From 28a108a1d8b406320a9a67142bf5823bc167860c Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Sat, 11 Apr 2026 04:24:35 -0500
Subject: [PATCH] fix(gluetun): pin to US-TX#457 server to restore downloads

The protonvpn named provider rotates through P2P servers and DNS
health checks were failing on every server it tried. Switching back
to custom provider pinned to the specific US-TX#457 server/key combo
from the ProtonVPN conf file, which is confirmed to work.

This sacrifices automatic port forwarding but restores stable downloads.
---
 .../legion/k8s/media/gluetun-qbittorrent.yaml | 25 ++++++++-----------
 1 file changed, 11 insertions(+), 14 deletions(-)

diff --git a/servers/legion/k8s/media/gluetun-qbittorrent.yaml b/servers/legion/k8s/media/gluetun-qbittorrent.yaml
index 5e87c93..8c41b2d 100644
--- a/servers/legion/k8s/media/gluetun-qbittorrent.yaml
+++ b/servers/legion/k8s/media/gluetun-qbittorrent.yaml
@@ -34,8 +34,9 @@ spec:
             capabilities:
               add: ["NET_ADMIN"]
           env:
+            # Use custom provider pinned to US-TX#457 — this specific server+key combo is confirmed working
             - name: VPN_SERVICE_PROVIDER
-              value: "protonvpn"
+              value: "custom"
             - name: VPN_TYPE
               value: "wireguard"
             - name: WIREGUARD_PRIVATE_KEY
@@ -43,22 +44,18 @@ spec:
                 secretKeyRef:
                   name: media-secrets
                   key: PROTONVPN_PRIVATE_KEY
-            # Pick a US P2P server — P2P servers support port forwarding
-            - name: SERVER_COUNTRIES
-              value: "United States"
-            - name: SERVER_FEATURES
-              value: "p2p"
-            # Port forwarding via NAT-PMP — lets peers connect inbound, fixes slow/stalled downloads
-            - name: VPN_PORT_FORWARDING
-              value: "on"
-            # When gluetun gets a forwarded port, tell qBittorrent to listen on it
-            - name: VPN_PORT_FORWARDING_UP_COMMAND
-              value: "/bin/sh -c 'curl -s -c /tmp/pf.jar -X POST http://localhost:8080/api/v2/auth/login -d username=admin&password=adminadmin >/dev/null && curl -s -b /tmp/pf.jar -X POST http://localhost:8080/api/v2/app/setPreferences -d \"json={\\\"listen_port\\\":{{FORWARDED_PORT}}}\"'"
+            # US-TX#457 server — generated from ProtonVPN portal with NAT-PMP=on
+            - name: WIREGUARD_PUBLIC_KEY
+              value: "ZLiSI0SkdK5O0/fhweOpZ2c78F30gWHtsfZcVV0vlj8="
+            - name: WIREGUARD_ADDRESSES
+              value: "10.2.0.2/32"
+            - name: VPN_ENDPOINT_IP
+              value: "95.173.217.219"
+            - name: VPN_ENDPOINT_PORT
+              value: "51820"
             # Allow cluster-internal traffic to bypass VPN (for Radarr/Sonarr → qBittorrent API)
             - name: FIREWALL_OUTBOUND_SUBNETS
               value: "10.42.0.0/16,10.43.0.0/16"
-            - name: UPDATER_PERIOD
-              value: "24h"
           ports:
             - containerPort: 8888  # gluetun HTTP proxy (unused but required)
           resources: