Gluetun: healthcheck via the tun0 tunnel interface

The :8000 status server 404s on every path and the image has no curl, so the
prior healthchecks could not pass. Check /sys/class/net/tun0 instead: it exists
only while the WireGuard tunnel is connected, so the healthcheck reflects real
VPN state.

dankclaw/compose.yaml

@@ -26,9 +26,10 @@ services:
       # SearXNG's published port lives on gluetun (network_mode: service:gluetun)
       - "8081:8080"
     healthcheck:
-      # The gluetun image has no curl; its status server answers 200 at /
-      # on port 8000. Use wget (present in the image) against that path.
-      test: ["CMD", "wget", "-qO", "/dev/null", "http://localhost:8000/"]
+      # The gluetun image has no curl, and its :8000 status server 404s on
+      # every path. Check the WireGuard tunnel interface instead: tun0 exists
+      # only while the VPN is connected, so this reflects real tunnel state.
+      test: ["CMD", "sh", "-c", "test -e /sys/class/net/tun0"]
       interval: 60s
       timeout: 10s
       retries: 3