From a046d2c89d326c40b7252ee0660a7d17c492c251 Mon Sep 17 00:00:00 2001
From: Frank <frank@dankware>
Date: Tue, 18 Aug 2026 15:16:50 -0700
Subject: [PATCH] Gluetun: pass full single-peer WireGuard config to the
 container

The compose only forwarded VPN_SERVICE_PROVIDER, VPN_TYPE and the private
key, so Gluetun could not form a tunnel. Forward the peer public key,
endpoint IP/port, addresses, allowed IPs and keepalive interval. Add
matching placeholders to .env.example (current Gluetun uses the
single-peer WIREGUARD_* model, not the old WIREGUARD_PEERS_* names).
---
 dankclaw/.env.example | 9 ++++++++-
 dankclaw/compose.yaml | 6 ++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/dankclaw/.env.example b/dankclaw/.env.example
index b9b0612..60a1258 100644
--- a/dankclaw/.env.example
+++ b/dankclaw/.env.example
@@ -6,9 +6,16 @@ SEARXNG_SECRET=changeme
 SEARXNG_BASE_URL=http://search.dankclaw.local/
 
 # Gluetun VPN (see https://github.com/qdm12/gluetun-wiki)
-VPN_SERVICE_PROVIDER=mullvad
+# Single-peer WireGuard model. Fill from your provider's WireGuard config.
+VPN_SERVICE_PROVIDER=protonvpn
 VPN_TYPE=wireguard
 WIREGUARD_PRIVATE_KEY=changeme
+WIREGUARD_ADDRESSES=0.0.0.0/32
+WIREGUARD_PUBLIC_KEY=changeme
+WIREGUARD_ENDPOINT_IP=0.0.0.0
+WIREGUARD_ENDPOINT_PORT=51820
+WIREGUARD_ALLOWED_IPS=0.0.0.0/0,::/0
+WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=25s
 
 # Gitea database
 GITEA_DB_PASSWORD=changeme
diff --git a/dankclaw/compose.yaml b/dankclaw/compose.yaml
index 471e4d8..1d43cdf 100644
--- a/dankclaw/compose.yaml
+++ b/dankclaw/compose.yaml
@@ -16,6 +16,12 @@ services:
       VPN_SERVICE_PROVIDER: "${VPN_SERVICE_PROVIDER}"
       VPN_TYPE: "${VPN_TYPE}"
       WIREGUARD_PRIVATE_KEY: "${WIREGUARD_PRIVATE_KEY}"
+      WIREGUARD_ADDRESSES: "${WIREGUARD_ADDRESSES}"
+      WIREGUARD_PUBLIC_KEY: "${WIREGUARD_PUBLIC_KEY}"
+      WIREGUARD_ENDPOINT_IP: "${WIREGUARD_ENDPOINT_IP}"
+      WIREGUARD_ENDPOINT_PORT: "${WIREGUARD_ENDPOINT_PORT}"
+      WIREGUARD_ALLOWED_IPS: "${WIREGUARD_ALLOWED_IPS}"
+      WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL: "${WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL}"
     ports:
       # SearXNG's published port lives on gluetun (network_mode: service:gluetun)
       - "8081:8080"