mirror of
https://github.com/soulis-1256/assemblrr.git
synced 2026-08-29 17:41:40 +00:00
119 lines
3.5 KiB
YAML
119 lines
3.5 KiB
YAML
# Overlay: VPN via Gluetun — routes qBittorrent through VPN
|
|
# Usage: docker compose -f base.yaml -f vpn.yaml --profile <media_service> up -d
|
|
|
|
services:
|
|
gluetun:
|
|
image: qmcgaw/gluetun:v3.41.3
|
|
container_name: gluetun
|
|
cap_add:
|
|
- NET_ADMIN
|
|
devices:
|
|
- /dev/net/tun:/dev/net/tun
|
|
ports:
|
|
- 8888:8888/tcp # HTTP proxy
|
|
- 8388:8388/tcp # Shadowsocks
|
|
- 8388:8388/udp # Shadowsocks
|
|
- 8003:8000/tcp # Admin
|
|
- 8081:8081/tcp # qBittorrent via VPN
|
|
secrets:
|
|
- openvpn_user
|
|
- openvpn_password
|
|
- wireguard_private_key
|
|
environment:
|
|
- VPN_SERVICE_PROVIDER=${VPN_SERVICE}
|
|
- VPN_TYPE=${VPN_TYPE}
|
|
- WIREGUARD_ADDRESSES=${WIREGUARD_ADDRESSES}
|
|
- OPENVPN_CIPHERS=AES-256-GCM
|
|
- PORT_FORWARD_ONLY=${PORT_FORWARD_ONLY:-off}
|
|
- VPN_PORT_FORWARDING=${VPN_PORT_FORWARDING:-off}
|
|
- FIREWALL_OUTBOUND_SUBNETS=172.60.0.0/24
|
|
# Prowlarr indexer HTTP (see prowlarr_sync_gluetun_proxy). Off unless set.
|
|
- HTTPPROXY=on
|
|
- TZ=${TZ}
|
|
healthcheck:
|
|
test:
|
|
[
|
|
"CMD-SHELL",
|
|
"wget -qO /dev/null http://127.0.0.1:9999/v1/healthcheck || exit 1",
|
|
]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 10s
|
|
start_interval: 2s
|
|
volumes:
|
|
- ${INSTALL_DIRECTORY}/config/gluetun:/gluetun
|
|
restart: unless-stopped
|
|
networks:
|
|
assemblrr_network:
|
|
ipv4_address: 172.60.0.19
|
|
|
|
qbittorrent:
|
|
network_mode: "service:gluetun"
|
|
depends_on:
|
|
gluetun:
|
|
condition: service_healthy
|
|
labels:
|
|
- "deunhealth.restart.on.unhealthy=true"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "wget -qO /dev/null http://127.0.0.1:9999/v1/healthcheck || exit 1"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 2
|
|
start_period: 10s
|
|
start_interval: 2s
|
|
restart: unless-stopped
|
|
|
|
deunhealth:
|
|
image: qmcgaw/deunhealth:v0.3.0
|
|
container_name: deunhealth
|
|
network_mode: "none"
|
|
environment:
|
|
- LOG_LEVEL=info
|
|
- HEALTH_SERVER_ADDRESS=127.0.0.1:9999
|
|
- TZ=${TZ}
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
restart: unless-stopped
|
|
|
|
vpn-watchdog:
|
|
image: assemblrr/vpn-watchdog:local
|
|
pull_policy: build
|
|
build:
|
|
context: ${INSTALL_DIRECTORY}/compose/sidecars
|
|
dockerfile: vpn-watchdog.Dockerfile
|
|
container_name: vpn-watchdog
|
|
depends_on:
|
|
gluetun:
|
|
condition: service_healthy
|
|
environment:
|
|
- AUTH_USERNAME_FILE=/run/secrets/auth_username.txt
|
|
- AUTH_PASSWORD_FILE=/run/secrets/auth_password.txt
|
|
- TZ=${TZ}
|
|
- WATCHDOG_INTERVAL=${WATCHDOG_INTERVAL:-30}
|
|
# Reach qB via Gluetun's published port on the Docker network — do not
|
|
# share Gluetun's netns (apk / DNS / package installs must not go out the VPN).
|
|
- QBIT_HOST=gluetun:8081
|
|
volumes:
|
|
- ${INSTALL_DIRECTORY}/scripts/vpn-watchdog.sh:/scripts/vpn-watchdog.sh:ro
|
|
- ${INSTALL_DIRECTORY}/secrets:/run/secrets:ro
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
command:
|
|
- -c
|
|
- |
|
|
while true; do
|
|
bash /scripts/vpn-watchdog.sh || true
|
|
sleep "$${WATCHDOG_INTERVAL:-30}"
|
|
done
|
|
restart: unless-stopped
|
|
networks:
|
|
assemblrr_network:
|
|
ipv4_address: 172.60.0.20
|
|
|
|
secrets:
|
|
openvpn_user:
|
|
file: ${INSTALL_DIRECTORY}/secrets/openvpn_user.txt
|
|
openvpn_password:
|
|
file: ${INSTALL_DIRECTORY}/secrets/openvpn_password.txt
|
|
wireguard_private_key:
|
|
file: ${INSTALL_DIRECTORY}/secrets/wireguard_private_key.txt
|