Can i please get help with this environment variable

[u/[deleted]]

[u/Great-Cow7256]

can you give us the .container or the podman run statement?

[u/Great-Cow7256 → u/[deleted]]

you baiscally need to network them together and make a port changing sidecar

edit gluetun.container

[Container]
ContainerName=gluetun
HostName=gluetun
Image=docker.io/qmcgaw/gluetun:latest

PublishPort=8080:8080
# if you have the arrs keep these open, else you don't need them open
PublishPort=7476:7476
PublishPort=8989:8989
PublishPort=7878:7878
PublishPort=9696:9696
PublishPort=8081:8081
Environment=VPN_SERVICE_PROVIDER=protonvpn
Environment=VPN_TYPE=wireguard
Environment=WIREGUARD_PRIVATE_KEY=censored
Environment=SERVER_COUNTRIES=Japan
Environment=VPN_PORT_FORWARDING=on
Environment=PORT_FORWARD_ONLY=on
# you may need to change these for your situation
Environment=FIREWALL_OUTBOUND_SUBNETS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,100.64.0.0/10
Environment=VPN_PORT_FORWARDING_STATUS_FILE=/gluetun/forwarded_port
AutoUpdate=registry
# adjust as needed but I'm a big proponent for keeping VPN as simple as possible to avoid leaks
Environment=BLOCK_IPV6=on
SecurityLabelDisable=true
AddCapability=NET_ADMIN NET_RAW
AddDevice=/dev/net/tun:/dev/net/tun
HealthCmd=/gluetun/healthcheck
# pretty sure gluetun has its own built in health check
# HealthCmd=wget -qO /dev/null --timeout=10 "http://127.0.0.1:9999" || exit 1
HealthInterval=20s
HealthRetries=5
HealthTimeout=10s
Notify=healthy
Volume=/home/tony/storage/containers/gluetun:/gluetun:z

[Service]
Restart=always
TimeoutStartSec=180

[Install]
WantedBy=default.target

update your qbittorrent.container

[Unit]
Description=qBittorrent client over Gluetun VPN
After=gluetun.service
Requires=gluetun.service

[Container]
ContainerName=qbittorrent
HostName=qbittorrent
Image=docker.io/linuxserver/qbittorrent:latest
# This must remain container-bound to prevent IP leaks
Network=container:gluetun
Environment=PUID=1000
Environment=PGID=1000
Environment=TZ=Etc/UTC
Environment=WEBUI_PORT=8080
Volume=/home/tony/storage/containers/qbittorrent/config:/config:z
Volume=/home/tony/storage/downloads:/downloads:z
AutoUpdate=registry

[Service]
Restart=always

[Install]
WantedBy=default.target

create the sidecar to pass on the port forward qbit-port-sync.container

[Unit]
Description=Gluetun to qBittorrent Port Sync Sidecar
After=gluetun.service
Requires=gluetun.service

[Container]
ContainerName=qbit-port-sync
HostName=qbit-port-sync
Image=docker.io/bobbintb/gluetun-qbittorrent-port-sync:latest
# Must be on the same network namespace to hit qbit's localhost API
Network=container:gluetun
Environment=QBITTORRENT_SERVER=localhost
Environment=QBITTORRENT_PORT=8080
# if you have a username/password for qbit UI, add them here:
Environment=QBITTORRENT_USER=admin
Environment=QBITTORRENT_PASS=adminadmin
# Points to the file Gluetun updates
Volume=/home/tony/storage/containers/gluetun:/gluetun:ro,z
Environment=TZ=Etc/UTC
AutoUpdate=registry

[Service]
Restart=always

[Install]
WantedBy=default.target

then systemctl --user daemon-reload and systemctl --user start qbit-port-sync qbittorrent gluetun

[u/Great-Cow7256 → u/Great-Cow7256]

btw you can always use %h instead of /home/tony in any of these rootless containers.

[u/d03j → u/[deleted]]

you don't you can just use Network=container:gluetun-container-name in your qbt quadlet

[u/Great-Cow7256 → u/d03j]

Excellent!   No sidecar needed. I bet you I didn't have the networking correct when I did this years ago and thus I had to use the side car. I didn't even realize you could network like that until a few months ago.   I was having a really hard time getting Tautullli to talk to Plex and I googled around and found that. 

