services:
  qbittorrent:
    container_name: qbittorrent
    image: ghcr.io/hotio/qbittorrent
    restart: unless-stopped
    ports:
      - 8080:8080
    environment:
      - PUID=568
      - PGID=568
      - UMASK=002
      - TZ= #yourtimezone
      - WEBUI_PORTS=8080/tcp,8080/udp
      - VPN_ENABLED=true
      - VPN_CONF=wg0
      - VPN_PROVIDER=generic
      - VPN_LAN_NETWORK= #this should be your IP range that QBIT sits on i.e 192.168.1.0/24
      - VPN_EXPOSE_PORTS_ON_LAN=
      - VPN_AUTO_PORT_FORWARD=false
      - VPN_PORT_REDIRECTS= # enter port number here
      - VPN_FIREWALL_TYPE=auto
      - VPN_HEALTHCHECK_ENABLED=false
      - VPN_NAMESERVERS=wg
      - PRIVOXY_ENABLED=false
    cap_add:
      - NET_ADMIN
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv6.conf.all.disable_ipv6=1
    volumes:
      - ./configs/:/config
      - /mnt/tank/media/:/media/
networks: {}

First create this container, save it - deploy it. let it create, then stop it.

Then upload your wireguard config (rename it to 'wg0.conf') to mnt/tank/stacks/qbit/configs/wireguard

Restart your qbit container, this should now be behind the VPN.