From 9cd3dd0134cc60964afb2fc7dec683273bfcd633 Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Sat, 11 Apr 2026 04:09:29 -0500
Subject: [PATCH] gluetun: switch to protonvpn provider with port forwarding
 enabled
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Custom WireGuard mode doesn't support NAT-PMP port forwarding — peers
can't connect inbound so most torrents stall. Switching to protonvpn
provider with SERVER_FEATURES=p2p picks a port-forwarding-capable server
and VPN_PORT_FORWARDING=on handles the NAT-PMP handshake. Up command
updates qBittorrent listen port automatically when gluetun gets the port.
---
 .../legion/k8s/media/gluetun-qbittorrent.yaml | 23 +++++++++++--------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/servers/legion/k8s/media/gluetun-qbittorrent.yaml b/servers/legion/k8s/media/gluetun-qbittorrent.yaml
index 20fc722..f95ff69 100644
--- a/servers/legion/k8s/media/gluetun-qbittorrent.yaml
+++ b/servers/legion/k8s/media/gluetun-qbittorrent.yaml
@@ -35,7 +35,7 @@ spec:
               add: ["NET_ADMIN"]
           env:
             - name: VPN_SERVICE_PROVIDER
-              value: "custom"
+              value: "protonvpn"
             - name: VPN_TYPE
               value: "wireguard"
             - name: WIREGUARD_PRIVATE_KEY
@@ -43,19 +43,22 @@ spec:
                 secretKeyRef:
                   name: media-secrets
                   key: PROTONVPN_PRIVATE_KEY
-            - name: WIREGUARD_PUBLIC_KEY
-              value: "mngiSxBpH7GU24nnWdBEcnhDnCPn2jq5+ZP3zwPwISA="
-            - name: WIREGUARD_ADDRESSES
-              value: "10.2.0.2/32"
-            - name: VPN_ENDPOINT_IP
-              value: "95.173.217.29"
-            - name: VPN_ENDPOINT_PORT
-              value: "51820"
+            # Pick a US P2P server — P2P servers support port forwarding
+            - name: SERVER_COUNTRIES
+              value: "United States"
+            - name: SERVER_FEATURES
+              value: "p2p"
+            # Port forwarding via NAT-PMP — lets peers connect inbound, fixes slow/stalled downloads
+            - name: VPN_PORT_FORWARDING
+              value: "on"
+            # When gluetun gets a forwarded port, tell qBittorrent to listen on it
+            - name: VPN_PORT_FORWARDING_UP_COMMAND
+              value: "/bin/sh -c 'curl -s -c /tmp/pf.jar -X POST http://localhost:8080/api/v2/auth/login -d username=admin&password=adminadmin >/dev/null && curl -s -b /tmp/pf.jar -X POST http://localhost:8080/api/v2/app/setPreferences -d \"json={\\\"listen_port\\\":{{FORWARDED_PORT}}}\"'"
             # Allow cluster-internal traffic to bypass VPN (for Radarr/Sonarr → qBittorrent API)
             - name: FIREWALL_OUTBOUND_SUBNETS
               value: "10.42.0.0/16,10.43.0.0/16"
             - name: UPDATER_PERIOD
-              value: "0"
+              value: "24h"
           ports:
             - containerPort: 8888  # gluetun HTTP proxy (unused but required)
           resources: