ansible-homelab/roles/setup_hosted_services/templates/vpn-stack.j2

---
version: "3"
services:
  protonwire:
    container_name: protonwire
    # Use semver tags or sha256 hashes of manifests.
    # using latest tag can lead to issues when used with
    # automatic image updaters like watchtower.
    image: ghcr.io/tprasadtp/protonwire:latest
    init: true
    restart: unless-stopped
    environment:
      # Quote this value as server name can contain '#'.
      PROTONVPN_SERVER: "nl-free-127.protonvpn.net"
      # Set this to 1 to show debug logs for issue forms.
      DEBUG: "1"
      # Set this to 0 to disable kill-switch.
      KILL_SWITCH: "0"

      WIREGUARD_PRIVATE_KEY: "{{ wireguard_private_key }}"
    # NET_ADMIN capability is mandatory!
    cap_add:
      - NET_ADMIN
    # sysctl net.ipv4.conf.all.rp_filter is mandatory!
    # net.ipv6.conf.all.disable_ipv6 disables IPv6 as protonVPN does not support IPv6.
    # 'net.*' sysctls are not required on application containers,
    # as they share network stack with protonwire container.
    sysctls:
      net.ipv4.conf.all.rp_filter: 2
      net.ipv6.conf.all.disable_ipv6: 1
    volumes:
      - type: tmpfs
        target: /tmp
    ports:
      # qbittorrent
      - 15000:15000
      - 6881:6881
      - 6881:6881/udp
      # radarr
      - 7878:7878
      # sonarr
      - 8989:8989
      # jackett
      - 9117:9117
      - 81:81
    devices:
      - /dev/net/tun

  caddy_proxy:
    image: caddy:latest
    network_mode: service:protonwire
    command: |
      caddy reverse-proxy \
          --change-host-header \
          --from :81 \
          --to https://ip.me:443

  surfshark:
    image: ilteoood/docker-surfshark
    container_name: surfshark
    environment:
      - SURFSHARK_USER={{ vpn.surfshark_username }}
      - SURFSHARK_PASSWORD={{ vpn.surfshark_password }}
      # must specify LAN_NETWORK otherwise you will not be able
      # to access ports which are exposed here.
      - LAN_NETWORK={{ vpn.lan_network }}
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun
    restart: unless-stopped
    dns:
      - 1.1.1.1
      - 8.8.8.8
{% if template_vars.qbittorrent.enabled %}
  qbittorrent:
    labels:
      ie.cianhatton.backup.enabled: "true"
      ie.cianhatton.backup.schedule: "{{ backups.schedule_keys.nightly }}"
    depends_on:
      - protonwire
    image: "{{ template_vars.qbittorrent.image }}:{{ template_vars.qbittorrent.tag }}"
    container_name: qbittorrent
    network_mode: service:protonwire
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/London
      - WEBUI_PORT=15000
    volumes:
      - qbittorrent_config:/config
      - {{ directories.downloads_dir }}:/downloads
    restart: unless-stopped
{% endif %}
{% if template_vars.radarr.enabled %}
  radarr:
    labels:
      ie.cianhatton.backup.enabled: "true"
      ie.cianhatton.backup.schedule: "{{ backups.schedule_keys.nightly }}"
    depends_on:
      - protonwire
    image: "{{ template_vars.radarr.image }}:{{ template_vars.radarr.tag }}"
    container_name: radarr
    network_mode: service:protonwire
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/London
    volumes:
      - radarr_config:/config
      - {{ directories.movies_dir }}:/movies
      - {{ directories.downloads_dir }}:/downloads
    restart: unless-stopped
{% endif %}
{% if template_vars.sonarr.enabled %}
  sonarr:
    depends_on:
      - protonwire
    image: "{{ template_vars.sonarr.image }}:{{ template_vars.sonarr.tag }}"
    labels:
      ie.cianhatton.backup.enabled: "true"
      ie.cianhatton.backup.schedule: "{{ backups.schedule_keys.nightly }}"
    container_name: sonarr
    network_mode: service:protonwire
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/London
    volumes:
      - sonarr_config:/config
      - {{ directories.tv_dir }}:/tv
      - {{ directories.downloads_dir }}:/downloads
    restart: unless-stopped
{% endif %}
{% if template_vars.jackett.enabled %}
  jackett:
    labels:
      ie.cianhatton.backup.enabled: "true"
      ie.cianhatton.backup.schedule: "{{ backups.schedule_keys.nightly }}"
    depends_on:
      - protonwire
    image: "{{ template_vars.jackett.image }}:{{ template_vars.jackett.tag }}"
    container_name: jackett
    network_mode: service:protonwire
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/London
      - AUTO_UPDATE=true
    volumes:
      - jackett_config:/config
      - {{ directories.downloads_dir }}:/downloads
    restart: unless-stopped
{% endif %}
volumes:
{% if template_vars.jackett.enabled %}
  jackett_config:
{% endif %}
{% if template_vars.qbittorrent.enabled %}
  qbittorrent_config:
{% endif %}
{% if template_vars.radarr.enabled %}
  radarr_config:
{% endif %}
{% if template_vars.sonarr.enabled %}
  sonarr_config:
{% endif %}