docker-compose.example.yml

---
# Example Docker Compose stack showing vpn-rebind as a drop-in control-plane
# sidecar alongside Gluetun and a set of VPN-dependent services.
#
# Key points:
#  • vpn-rebind needs read-write access to the Docker socket to stop, remove,
#    and recreate dependent containers when the VPN provider restarts.
#  • group_add: "999" grants docker socket access without running as root.
#    Verify your docker group GID with: getent group docker
#  • The config file is mounted from ./vpn-rebind/config.yaml (or omit it
#    entirely and use the VPN_REBIND_* environment variables shown below).
#  • Dependent services set  network_mode: "container:gluetun"  so all their
#    traffic is routed through Gluetun's network namespace.
#  • Label  vpn.provider=gluetun  opts a service into automatic label-based
#    discovery (in addition to the explicit list in the config file).

services:

  # ── VPN provider ───────────────────────────────────────────────────────────
  gluetun:
    image: qmcgaw/gluetun:latest
    container_name: gluetun          # Must match config.yaml provider value.
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    environment:
      - VPN_SERVICE_PROVIDER=mullvad
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=${WIREGUARD_PRIVATE_KEY}
      - SERVER_CITIES=Amsterdam
    ports:
      # Expose ports here — NOT on the dependent containers.
      - "8080:8080"   # qBittorrent web UI
      - "9696:9696"   # Prowlarr
    restart: unless-stopped

  # ── vpn-rebind control plane ───────────────────────────────────────────────
  vpn-rebind:
    image: ghcr.io/darkiris4/vpn-rebind:latest
    container_name: vpn-rebind
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./vpn-rebind:/config:ro          # Mount config directory (optional).
    group_add:
      - "999"                            # docker group GID — check with: getent group docker
    environment:
      - VPN_REBIND_LOG_LEVEL=info
      # Uncomment to use env-only config (no file needed):
      # - VPN_REBIND_PROVIDER=gluetun
      # - VPN_REBIND_LABEL_SELECTOR=vpn.required=true,vpn.provider=gluetun
      # - VPN_REBIND_DELAY=5s
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    depends_on:
      - gluetun

  # ── VPN-dependent services ─────────────────────────────────────────────────
  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    network_mode: "container:gluetun"   # Share Gluetun's network namespace.
    environment:
      - PUID=1000
      - PGID=1000
      - WEBUI_PORT=8080
    volumes:
      - ./qbittorrent/config:/config
      - ./downloads:/downloads
    restart: unless-stopped
    labels:
      vpn.required: "true"              # Opt in to label-based discovery.
      vpn.provider: gluetun
    depends_on:
      - gluetun

  prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
    network_mode: "container:gluetun"
    environment:
      - PUID=1000
      - PGID=1000
    volumes:
      - ./prowlarr/config:/config
    restart: unless-stopped
    labels:
      vpn.required: "true"
      vpn.provider: gluetun
    depends_on:
      - gluetun