services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: vpn_gluetun
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 256M
        reservations:
          cpus: "0.25"
          memory: 128M
    ports:
      - 30000:8000
      - 13001:6500
      - 11470:11470
      - 11471:11471
      - 12470:12470
      - 12471:12471
      - 8099:8080
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    volumes:
      - /mnt/pve/unas/services/gluetun/data:/gluetun
    environment:
      - PUID=977
      - PGID=988
      - VPN_SERVICE_PROVIDER=nordvpn
      - SERVER_COUNTRIES=Germany
      - VPN_TYPE=wireguard
      - WIREGUARD_MTU=1420
      - WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=25s
      - FIREWALL_OUTBOUND_SUBNETS=192.168.1.0/24
      - UPDATER_PERIOD=24h
      - TZ=Europe/Berlin
      - OPENVPN_USER=BNDz2XmPPbgWxoPe1XQcWT1v
      - OPENVPN_PASSWORD=kqbaBsuvVP4gcvqfv3bC8BHe
      - WIREGUARD_PRIVATE_KEY=70dYZGDAUkXDjeCEFVJJMMbbso/jGnuk10HoInKHF+w=
      - HTTP_CONTROL_SERVER_AUTH_DEFAULT_ROLE='{"auth":"none"}'
    # No custom healthcheck: gluetun ships a built-in healthcheck (queries
    # 127.0.0.1:9999 in healthcheck mode and verifies the VPN tunnel/DNS).
    # Overriding it with wget against the :8000 control server gives false
    # "unhealthy" (that endpoint 404s). Let the image's own healthcheck run.