From ce1bf4d0d229b6e76c04e848cb0bb01d76dd5d37 Mon Sep 17 00:00:00 2001 From: dtoro Date: Tue, 2 Jun 2026 22:42:46 +0200 Subject: [PATCH] docs: gluetun VPN + static IP migration (2026-06-02) --- containers/122-arriman.md | 10 ++++++++++ infrastructure/dns.md | 3 +++ 2 files changed, 13 insertions(+) diff --git a/containers/122-arriman.md b/containers/122-arriman.md index 04f9542..7ad2583 100644 --- a/containers/122-arriman.md +++ b/containers/122-arriman.md @@ -101,6 +101,16 @@ Member of [media GID 10000](../infrastructure/media-permissions.md). The LXC has ## Changelog +### 2026-06-02 — ProtonVPN added (gluetun); LXC IP set static +- Added `gluetun` container to compose as a WireGuard VPN sidecar (ProtonVPN, server AL#57, located in Tirana, Albania) +- **qbittorrent** and **sabnzbd** now use `network_mode: service:gluetun` — all traffic routes through the VPN +- Ports 8080 (qBit WebUI), 6881 tcp/udp (qBit BT), 8081 (SAB WebUI) exposed through gluetun +- gluetun config at `gluetun-config/wireguard/wg0.conf` (read-only mount) +- Healthcheck on gluetun; qBit/SAB wait for `service_healthy` before starting +- LXC IP changed from DHCP to static (`192.168.8.132`) via `pct set` + `/etc/network/interfaces` +- **After first start:** Sonarr/Radarr/Lidarr download client host needs updating from `qbittorrent` → `gluetun` (SAB similarly `sabnzbd` → `gluetun`) +- **Also fixed:** 7 other DHCP LXCs (101 jellyfin, 103 paperless, 104 gitea, 105 apps, 114 nextcloud, 118 elementsynapse, 120 mule-images, 121 caddy) set to static IPs to prevent floating on reboot. See infrastructure/dns.md. + ### 2026-04-28 — wiki entry created Initial documentation. diff --git a/infrastructure/dns.md b/infrastructure/dns.md index fd58042..1beb949 100644 --- a/infrastructure/dns.md +++ b/infrastructure/dns.md @@ -80,6 +80,9 @@ Either: ## Changelog +### 2026-06-02 — 8 LXCs moved from DHCP to static IP +All LXCs that Caddy reverse-proxies to by IP were on `ip=dhcp` and could float on reboot (arriman got a different lease mid-session and broke). Fixed via `pct set` + in-LXC `/etc/network/interfaces`. Affected: 101 jellyfin, 103 paperless, 104 gitea, 105 apps, 114 nextcloud, 118 elementsynapse, 120 mule-images, 121 caddy, 122 arriman. See [arriman changelog](../containers/122-arriman.md#changelog). + ### 2026-06-01 — dnsmasq replaced by Technitium on [dns (107)](../containers/107-dns.md); LXC 124 retired Split-horizon DNS moved off [124](../containers/124-authentik.md) to a dedicated **Technitium** LXC at **`192.168.8.2`** (zone: specific A overrides + wildcard→VPS + replicated MX/SPF/CAA). NetBird `home-lab-dns` nameserver group cut over to `192.168.8.2` (with `.180` as a now-dead fallback). dnsmasq stopped, all names verified via Technitium, **LXC 124 shut down**. **Caveat:** the [NetBird managed DNS zone](../containers/124-authentik.md) still answers most app names *directly* (bypassing the nameserver group) — three overlapping DNS sources remain; see the single-source-of-truth decision (Phase 4). **Action needed:** update router DHCP DNS from the dead `.180` → `192.168.8.2` for any plain-LAN (non-mesh) clients.