services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: vpn_gluetun
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 256M
        reservations:
          cpus: "0.25"
          memory: 128M
    ports:
      - 30000:8000
      - 13001:6500
      - 11470:11470
      - 11471:11471
      - 12470:12470
      - 12471:12471
      - 8099:8080
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    volumes:
      - /mnt/pve/unas/services/gluetun/data:/gluetun
      - ./gluetun_port:/tmp/gluetun # Shares the port file
    environment:
      - PUID=977
      - PGID=988
      - FIREWALL_OUTBOUND_SUBNETS=192.168.1.0/24
      - UPDATER_PERIOD=24h
      - TZ=Europe/Berlin
      - VPN_SERVICE_PROVIDER=protonvpn
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=QJ4sOBjZJjj347672wiaVcC/m9zLlmqoNKF06g0XBF4=
      - PORT_FORWARD_ONLY=on
      - VPN_PORT_FORWARDING=on
#      - VPN_PORT_FORWARDING_PROVIDER=protonvpn



      # - VPN_SERVICE_PROVIDER=nordvpn
      # - SERVER_COUNTRIES=Germany
      # - VPN_TYPE=wireguard
      # - WIREGUARD_MTU=1420
      - WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=25s

      - HTTP_CONTROL_SERVER_AUTH_DEFAULT_ROLE='{"auth":"none"}'
    # No custom healthcheck: gluetun ships a built-in healthcheck (queries
    # 127.0.0.1:9999 in healthcheck mode and verifies the VPN tunnel/DNS).
    # Overriding it with wget against the :8000 control server gives false
    # "unhealthy" (that endpoint 404s). Let the image's own healthcheck run.
  # port-updater:
  #   image: technosam/qbittorrent-gluetun-port-update:1.1
  #   container_name: port-updater
  #   network_mode: "service:gluetun" # Must be on Gluetun's network to talk to qBit
  #   volumes:
  #     - ./gluetun_port:/tmp/gluetun:ro # Reads the port file natively
  #   environment:
  #     - QBITTORRENT_SERVER=192.168.1.40
  #     - QBITTORRENT_PORT=13001
  #     - QBITTORRENT_USER=fkrebs
  #     - QBITTORRENT_PASS=tapirnase1
  #     - PORT_FILE=/tmp/gluetun/forwarded_port
  #     - LOOP_INTERVAL=300 # Checks every 5 minutes if the port changed
  #   # depends_on:
  #   #   - rdtclient
  #   restart: always