ansible-homelab/roles/setup_hosted_services/templates/vpn-stack.j2

---
version: "3"
services:
{% if template_vars.vpn  == "protonwire" %}
  protonwire:
    container_name: protonwire
    image: ghcr.io/tprasadtp/protonwire:7.2.0
    init: true
    restart: unless-stopped
    environment:
      # Quote this value as server name can contain '#'.
      PROTONVPN_SERVER: "{{ vpn.protonvpn_server }}"
      # Set this to 1 to show debug logs for issue forms.
      DEBUG: "1"
      # Set this to 0 to disable kill-switch.
      KILL_SWITCH: "0"

      WIREGUARD_PRIVATE_KEY: "{{ vpn.wireguard_private_key }}"
    cap_add:
      - NET_ADMIN
    # sysctl net.ipv4.conf.all.rp_filter is mandatory!
    # net.ipv6.conf.all.disable_ipv6 disables IPv6 as protonVPN does not support IPv6.
    # 'net.*' sysctls are not required on application containers,
    # as they share network stack with protonwire container.
    sysctls:
      net.ipv4.conf.all.rp_filter: 2
      net.ipv6.conf.all.disable_ipv6: 1
    volumes:
      - type: tmpfs
        target: /tmp
    ports:
      # qbittorrent
      - 15000:15000
      - 6881:6881
      - 6881:6881/udp
      # radarr
      - 7878:7878
      # sonarr
      - 8989:8989
      # jackett
      - 9117:9117
    devices:
      - /dev/net/tun
{% elif template_vars.vpn == "surfshark" %}
  surfshark:
    image: ilteoood/docker-surfshark
    container_name: surfshark
    environment:
      - SURFSHARK_USER={{ vpn.surfshark_username }}
      - SURFSHARK_PASSWORD={{ vpn.surfshark_password }}
      # must specify LAN_NETWORK otherwise you will not be able
      # to access ports which are exposed here.
      - LAN_NETWORK={{ vpn.lan_network }}
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun
    ports:
      # qbittorrent
      - 15000:15000
      - 6881:6881
      - 6881:6881/udp
      # radarr
      - 7878:7878
      # sonarr
      - 8989:8989
      # jackett
      - 9117:9117
    restart: unless-stopped
    dns:
      - 1.1.1.1
      - 8.8.8.8
{% endif %}
{% if template_vars.qbittorrent.enabled %}
  qbittorrent:
    labels:
      ie.cianhatton.backup.enabled: "true"
      ie.cianhatton.backup.schedule: "{{ backups.schedule_keys.nightly }}"
    depends_on:
      - {{ template_vars.vpn }}
    image: "{{ template_vars.qbittorrent.image }}:{{ template_vars.qbittorrent.tag }}"
    container_name: qbittorrent
    network_mode: "service:{{ template_vars.vpn }}"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/London
      - WEBUI_PORT=15000
    volumes:
      - qbittorrent_config:/config
      - {{ directories.downloads_dir }}:/downloads
    restart: unless-stopped
{% endif %}
{% if template_vars.radarr.enabled %}
  radarr:
    labels:
      ie.cianhatton.backup.enabled: "true"
      ie.cianhatton.backup.schedule: "{{ backups.schedule_keys.nightly }}"
    depends_on:
      - {{ template_vars.vpn }}
    image: "{{ template_vars.radarr.image }}:{{ template_vars.radarr.tag }}"
    container_name: radarr
    network_mode: "service:{{ template_vars.vpn }}"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/London
    volumes:
      - radarr_config:/config
      - {{ directories.movies_dir }}:/movies
      - {{ directories.downloads_dir }}:/downloads
    restart: unless-stopped
{% endif %}
{% if template_vars.sonarr.enabled %}
  sonarr:
    depends_on:
      - {{ template_vars.vpn }}
    image: "{{ template_vars.sonarr.image }}:{{ template_vars.sonarr.tag }}"
    labels:
      ie.cianhatton.backup.enabled: "true"
      ie.cianhatton.backup.schedule: "{{ backups.schedule_keys.nightly }}"
    container_name: sonarr
    network_mode: "service:{{ template_vars.vpn }}"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/London
    volumes:
      - sonarr_config:/config
      - {{ directories.tv_dir }}:/tv
      - {{ directories.downloads_dir }}:/downloads
    restart: unless-stopped
{% endif %}
{% if template_vars.jackett.enabled %}
  jackett:
    labels:
      ie.cianhatton.backup.enabled: "true"
      ie.cianhatton.backup.schedule: "{{ backups.schedule_keys.nightly }}"
    depends_on:
      - {{ template_vars.vpn }}
    image: "{{ template_vars.jackett.image }}:{{ template_vars.jackett.tag }}"
    container_name: jackett
    network_mode: "service:{{ template_vars.vpn }}"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/London
      - AUTO_UPDATE=true
    volumes:
      - jackett_config:/config
      - {{ directories.downloads_dir }}:/downloads
    restart: unless-stopped
{% endif %}
volumes:
{% if template_vars.jackett.enabled %}
  jackett_config:
{% endif %}
{% if template_vars.qbittorrent.enabled %}
  qbittorrent_config:
{% endif %}
{% if template_vars.radarr.enabled %}
  radarr_config:
{% endif %}
{% if template_vars.sonarr.enabled %}
  sonarr_config:
{% endif %}