln -s /etc/nginx/sites-available/qbittorrent /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx
sudo certbot --nginx -d qb.yourdomain.com

Certbot will automatically uncomment the SSL lines, point them at the freshly issued certificate, and install a renewal timer. Visit https://qb.yourdomain.com to confirm TLS is live.

Tighten the firewall -- block direct access to port 8080 from the internet:

sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw deny 8080
sudo ufw enable

Step 10: Bind qBittorrent Traffic to a WireGuard VPN

If your provider permits torrent traffic on the VPS IP, you can skip this step. Many users still route torrent traffic through a VPN as a privacy baseline. This section assumes you have already followed the WireGuard install guide and have a working wg0 interface.

There are two approaches. Pick one.

Option A: Bind qBittorrent to the WireGuard Interface (Simple)

qBittorrent can be told to bind its socket to a specific network interface. Any traffic originating from qBittorrent then takes the routing table of that interface.

Reinforce with iptables so that if wg0 goes down, qBittorrent cannot accidentally fall back to the public interface and leak:

sudo iptables -A OUTPUT -m owner --uid-owner qbittorrent -o wg0 -j ACCEPT
sudo iptables -A OUTPUT -m owner --uid-owner qbittorrent -o lo -j ACCEPT
sudo iptables -A OUTPUT -m owner --uid-owner qbittorrent -d 127.0.0.1 -j ACCEPT
sudo iptables -A OUTPUT -m owner --uid-owner qbittorrent -j REJECT

These rules let the qbittorrent user talk to loopback (for Nginx, Prowlarr) and wg0 (for peers and trackers) and drop everything else. Persist with iptables-persistent:

sudo apt install -y iptables-persistent
sudo netfilter-persistent save

Option B: Split Network Namespace (Hard Isolation)

For guaranteed isolation, run qBittorrent in its own network namespace where the only interface is the WireGuard tunnel. The root namespace cannot leak to peers because it has no route to them, and the qBittorrent namespace cannot reach the internet outside the tunnel because no other interface exists.

Create a namespace vpn with a WireGuard interface moved into it:

sudo ip netns add vpn
sudo ip -n vpn link set lo up
sudo ip link add wg-vpn type wireguard
sudo wg setconf wg-vpn /etc/wireguard/wg0.conf
sudo ip link set wg-vpn netns vpn
sudo ip -n vpn addr add 10.66.66.2/32 dev wg-vpn
sudo ip -n vpn link set wg-vpn up
sudo ip -n vpn route add default dev wg-vpn

Run qBittorrent inside the namespace via a drop-in systemd override:

sudo systemctl edit qbittorrent-nox.service

Add:

[Service]
ExecStart=
ExecStart=/usr/sbin/ip netns exec vpn /usr/bin/qbittorrent-nox --webui-port=8080 --profile=/var/lib/qbittorrent

The Web UI on 127.0.0.1:8080 is unreachable from Nginx because it lives inside the vpn namespace. Bridge it back with socat:

sudo apt install -y socat
sudo tee /etc/systemd/system/qbittorrent-bridge.service > /dev/null <<'EOF'
[Unit]
Description=Bridge qBittorrent Web UI out of the vpn netns
After=qbittorrent-nox.service
Requires=qbittorrent-nox.service
[Service]
ExecStart=/usr/bin/socat TCP-LISTEN:8080,fork,reuseaddr EXEC:"ip netns exec vpn socat STDIO TCP\:127.0.0.1\:8080"
Restart=on-failure
[Install]
WantedBy=multi-user.target
EOF
sudo systemctl daemon-reload
sudo systemctl enable --now qbittorrent-bridge.service

Now Nginx on the root namespace talks to 127.0.0.1:8080 (the bridge), which forwards into the vpn namespace where qBittorrent lives. Torrent peers see only the VPN IP. A VPN disconnect produces an immediate, clean failure because no fallback route exists.

This is the same pattern used by gluetun, wireguard-namespaces, and other battle-tested seedbox setups.

Post-Install Checks

Run through this checklist before adding real torrents:

# Service is running
sudo systemctl status qbittorrent-nox
Listening only on loopback
sudo ss -tlnp | grep 8080
Expected: 127.0.0.1:8080
TLS certificate valid
curl -I https://qb.yourdomain.com
Expected: HTTP/2 200
If using VPN: torrent IP matches VPN exit
curl --interface wg0 https://ifconfig.me

Add a Linux ISO torrent as a smoke test -- the Ubuntu 24.04 Desktop torrent is a good choice. Confirm it downloads to /var/lib/qbittorrent/Downloads (or the linux-isos category folder), then lets you seed back.

