# Overlay: VPN via Gluetun — routes qBittorrent through VPN
# Usage: docker compose -f base.yaml -f vpn.yaml --profile <media_service> up -d

services:
  gluetun:
    image: qmcgaw/gluetun:v3.41.3
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - 8888:8888/tcp # HTTP proxy
      - 8388:8388/tcp # Shadowsocks
      - 8388:8388/udp # Shadowsocks
      - 8003:8000/tcp # Admin
      - 8081:8081/tcp # qBittorrent via VPN
    secrets:
      - openvpn_user
      - openvpn_password
      - wireguard_private_key
    environment:
      - VPN_SERVICE_PROVIDER=${VPN_SERVICE}
      - VPN_TYPE=${VPN_TYPE}
      - WIREGUARD_ADDRESSES=${WIREGUARD_ADDRESSES}
      - OPENVPN_CIPHERS=AES-256-GCM
      - PORT_FORWARD_ONLY=${PORT_FORWARD_ONLY:-off}
      - VPN_PORT_FORWARDING=${VPN_PORT_FORWARDING:-off}
      - FIREWALL_OUTBOUND_SUBNETS=172.60.0.0/24
      # Prowlarr indexer HTTP (see prowlarr_sync_gluetun_proxy). Off unless set.
      - HTTPPROXY=on
      - TZ=${TZ}
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget -qO /dev/null http://127.0.0.1:9999/v1/healthcheck || exit 1",
        ]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s
      start_interval: 2s
    volumes:
      - ${INSTALL_DIRECTORY}/config/gluetun:/gluetun
    restart: unless-stopped
    networks:
      assemblrr_network:
        ipv4_address: 172.60.0.19

  qbittorrent:
    network_mode: "service:gluetun"
    depends_on:
      gluetun:
        condition: service_healthy
    labels:
      - "deunhealth.restart.on.unhealthy=true"
    healthcheck:
      test: ["CMD-SHELL", "wget -qO /dev/null http://127.0.0.1:9999/v1/healthcheck || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 2
      start_period: 10s
      start_interval: 2s
    restart: unless-stopped

  deunhealth:
    image: qmcgaw/deunhealth:v0.3.0
    container_name: deunhealth
    network_mode: "none"
    environment:
      - LOG_LEVEL=info
      - HEALTH_SERVER_ADDRESS=127.0.0.1:9999
      - TZ=${TZ}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    restart: unless-stopped

  vpn-watchdog:
    image: assemblrr/vpn-watchdog:local
    pull_policy: build
    build:
      context: ${INSTALL_DIRECTORY}/compose/sidecars
      dockerfile: vpn-watchdog.Dockerfile
    container_name: vpn-watchdog
    depends_on:
      gluetun:
        condition: service_healthy
    environment:
      - AUTH_USERNAME_FILE=/run/secrets/auth_username.txt
      - AUTH_PASSWORD_FILE=/run/secrets/auth_password.txt
      - TZ=${TZ}
      - WATCHDOG_INTERVAL=${WATCHDOG_INTERVAL:-30}
      # Reach qB via Gluetun's published port on the Docker network — do not
      # share Gluetun's netns (apk / DNS / package installs must not go out the VPN).
      - QBIT_HOST=gluetun:8081
    volumes:
      - ${INSTALL_DIRECTORY}/scripts/vpn-watchdog.sh:/scripts/vpn-watchdog.sh:ro
      - ${INSTALL_DIRECTORY}/secrets:/run/secrets:ro
      - /var/run/docker.sock:/var/run/docker.sock
    command:
      - -c
      - |
        while true; do
          bash /scripts/vpn-watchdog.sh || true
          sleep "$${WATCHDOG_INTERVAL:-30}"
        done
    restart: unless-stopped
    networks:
      assemblrr_network:
        ipv4_address: 172.60.0.20

secrets:
  openvpn_user:
    file: ${INSTALL_DIRECTORY}/secrets/openvpn_user.txt
  openvpn_password:
    file: ${INSTALL_DIRECTORY}/secrets/openvpn_password.txt
  wireguard_private_key:
    file: ${INSTALL_DIRECTORY}/secrets/wireguard_private_key.txt