# Quadlet unit: Gluetun VPN tunnel in FrankBook-Pro's podman machine.
#
# Install path is INSIDE the machine VM:
#   /home/core/.config/containers/systemd/gluetun.container
# (installed by the frankbook-pro handler in scripts/deploy-remote.sh —
# install_quadlet targets the Linux hosts' systemctl --user, not the VM).
#
# WireGuard tunnel to ProtonVPN. qBittorrent and all five *arrs share this
# container's network namespace (Network=gluetun.container) so every fleet
# container's egress — torrent traffic, indexer APIs, metadata lookups —
# exits ONLY through the tunnel (AllowedIPs=0.0.0.0/0). Every fleet port
# publishes HERE; a netns-sharer publishes no ports of its own (same
# invariant as the dankclaw searxng/gluetun pair). Credentials live in
# /home/core/Containers/gluetun/env inside the VM (mode 0600, never
# committed); the private key is Mac-tunnel-specific and MUST NOT be copied
# from dankclaw — one WireGuard peer key cannot serve two machines at once.
[Unit]
Description=Gluetun VPN tunnel (FrankBook-Pro podman machine)

[Container]
ContainerName=gluetun
Image=docker.io/qmcgaw/gluetun:latest
AddCapability=NET_ADMIN
AddDevice=/dev/net/tun:/dev/net/tun
Environment=VPN_SERVICE_PROVIDER=${VPN_SERVICE_PROVIDER}
Environment=VPN_TYPE=${VPN_TYPE}
Environment=WIREGUARD_PRIVATE_KEY=${WIREGUARD_PRIVATE_KEY}
Environment=WIREGUARD_ADDRESSES=${WIREGUARD_ADDRESSES}
Environment=WIREGUARD_PUBLIC_KEY=${WIREGUARD_PUBLIC_KEY}
Environment=WIREGUARD_ENDPOINT_IP=${WIREGUARD_ENDPOINT_IP}
Environment=WIREGUARD_ENDPOINT_PORT=${WIREGUARD_ENDPOINT_PORT}
Environment=WIREGUARD_ALLOWED_IPS=${WIREGUARD_ALLOWED_IPS}
Environment=WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=${WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL}
PublishPort=8080:8080
PublishPort=6881:6881
PublishPort=6881:6881/udp
PublishPort=9696:9696
PublishPort=8989:8989
PublishPort=7878:7878
PublishPort=8686:8686
PublishPort=8787:8787

[Service]
EnvironmentFile=/home/core/Containers/gluetun/env
TimeoutStartSec=900
Restart=always

[Install]
WantedBy=default.target