services:
  gluetun:
    image: qmcgaw/gluetun:latest
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    environment:
      - VPN_SERVICE_PROVIDER=protonvpn
      - VPN_TYPE=openvpn
      - OPENVPN_USER=${OPENVPN_USER}
      - OPENVPN_PASSWORD=${OPENVPN_PASSWORD}
      - FIREWALL_OUTBOUND_SUBNETS=192.168.88.0/24
      - TZ=America/Chicago
    ports:
      - 8080:8080
      - 6881:6881
      - 6881:6881/udp
    volumes:
      - /srv/docker/gluetun:/gluetun
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "sh", "-c", "wget -qO- https://ipinfo.io/ip || exit 1"]
      interval: 60s
      timeout: 20s
      retries: 3
      start_period: 30s

  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    network_mode: "service:gluetun"
    depends_on:
      gluetun:
        condition: service_healthy
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/Chicago
      - WEBUI_PORT=8080
    volumes:
      - /srv/docker/qbittorrent/config:/config
      - /mnt/media:/mnt/media
    restart: unless-stopped

# NOTE (2026-08-07): Replaces the native qbittorrent-nox systemd service on the
# jellyfin host, which was bound to a desktop ProtonVPN app's tunnel interface
# (proton0). When that GUI-managed tunnel dropped, there was no way to reconnect
# without an interactive desktop session, silently killing all downloads.
#
# qbittorrent now runs with network_mode: service:gluetun, so it shares gluetun's
# network namespace entirely. If the VPN drops, qbittorrent has zero network
# access (fails closed, never falls back to the real IP) until gluetun
# auto-reconnects on its own -- no GUI or manual intervention needed.
#
# OPENVPN_USER / OPENVPN_PASSWORD are the ProtonVPN OpenVPN/IKEv2 credentials
# (see API Codes.md), NOT the regular Proton account login. Set them in a .env
# file alongside this compose file (not committed) or export them before
# `docker compose up -d`.
#
# qbittorrent's media volume is mounted at /mnt/media (matching the original
# native install), NOT /data, so it lines up with Sonarr/Radarr's existing
# Remote Path Mapping (host 192.168.88.10: /mnt/media/ -> /data/) and the
# pre-existing categories (tv-sonarr, movies-radarr) needed zero path rewriting
# when migrating resume data.