How to Set Up a Seedbox with qBittorrent on Ubuntu

A seedbox is a server that stays online around the clock, keeps your torrents seeding and gives you a Web UI to manage them from anywhere. A dedicated server is a good fit: you get root, local NVMe for active torrents and an unmetered port, with no shared slot or per-GB counter. This guide builds a seedbox on Ubuntu 22.04 or 24.04 with qBittorrent-nox, running as its own user under systemd, with the Web UI behind HTTPS and a firewall that exposes only what it needs. If you would rather skip the setup, the preconfigured qBittorrent app covers the same stack.

Prerequisites

• A dedicated server or VPS with Ubuntu 22.04 or 24.04 and root or sudo access.
• A DNS name (for example seed.example.com) pointing at the server's IP, if you want HTTPS for the Web UI.
• Only content you have the right to share. See the legal note at the end.

Step 1: Update the system and install qBittorrent-nox

qbittorrent-nox is the headless build of qBittorrent: no desktop, just the engine and the Web UI.

sudo apt update && sudo apt upgrade -y
sudo apt install -y qbittorrent-nox
qbittorrent-nox --version

Ubuntu 24.04 ships a 4.6.x build in its own repositories. Ubuntu 22.04's repository build is older than 4.6.1, and that matters for the login step below.

If you want a newer build, the stable PPA is maintained by the qBittorrent team:

sudo add-apt-repository -y ppa:qbittorrent-team/qbittorrent-stable
sudo apt update
apt-cache policy qbittorrent-nox
sudo apt install -y qbittorrent-nox

Read the apt-cache policy output before installing and make sure the candidate version really comes from the PPA. If it does not, stay with the distribution package; it is fine for a seedbox.

Step 2: Create a dedicated user and accept the legal notice

Never run a torrent client as root. Create a user with no password login and run the client once by hand so it can show its legal notice.

sudo adduser --disabled-password --gecos "" qbtuser
sudo -u qbtuser -H qbittorrent-nox

Accept the notice when prompted. The client prints the Web UI address (port 8080 by default) and credentials. Then stop it with Ctrl+C. We start it properly under systemd next.

Step 3: Run it under systemd

The Ubuntu package installs a template unit at /usr/lib/systemd/system/[email protected]. The text after @ is the user it runs as:

sudo systemctl enable --now qbittorrent-nox@qbtuser
systemctl status qbittorrent-nox@qbtuser --no-pager

If that file is missing on your build, create /etc/systemd/system/qbittorrent-nox.service (this follows the example on the qBittorrent wiki) and use qbittorrent-nox instead of qbittorrent-nox@qbtuser in the commands:

[Unit]
Description=qBittorrent-nox service
Wants=network-online.target
After=network-online.target nss-lookup.target

[Service]
Type=exec
User=qbtuser
ExecStart=/usr/bin/qbittorrent-nox

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now qbittorrent-nox

Step 4: First login and the password

The username is admin. The password depends on the version:

• qBittorrent 4.6.1 and newer (including 5.x): there is no fixed default. At startup the client generates a random temporary password for that session and prints it to its output, which systemd stores in the journal. A new one is generated on each start until you set your own password.
• Older than 4.6.1 (for example the 22.04 repository build): the default is adminadmin. Change it immediately.

For 4.6.1 and newer, read the temporary password from the journal:

sudo journalctl -u qbittorrent-nox@qbtuser -b --no-pager | grep -i password

Do not open port 8080 to the internet to log in. Use an SSH tunnel from your own computer:

ssh -L 8080:127.0.0.1:8080 your-user@SERVER_IP

Then browse to http://127.0.0.1:8080 and sign in as admin. Go to Tools > Options > Web UI > Authentication, set your own username and a long unique password, and save. Keep the temporary password out of your notes; it is only good for this first session.

Step 5: Keep the Web UI off the public internet

In Options > Web UI, set IP address to 127.0.0.1 and save, then restart the service. The Web UI now listens only on the server itself, and everything below reaches it through nginx or an SSH tunnel.

sudo systemctl restart qbittorrent-nox@qbtuser
ss -ltnp | grep 8080

The ss output should show 127.0.0.1:8080, not 0.0.0.0:8080 or *:8080.

