# ============================================================================
# qBittorrent + Surfshark VPN in one container - my actual compose file.
#
# This is the real file running on my Synology NAS, with private values
# masked. Every REPLACE_WITH_* needs YOUR value; everything else is exactly
# what I run, quirks included.
#
# Surfshark specifics: this uses binhex's "custom" VPN provider mode with
# Surfshark's OpenVPN config. Log in to Surfshark -> VPN -> Manual setup ->
# OpenVPN, download a .ovpn for the location you want plus your service
# credentials (these are NOT your Surfshark account login), and drop both
# into the openvpn/ subfolder of the config volume below before first start:
#
#   <your config folder>/openvpn/surfshark.ovpn
#   <your config folder>/openvpn/credentials.conf   (username on line 1,
#                                                    password on line 2)
#
# From: homelabhaven.com - Media Stack from Scratch, Part 3
# ============================================================================

services:
  qbittorrent:
    # Version pinned on purpose. VPN images break on 'latest' more than any
    # other kind of container - see the post for why.
    image: binhex/arch-qbittorrentvpn:5.2.2-1-01
    container_name: qbittorrent
    restart: unless-stopped
    environment:
      - VPN_ENABLED=yes
      - VPN_PROV=custom            # custom = the .ovpn file you dropped in
      - VPN_CLIENT=openvpn
      - VPN_OPTIONS=
      # Route exceptions so YOU can reach the web UI while everything else
      # goes through the tunnel. Mine lists three networks: the Docker bridge
      # this stack runs on, my LAN, and my Tailscale range. Yours needs at
      # least your LAN; drop the rest if they mean nothing to you.
      - LAN_NETWORK=172.18.0.0/24,REPLACE_WITH_YOUR_LAN_SUBNET,100.64.0.0/10
      - NAME_SERVERS=1.1.1.1,1.0.0.1
      - WEBUI_PORT=8085
      - PUID=REPLACE_WITH_YOUR_UID    # run `id <your user>` on the host
      - PGID=REPLACE_WITH_YOUR_GID
      - TZ=Europe/Amsterdam
    volumes:
      # Same placeholder style as the series: what /path/to/... is on your box
      # (Synology, generic Linux) is defined in Part 1. Downloads + library
      # share the one /Media mount - that's the whole hardlink story.
      - /path/to/appdata/qbittorrent:/config
      - /path/to/Media:/Media
      - /etc/localtime:/etc/localtime:ro
    ports:
      # Host port 9105 is just my port-numbering scheme - any free port works.
      # The container side must stay equal to WEBUI_PORT.
      - "9105:8085"
    devices:
      - /dev/net/tun               # the container builds the tunnel itself
    cap_add:
      - NET_ADMIN                  # and needs this to manage its own routing