FAQ

Is running a torrent client on a VPS legal?

qBittorrent itself is completely legal everywhere it is distributed. What determines legality is the content you download and share. This guide is intended for fully legitimate use cases -- Linux ISOs, public-domain media, Creative Commons works, academic datasets from Academic Torrents, and your own backups. Always review your VPS provider's acceptable use policy before seeding anything, and when in doubt stick to clearly licensed content.

Why use qbittorrent-nox instead of the desktop qbittorrent package?

qbittorrent-nox is the headless build designed specifically for servers. It drops the Qt GUI dependency chain, runs as a systemd service, and exposes a full-featured Web UI on any port you choose. On a VPS it is always the right choice -- a desktop build would pull in 200+ MB of unused libraries and refuse to start without an X server.

Do I need a VPN for a seedbox on a VPS?

If your VPS provider permits torrent traffic on the dedicated IP and you are only seeding legal content, a VPN is optional. Many users still route torrent traffic through WireGuard so that their VPS IP is never exposed to trackers and peers -- this also adds a useful layer of isolation between your seedbox and the Arr stack. The split network namespace approach in Step 10 is the gold standard for leak-free binding.

What is VueTorrent and should I use it?

VueTorrent is a modern, open-source alternative Web UI that drops into qBittorrent without patching the binary. It provides a responsive mobile layout, dark mode by default, richer per-torrent statistics, and keyboard shortcuts. If you use the Web UI regularly, especially from a phone, VueTorrent is a significant upgrade over the stock interface.

Can I integrate qBittorrent with Sonarr, Radarr, and Prowlarr?

Yes, and this is the most common use case. qBittorrent is a first-class download client in every Arr application. In Sonarr and Radarr, go to Settings -> Download Clients -> Add -> qBittorrent and point it at http://127.0.0.1:8080 with a dedicated API user and category (tv or movies). Prowlarr fans indexers out to all the Arrs. Jellyfin then points at the category folders for automatic library indexing.

How do I move the Downloads folder to a bigger disk?

Mount the new volume (for example at /mnt/storage), stop qBittorrent, move the directory, fix ownership, update the save path, and restart:

sudo systemctl stop qbittorrent-nox
sudo mv /var/lib/qbittorrent/Downloads /mnt/storage/qbittorrent-downloads
sudo chown -R qbittorrent:qbittorrent /mnt/storage/qbittorrent-downloads
sudo -u qbittorrent ln -s /mnt/storage/qbittorrent-downloads /var/lib/qbittorrent/Downloads
sudo systemctl start qbittorrent-nox

A symlink keeps the systemd ReadWritePaths= sandbox happy without further changes. Alternatively, update Default Save Path in the Web UI to the new mount and skip the symlink.

Why disable qBittorrent's built-in HTTPS when using Nginx?

When Nginx terminates TLS in front of qBittorrent, adding a second TLS layer between Nginx and the backend is pointless CPU overhead, breaks Web Socket upgrades on some Nginx versions, and complicates certificate renewal (you would have to reuse Let's Encrypt certificates inside qBittorrent's own TLS config). The canonical reverse-proxy pattern is: HTTPS on the public edge, plain HTTP on loopback. Let Nginx handle TLS and let qBittorrent speak plain HTTP on 127.0.0.1 only.

Next Steps

With qBittorrent running, expand into a full media stack:

• Add Prowlarr for unified indexer management. Install Prowlarr and connect it to qBittorrent. Every indexer you add in Prowlarr automatically syncs to Sonarr, Radarr, Lidarr, and Readarr -- no more configuring the same tracker four times.
• Automate TV shows with Sonarr. Sonarr watches for new episodes, submits downloads to qBittorrent with category tv, and renames finished files into a clean library layout.
• Automate movies with Radarr. Radarr does the same for films -- wishlist a movie and it appears in your library the moment an acceptable release is available.
• Stream your library with Jellyfin. Jellyfin is the open-source, free-forever media server. Point it at your category folders and stream to every device in the house.
• Harden the VPN. If you followed Option A for VPN binding, consider upgrading to Option B (split namespace) for guaranteed leak protection. See the WireGuard install guide for tunnel provisioning.
• Bookmark the official docs. The qBittorrent Wiki is the authoritative reference for advanced features -- search jobs, RSS auto-download rules, the full Web API, and plugin search engines.

Prefer a managed VPS over a DIY install?

The CloudCore Starter plan at EUR 7.99/month gives you 4 vCPU, 6 GB RAM, 100 GB NVMe, and unmetered bandwidth -- enough to run qBittorrent, Prowlarr, Sonarr, Radarr, and Jellyfin on a single box.

- Ubuntu 24.04 LTS pre-installed

- Full root access, no usage caps

- 99.9% uptime SLA

- Deploy in 60 seconds

Launch Your Seedbox VPS Now