vpn docker setup

---
networks:
  caddy:
    external: true

services:
  vpn1:
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
  # Mounting the tun device may be necessary for userspace implementations
    devices:
      - /dev/net/tun:/dev/net/tun
    container_name: vpn1
    environment:
      - LOC=us_seattle,ca_vancouver,france,sweden,austria,italy,belgium
      - USER=$OPENVPN_USERNAME
      - PASS=$OPENVPN_PASSWORD
      - LOCAL_NETWORK=192.168.7.0/24
      - FIREWALL=0
      - KEEPALIVE=25
      - PORT_FORWARDING=0
#      - PORT_FILE=/pia-shared/port.dat
#      - PORT_PERSIST=1
#      - PORT_FATAL=1
      - EXIT_ON_FATAL=1
      - WG_USERSPACE=1
    healthcheck:
      test: ping -c 1 www.google.com || exit 1
      interval: 30s
      timeout: 10s
      retries: 3
    image: thrnz/docker-wireguard-pia
    labels:
      caddy_0: "transvideo.$DOMAIN"
      caddy_0.reverse_proxy: "{{upstreams 9091}}"
      caddy_1: "qbit.$DOMAIN"
      caddy_1.reverse_proxy: "{{upstreams 8890}}"
#      caddy_2: "slskd.$DOMAIN"
#      caddy_2.reverse_proxy: "{{upstreams 5030}}"
#      [email protected]_header: Connection *Upgrade*
#      [email protected]_header: Upgrade websocket
      com.centurylinklabs.watchtower.enable: "true"
    networks:
      - caddy
    ports:
      - 9091:9091
      - 51413:51413
      - 51413:51413/udp
      - 8890:8890
      - 6881:6881
      - 6881:6881/udp
#      - 5030:5030
#      - 5031:5031
#      - 50300:50300
    privileged: true
    restart: unless-stopped
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv6.conf.default.disable_ipv6=1
      - net.ipv6.conf.all.disable_ipv6=1
      - net.ipv6.conf.lo.disable_ipv6=1
    volumes:
      - "$DOCKERDIR/pia1:/pia"
      - "$DOCKERDIR/pia1/pia-shared:/pia-shared"
  transvideo:
    container_name: transvideo
    depends_on:
      - vpn1
    environment:
      - PUID=$PUID
      - PGID=$PGID
      - TZ=$TZ
      - DOCKER_MODS=linuxserver/mods:transmission-floodui|linuxserver/mods:transmission-env-var-settings
      - TRANSMISSION_RPC_USERNAME=$TRANSMISSION_RPC_USERNAME
      - TRANSMISSION_RPC_PASSWORD=$TRANSMISSION_RPC_PASSWORD
      - TRANSMISSION_RPC_AUTHENTICATION_REQUIRED=true
      - TRANSMISSION_INCOMPLETE_DIR=/data/torrents/incomplete
      - TRANSMISSION_DOWNLOAD_DIR=/data/torrents
      - TRANSMISSION_PEER_LIMIT_GLOBAL=3000
      - TRANSMISSION_PEER_LIMIT_PER_TORRENT=2000
      - TRANSMISSION_DOWNLOAD_QUEUE_ENABLED=true
      - TRANSMISSION_DOWNLOAD_QUEUE_SIZE=30
      - TRANSMISSION_RATIO_LIMIT=0
      - TRANSMISSION_RATIO_LIMIT_ENABLED=true
      - TRANSMISSION_WEB_HOME=9091
    image: lscr.io/linuxserver/transmission:latest
    labels:
      com.centurylinklabs.watchtower.enable: "true"
    network_mode: "service:vpn1"
#    ports:
#      - 9091:9091
    restart: unless-stopped
    volumes:
      - $DOCKERDIR/transvideo/data:/config
      - $DOWNLOADS:/data/torrents
  qbittorrent:
    container_name: qbittorrent
    depends_on:
      - vpn1
    environment:
      TZ: $TZ
      PUID: $PUID
      PGID: $PGID
      DOCKER_MODS: ghcr.io/gabe565/linuxserver-mod-vuetorrent
      WEBUI_PORT: "8890"
    image: lscr.io/linuxserver/qbittorrent:latest
    labels:
      com.centurylinklabs.watchtower.enable: "true"
    network_mode: "service:vpn1"
#    ports:
#      - 8890:8890
#      - 6881:6881
#      - 6881:6881/udp
    restart: unless-stopped
    volumes:
      - $DOCKERDIR/qbit/config:/config
      - $DOWNLOADS/music:/data/torrents/music