• 0 Posts
  • 59 Comments
Joined 2 years ago
cake
Cake day: June 23rd, 2024

help-circle
  • This is my setup

    sabnzbd:
        ...
        restart: unless-stopped
        network_mode: "service:gluetun"
    
      gluetun:
        image: qmcgaw/gluetun
        container_name: gluetun
        cap_add:
          - NET_ADMIN
        environment:
          - VPN_SERVICE_PROVIDER=custom
          - VPN_TYPE=wireguard
        devices:
          - /dev/net/tun:/dev/net/tun
        ports:
          - 9090:8080 # SABnzbd webui port forwarding
        volumes:
          - ./Wireguard/wg0.conf:/gluetun/wireguard/wg0.conf:ro
        restart: unless-stopped
    

    Note how i explicitly tell sabnzbd container to use gluetun as a network.

    Afaik, with your setup you simply run both containers in the same network so that both can reach each other.




  • You could maybe try using the wg0.conf and mount this insteas. Here is how I set it up (works with proton and windscribe)

    gluetun:
        image: qmcgaw/gluetun
        container_name: gluetun
        cap_add:
          - NET_ADMIN
        environment:
          - VPN_SERVICE_PROVIDER=custom
          - VPN_TYPE=wireguard
        devices:
          - /dev/net/tun:/dev/net/tun
        ports:
          - 9090:8080 # SABnzbd webui port forwarding
        volumes:
          - ./Wireguard/wg0.conf:/gluetun/wireguard/wg0.conf:ro
        restart: unless-stopped
    












  • I get you and I know that there can be security issues (especially in Jellyfin) that might give you access. This is the reason I only mount the media and config folders, and nothing else into the docker container. The media folders are mounted as read only and don’t contain sensitive information. For the config folder I created a separate user. Plus I block non-German IP addresses which already blocks quite some bots. If your friends have fixed IP addresses you could also just whitelist them and block everything else.

    You could also probably sniff the network and define more strict rules on ‘allowed’ requests in fail2ban but this is bridle because requests might change with different versions.