docs: daylog 2026-09-25 qbittorrent bt-net + scripts/prime apply-koopa-bt-fix wrappers

2026/2026-09-25--qbittorrent-bt-net.md

@@ -0,0 +1,39 @@
+# 2026-09-25 — qBittorrent BT net (flame / firewalled)
+
+## Goal
+Inbound BT listen **6881** tcp+udp reachable so WebUI connection status leaves the firewalled (flame) state.
+
+## Live on koopa
+- CTR `koopa-prime-qbittorrent` (linuxserver): host **6881** tcp+udp, WebUI **9023**→8080 → `bt.hacktivism.ch`
+- Conf: `Session\Port=6881`, `PortForwardingEnabled=true`, `Connection\UPnP=true`
+- Temp: `/downloads/incomplete/` (abc / host uid 100999)
+- Durable apply: `scripts/prime/apply-qbittorrent-bt-net.sh` (+ wrapper `koopa-bt-fix.sh`)
+- Clone on host: `~/koopa-admin-log/scripts/prime/`
+
+## firewalld
+- Doc: `configs/firewalld/public-ports.md` — **6881/tcp+udp**
+- Agent cannot list without sudo/polkit; human opens with:
+  ```bash
+  sudo firewall-cmd --permanent --add-port=6881/tcp
+  sudo firewall-cmd --permanent --add-port=6881/udp
+  sudo firewall-cmd --reload
+  ```
+- WAN probe success (below) implies the path through host firewall is open.
+
+## VeciGate (2026-09-25)
+- wan `dstnat` tcp+udp **6881** → `192.168.100.95:6881`
+- hairpin LAN `192.168.100.0/24` and LAN2 `192.168.88.0/24` → `212.51.151.254:6881` tcp+udp
+- Comments: `koopa: qBittorrent BT …` / `hairpin: LAN[2] qBittorrent BT …`
+- Detail: vecigate-admin-log `2026/2026-09-25--qbittorrent-bt-dnat.md`
+
+## Verify (2026-09-25, from magikoopa)
+| Probe | Result |
+|-------|--------|
+| `nc -vz 192.168.100.95 6881` | LAN_TCP_OK |
+| `nc -vz 212.51.151.254 6881` | WAN_TCP_OK |
+| `nc -zu 212.51.151.254 6881` | WAN_UDP_OK |
+
+WebUI API (`/api/v2/…`) still auth-gated from agent — human glance at connection icon on `bt.hacktivism.ch`.
+
+## Freigabe
+Session Freigabe covered podman conf/restart + VeciGate NAT. No git push of admin-log unless asked.