Switch qbt-config-patch from busybox/sed to python:3-alpine so we can
cleanly handle INI keys with backslashes. Now seeds both password hash
and high-throughput defaults (3000 max connections, 50 active downloads,
unlimited rate) on fresh PVC deployments. Existing configs are updated
in-place; API-applied values are preserved on restart.
LocalhostAuthEnabled=false isn't honored in this qBT version. Instead, initContainer
stamps the PBKDF2 hash for admin:adminadmin before startup so all three pods have
consistent credentials. portforward-helper and coordinator restored to cookie-based
SID auth.
Adds qbt-config-patch initContainer that sets WebUI\LocalhostAuthEnabled=false
in qBittorrent.conf before the main containers start. Prevents qBittorrent from
overwriting the setting (previously edited at runtime, lost on pod restart).
LocalhostAuthEnabled=false set in all three qbt configs. portforward-helper and
coordinator now call the API directly without auth — no more ban risk from failed
login attempts.
- portforward-helper now reads /tmp/gluetun/forwarded_port via shared emptyDir
volume instead of polling gluetun HTTP API (which returned Unauthorized)
- Main qbt: SERVER_NAMES=US-IL#1 (valid entry in gluetun server list)
- Both manifests cleaned up
- Main qbt: switch from pinned US-IL#149 (no PF) to SERVER_REGIONS=Illinois so
gluetun picks any IL server with port forwarding enabled
- Fornax workers: portforward-helper 32Mi→96Mi to stop OOMKill
US-TX#253 and US-TX#34 aren't in gluetun's built-in list. Switching to:
- Main qbt: US-IL#149 (was US-IL#267)
- Fornax TX253: US-TX#179
- Fornax TX34: US-TX#220
Private keys are per-account and work with any ProtonVPN WireGuard server.
Replaces DIY natpmpc sidecar with gluetun's built-in NAT-PMP handling for the protonvpn
provider. The natpmpc UDP response was being dropped by gluetun's firewall since conntrack
doesn't track stateless UDP from the gateway. With VPN_PORT_FORWARDING=on, gluetun handles
the NAT-PMP exchange internally and exposes the port at :8000/v1/openvpn/portforwarded.
Helper sidecar now just polls that endpoint.
Increase memory limit 32→64Mi (apk install was hitting the 32Mi ceiling).
Fix qBittorrent setPreferences call: use form-encoded json=<string> not
json body nesting.
Adds a lightweight Alpine sidecar that runs natpmpc against the ProtonVPN
NAT-PMP gateway (10.2.0.1) every 45s to maintain a forwarded port, then
updates qBittorrent's listen port via API. Without inbound port forwarding
peers can only be dialed out to, which severely limits download speeds on
a gigabit connection.
The /gluetun binary has restrictive permissions and cannot be exec'd
from a shell wrapper. The OOM fix (512Mi limit) prevents the crashes
that caused stale ip rules, so the wrapper is not needed.
- Increase memory limit 128Mi → 512Mi (DNS block list download needs ~200MB)
- Add command wrapper that cleans stale ip rules before exec'ing gluetun
so container restarts within the same pod don't fail with "file exists"
- Fix deprecated VPN_ENDPOINT_IP/PORT → WIREGUARD_ENDPOINT_IP/PORT
The protonvpn named provider rotates through P2P servers and DNS
health checks were failing on every server it tried. Switching back
to custom provider pinned to the specific US-TX#457 server/key combo
from the ProtonVPN conf file, which is confirmed to work.
This sacrifices automatic port forwarding but restores stable downloads.
Custom WireGuard mode doesn't support NAT-PMP port forwarding — peers
can't connect inbound so most torrents stall. Switching to protonvpn
provider with SERVER_FEATURES=p2p picks a port-forwarding-capable server
and VPN_PORT_FORWARDING=on handles the NAT-PMP handshake. Up command
updates qBittorrent listen port automatically when gluetun gets the port.
Will Anderson