Add gluetun+qbittorrent stack (replaces native qbittorrent-nox bound to desktop ProtonVPN app)

2026-08-07 15:27:17 +00:00
parent bbb56056c0
commit 2b2f586487
1 changed files with 66 additions and 0 deletions
@@ -0,0 +1,66 @@
+services:
+  gluetun:
+    image: qmcgaw/gluetun:latest
+    container_name: gluetun
+    cap_add:
+      - NET_ADMIN
+    devices:
+      - /dev/net/tun:/dev/net/tun
+    environment:
+      - VPN_SERVICE_PROVIDER=protonvpn
+      - VPN_TYPE=openvpn
+      - OPENVPN_USER=${OPENVPN_USER}
+      - OPENVPN_PASSWORD=${OPENVPN_PASSWORD}
+      - FIREWALL_OUTBOUND_SUBNETS=192.168.88.0/24
+      - TZ=America/Chicago
+    ports:
+      - 8080:8080
+      - 6881:6881
+      - 6881:6881/udp
+    volumes:
+      - /srv/docker/gluetun:/gluetun
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "sh", "-c", "wget -qO- https://ipinfo.io/ip || exit 1"]
+      interval: 60s
+      timeout: 20s
+      retries: 3
+      start_period: 30s
+
+  qbittorrent:
+    image: lscr.io/linuxserver/qbittorrent:latest
+    container_name: qbittorrent
+    network_mode: "service:gluetun"
+    depends_on:
+      gluetun:
+        condition: service_healthy
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=America/Chicago
+      - WEBUI_PORT=8080
+    volumes:
+      - /srv/docker/qbittorrent/config:/config
+      - /mnt/media:/mnt/media
+    restart: unless-stopped
+
+# NOTE (2026-08-07): Replaces the native qbittorrent-nox systemd service on the
+# jellyfin host, which was bound to a desktop ProtonVPN app's tunnel interface
+# (proton0). When that GUI-managed tunnel dropped, there was no way to reconnect
+# without an interactive desktop session, silently killing all downloads.
+#
+# qbittorrent now runs with network_mode: service:gluetun, so it shares gluetun's
+# network namespace entirely. If the VPN drops, qbittorrent has zero network
+# access (fails closed, never falls back to the real IP) until gluetun
+# auto-reconnects on its own -- no GUI or manual intervention needed.
+#
+# OPENVPN_USER / OPENVPN_PASSWORD are the ProtonVPN OpenVPN/IKEv2 credentials
+# (see API Codes.md), NOT the regular Proton account login. Set them in a .env
+# file alongside this compose file (not committed) or export them before
+# `docker compose up -d`.
+#
+# qbittorrent's media volume is mounted at /mnt/media (matching the original
+# native install), NOT /data, so it lines up with Sonarr/Radarr's existing
+# Remote Path Mapping (host 192.168.88.10: /mnt/media/ -> /data/) and the
+# pre-existing categories (tv-sonarr, movies-radarr) needed zero path rewriting
+# when migrating resume data.