Frank
949f68e2b5
Seven units installed INSIDE the Mac VM (/home/core/.config/containers/ systemd) by a new deploy_frankbook_stack handler: gluetun (ProtonVPN WireGuard, env-file credentials, publishes qbit's 8080/6881), qbittorrent (Network=gluetun.container, verbatim /Volumes data roots, first-boot config seed with fresh machine-local WebUI password and the Finished Torrents category), and prowlarr/sonarr/radarr/lidarr/readarr (grab-only, config migrated from dankserver at provisioning, readarr pinned to amd64-1.0.980). deploy.sh routes the new target through the ssh-config alias with REMOTE_SHELL=/usr/local/bin/bash (macOS bash 3.2 lacks associative arrays); the planner learns FRANKBOOK_SERVICES and the gluetun->qbittorrent netns pairing; new seam test pins the contract.
44 lines
1.8 KiB
INI
44 lines
1.8 KiB
INI
# Quadlet unit: Gluetun VPN tunnel in FrankBook-Pro's podman machine.
|
|
#
|
|
# Install path is INSIDE the machine VM:
|
|
# /home/core/.config/containers/systemd/gluetun.container
|
|
# (installed by the frankbook-pro handler in scripts/deploy-remote.sh —
|
|
# install_quadlet targets the Linux hosts' systemctl --user, not the VM).
|
|
#
|
|
# WireGuard tunnel to ProtonVPN. qBittorrent shares this container's network
|
|
# namespace (Network=gluetun.container) so torrent egress never touches the
|
|
# residential IP. qBittorrent's WebUI and BitTorrent ports publish HERE — a
|
|
# netns-sharer publishes no ports of its own (same invariant as the dankclaw
|
|
# searxng/gluetun pair). Credentials live in
|
|
# /home/core/Containers/gluetun/env inside the VM (mode 0600, never
|
|
# committed); the private key is Mac-tunnel-specific and MUST NOT be copied
|
|
# from dankclaw — one WireGuard peer key cannot serve two machines at once.
|
|
[Unit]
|
|
Description=Gluetun VPN tunnel (FrankBook-Pro podman machine)
|
|
|
|
[Container]
|
|
ContainerName=gluetun
|
|
Image=docker.io/qmcgaw/gluetun:latest
|
|
AddCapability=NET_ADMIN
|
|
AddDevice=/dev/net/tun:/dev/net/tun
|
|
Environment=VPN_SERVICE_PROVIDER=${VPN_SERVICE_PROVIDER}
|
|
Environment=VPN_TYPE=${VPN_TYPE}
|
|
Environment=WIREGUARD_PRIVATE_KEY=${WIREGUARD_PRIVATE_KEY}
|
|
Environment=WIREGUARD_ADDRESSES=${WIREGUARD_ADDRESSES}
|
|
Environment=WIREGUARD_PUBLIC_KEY=${WIREGUARD_PUBLIC_KEY}
|
|
Environment=WIREGUARD_ENDPOINT_IP=${WIREGUARD_ENDPOINT_IP}
|
|
Environment=WIREGUARD_ENDPOINT_PORT=${WIREGUARD_ENDPOINT_PORT}
|
|
Environment=WIREGUARD_ALLOWED_IPS=${WIREGUARD_ALLOWED_IPS}
|
|
Environment=WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=${WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL}
|
|
PublishPort=8080:8080
|
|
PublishPort=6881:6881
|
|
PublishPort=6881:6881/udp
|
|
|
|
[Service]
|
|
EnvironmentFile=/home/core/Containers/gluetun/env
|
|
TimeoutStartSec=900
|
|
Restart=always
|
|
|
|
[Install]
|
|
WantedBy=default.target
|