Files

T

Frank e3eb5334cb feat: initialize serverAppConfigs with podman stacks for Dankserver and Dankclaw

- Dankserver stack: RomM, Copyparty, Calibre-Web, node-exporter
- Dankclaw stack: Gluetun VPN (SearXNG tunnel), SearXNG+Valkey, ComfyUI
  (CPU backend), OpenWebUI, Hermes, Gitea+Postgres (migrated), Caddy
  reverse proxy, Grafana+Prometheus+Loki+Alloy observability
- Caddyfiles with .local hostname convention and basicauth homepage
- bind-mount storage policy, no named volumes
- deploy.sh mirroring vllmScripts git workflow (push -> pull -> restart -> health)
- docs/ Obsidian vault: per-service docs from frank-default-small research
  subagents (promtail EOL -> Alloy; gitea SECRET_KEY preservation; ComfyUI --cpu)
- bats test suite at 6 seams — 22 tests green

2026-08-13 20:19:41 -07:00

2.1 KiB

Raw Blame History

Gluetun

Gluetun is a lightweight VPN client container. It connects to a VPN provider (WireGuard or OpenVPN) and shares that tunnel with other containers that attach to its network namespace.

Host: Dankclaw — Docs: https://github.com/qdm12/gluetun

Facts (from research, primary source)

Item	Value
Image	`qmcgaw/gluetun:latest`
Capabilities	`NET_ADMIN` required
Device	`/dev/net/tun:/dev/net/tun`
Ports published	searxng's 8081 → 8080 lives here
Healthcheck	internal on `8000` (built-in)

Required Environment

environment:
  VPN_SERVICE_PROVIDER: "${VPN_SERVICE_PROVIDER}"   # e.g. mullvad, protonvpn
  VPN_TYPE: wireguard
  WIREGUARD_PRIVATE_KEY: "${WIREGUARD_PRIVATE_KEY}" # from .env, never committed

VPN_TYPE default is openvpn; WireGuard preferred when the provider supports it.
Provider-specific variables come from the Gluetun wiki; set them in .env.

Optional DNS (from research)

Variable	Default	Purpose
`DNS_UPSTREAM_RESOLVER_TYPE`	`dot`	DNS over TLS
`DNS_UPSTREAM_RESOLVERS`	`cloudflare`	upstream DoT providers
`DNS_CACHING`	`on`	cache queries
`BLOCK_MALICIOUS`	`on`	block malicious hostnames

Warning from the wiki: do NOT set DNS_UPSTREAM_PLAIN_ADDRESSES to a LAN/bridge address — DNS queries leak out of the tunnel.

Attaching a Container

services:
  searxng:
    network_mode: "service:gluetun"
    depends_on:
      - gluetun

There is no need for depends_on for the network stack, but it orders startup cleanly.

Verify the Tunnel

podman exec gluetun curl -s ifconfig.me

The returned IP must differ from the host IP.

Gotchas

The container that holds the published port must be the one with the ports mapping (gluetun).
restart: always on gluetun so the tunnel reconnects after VPN drops.
When gluetun restarts, attached containers inherit the new network state; searxng may need a restart to re-resolve DNS.

2.1 KiB Raw Blame History