# Quadlet unit: Gluetun VPN tunnel in FrankBook-Pro's podman machine.
#
# Install path is INSIDE the machine VM:
#   /home/core/.config/containers/systemd/gluetun.container
# (installed by the frankbook-pro handler in scripts/deploy-remote.sh —
# install_quadlet targets the Linux hosts' systemctl --user, not the VM).
#
# WireGuard tunnel to ProtonVPN. qBittorrent shares this container's network
# namespace (Network=gluetun.container) so torrent egress never touches the
# residential IP. qBittorrent's WebUI and BitTorrent ports publish HERE — a
# netns-sharer publishes no ports of its own (same invariant as the dankclaw
# searxng/gluetun pair). Credentials live in
# /home/core/Containers/gluetun/env inside the VM (mode 0600, never
# committed); the private key is Mac-tunnel-specific and MUST NOT be copied
# from dankclaw — one WireGuard peer key cannot serve two machines at once.
[Unit]
Description=Gluetun VPN tunnel (FrankBook-Pro podman machine)

[Container]
ContainerName=gluetun
Image=docker.io/qmcgaw/gluetun:latest
AddCapability=NET_ADMIN
AddDevice=/dev/net/tun:/dev/net/tun
Environment=VPN_SERVICE_PROVIDER=${VPN_SERVICE_PROVIDER}
Environment=VPN_TYPE=${VPN_TYPE}
Environment=WIREGUARD_PRIVATE_KEY=${WIREGUARD_PRIVATE_KEY}
Environment=WIREGUARD_ADDRESSES=${WIREGUARD_ADDRESSES}
Environment=WIREGUARD_PUBLIC_KEY=${WIREGUARD_PUBLIC_KEY}
Environment=WIREGUARD_ENDPOINT_IP=${WIREGUARD_ENDPOINT_IP}
Environment=WIREGUARD_ENDPOINT_PORT=${WIREGUARD_ENDPOINT_PORT}
Environment=WIREGUARD_ALLOWED_IPS=${WIREGUARD_ALLOWED_IPS}
Environment=WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=${WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL}
PublishPort=8080:8080
PublishPort=6881:6881
PublishPort=6881:6881/udp

[Service]
EnvironmentFile=/home/core/Containers/gluetun/env
TimeoutStartSec=900
Restart=always

[Install]
WantedBy=default.target