Optional: nginx reverse proxy with HTTPS

An SSH tunnel is enough for one admin. If you want a normal URL, put nginx in front and get a Let's Encrypt certificate with Certbot.

sudo apt install -y nginx
sudo nano /etc/nginx/sites-available/seedbox

Based on the qBittorrent wiki's reverse proxy example:

server {
    listen 80;
    server_name seed.example.com;

    location / {
        proxy_pass         http://127.0.0.1:8080/;
        proxy_http_version 1.1;

        proxy_set_header   Host               $proxy_host;
        proxy_set_header   X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Host   $http_host;
        proxy_set_header   X-Forwarded-Proto  $scheme;

        client_max_body_size 100M;
    }
}

sudo ln -s /etc/nginx/sites-available/seedbox /etc/nginx/sites-enabled/seedbox
sudo nginx -t && sudo systemctl reload nginx

Install Certbot the way its documentation recommends for Ubuntu, then let it add HTTPS to the server block:

sudo apt-get remove certbot
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/local/bin/certbot
sudo certbot --nginx
sudo certbot renew --dry-run

If you hit login loops on qBittorrent 5.0 or older, the wiki suggests adding proxy_cookie_path / "/; Secure"; to the location block, but only once the site is served over HTTPS. It is not needed from v5.1.

Step 6: Firewall with ufw

Allow SSH first, or you will lock yourself out. Then add web ports for nginx and your torrent port. We use 51413 below only as an example; any port you pick works as long as it matches the client setting.

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 80,443/tcp
sudo ufw allow 51413/tcp
sudo ufw allow 51413/udp
sudo ufw enable
sudo ufw status verbose

Do not add a rule for 8080. If you use only the SSH tunnel and no nginx, skip the 80/443 rule too.

In Options > Connection, set Port used for incoming connections to the same number, and turn off random port selection and UPnP/NAT-PMP (a server has no router to ask). A reachable incoming port lets more peers connect to you, which helps seeding.

Step 7: Download folders

Keep active data and finished data in separate directories, owned by the service user:

sudo mkdir -p /srv/seedbox/incomplete /srv/seedbox/complete
sudo chown -R qbtuser:qbtuser /srv/seedbox

In Options > Downloads, set the default save path to /srv/seedbox/complete, and enable keeping incomplete torrents in /srv/seedbox/incomplete. Categories let you split paths by type (for example /srv/seedbox/complete/media).

Choosing hardware for a seedbox

What matters most is where the active torrents live and how fast the port is.

Disk. Torrents that are downloading or seeding hit the disk with many small random reads, so keep them on NVMe. Move finished items you only keep for archive to bulk storage.

Port. A 1G port is plenty for one person and a handful of trackers. If you seed to many peers at once, or run several users on the box, a 10G-class port is where unmetered dedicated servers and the 10 Gbps dedicated server page come in. Port speed and the committed rate differ by product, so confirm the committed rate for your chosen server before ordering.

These are real products from our current catalog; check the product page for the final price at checkout:

For most seedboxes the $139 Xeon Gold 6138 is the practical starting point: two NVMe drives for active torrents, 64 GB RAM for disk cache and enough threads for qBittorrent and a media server. Vault S is a storage server for the archive, not a replacement for NVMe. If you want to combine the two, tell us your layout and we will confirm how to connect them. We do not publish benchmark numbers for these builds, so size by your own torrent count and peer load, and start smaller if unsure.

Optional: add Plex or Jellyfin

Once the files sit in /srv/seedbox/complete, a media server on the same box can stream them. Both Plex and Jellyfin install from their own apt repositories; point their libraries at the completed folder and make sure their user can read it (for example by adding it to the qbtuser group). Keep in mind that the Xeon Gold 6138 has no integrated GPU, so transcoding runs on the CPU. Direct play is much lighter than transcoding.

Troubleshooting

• Unauthorized, or login does not stick. On 4.6.1+, the temporary password changes on every restart until you save your own. Re-read the journal. Behind nginx, check that the Host and X-Forwarded-* headers are set as above.
• Locked out of the Web UI. Stop the service, delete the WebUI\Password_PBKDF2 line from /home/qbtuser/.config/qBittorrent/qBittorrent.conf, start it again and read the new temporary password from the journal.
• Torrents connect but seed slowly. Check that the incoming port matches the ufw rule and the client setting, and that no other firewall sits in front of the server.
• Service fails to start. Run journalctl -u qbittorrent-nox@qbtuser -n 50 and check that qbtuser owns its home directory and /srv/seedbox.

Legal note

Use your seedbox only for content you have the right to share. Our Acceptable Use Policy applies to every server, including copyright rules and the abuse process; reports are forwarded and reviewed under the policy. Hostfory is not a place to hide infringing activity, and a seedbox does not make anything anonymous.

Next step

If you would rather start from a ready-made setup, see our seedbox hosting page, or tell us your torrent count, library size and target port speed through the contact form and we will recommend a server from the catalog.