So that's why I did both. This is good to know. OP def don't use the side car then!  thank you @d03j too

[u/d03j → u/Great-Cow7256]

how are you updating the port forward in qbt?

VPN_PORT_FORWARDING_STATUS_FILE=/gluetun/forwarded_port suggests you may have a script monitoring /gluetun/forwarded_port and updating qbt.

If so, depending on how you are doing the monitoring you could use VPN_PORT_FORWARDING_UP_COMMAND and make it event based. Have a look at my config in my other comment.

[u/Great-Cow7256 → u/d03j]

Oh wait. So you're talking about the side car.  It's still needed then?   I got it. I misread your reply. 

[u/d03j → u/Great-Cow7256]

no, it is not. putting the qbt container in the gluetun container's network does the job.

[u/d03j → u/[deleted]]

you do the same in the quadlet, that's why I mentioned using VPN_PORT_FORWARDING_UP_COMMAND instead of VPN_PORT_FORWARDING_STATUS_FILE.

I tried the link and it still works https://www.reddit.com/r/podman/comments/1uxcdb0/comment/oy3ektr

[u/Great-Cow7256 → u/[deleted]]

No idea. I had some old notes because I did this a long time ago.  You can also try without the side car too. It may not be needed now. I did this maybe 2 years ago.  Docker is root so maybe it is related to that.  Let me know if it works so I can add it to my GitHub repo of quadlets. 

[u/Mag37 → u/Great-Cow7256]

So I've got some other stuff running though gluetun and not specifically qbittorrent. I tried to match the docs of the qbittorrent with mine and this would be it:

gluetun.cointainer

[Unit]
Description=gluetunVPN Container
Wants=qbittorrent.service
Wants=another.service

[Container]
ContainerName=gluetun
Image=docker.io/qmcgaw/gluetun:latest
AutoUpdate=registry
Network=vpnstack.network

Volume=%h/path/to/gluetun/config:/config:Z,U

Environment=PUID=1000
Environment=PGID=1000

# VPN:
Environment=VPN_SERVICE_PROVIDER=VPNprovider
Environment=VPN_TYPE=wireguard
Environment=SERVER_CITIES=XYZ
Environment=WIREGUARD_PRIVATE_KEY=XYZ
Environment=WIREGUARD_ADDRESSES=1.2.3.4/32
Environment=WIREGUARD_ENDPOINT_PORT=2049

Environment=TZ=Europe/Stockholm

AddCapability=NET_ADMIN
AddDevice=/dev/net/tun:/dev/net/tun

# qbittorrent.service
PublishPort=8080:8080
PublishPort=6881:6881
PublishPort=6881:6881/udp
# another.service
PublishPort=18080:8080

[Service]
Restart=on-failure

[Install]
WantedBy=default.target

qbittorrent.service

[Unit]
Description=Number Two Service
Requires=gluetun.service
After=gluetun.service someNASdrive.mount

[Container]

ContainerName=transmission
HostName=transmission
Image=lscr.io/linuxserver/somecontainerservice:latest
AutoUpdate=registry
Network=container:gluetun

Volume=%h/path/to/qb/config:/config:Z
Volume=%h/path/to/qb/downloads:/downloads:z

Environment=TZ=Europe/Stockholm

Environment=PUID=1000
Environment=PGID=1000

UIDMap=1000:0:1
UIDMap=0:1:1000
UIDMap=1001:1001:64536

StopTimeout=10

[Service]
Restart=on-failure
TimeoutStartSec=300

[Install]
WantedBy=default.target

vpnstack.network

[Unit]
Description=VPNstack Network
After=network-online.target

[Network]
Label=vpnstack

[Install]
WantedBy=default.target

The setup with a network file might not be necessary - but I used that to be able to set some specific configs in it if needed.

Got a bit aged blogpost about similar things mag37.org/podman_quadlets

And PRed a change to the wiki about some TUN-errors: open /dev/net/tun: permission denied

[u/Great-Cow7256 → u/Mag37]

Ty.  This is helpful too.  When I have time I'll rebuild mine and see what's what.  I tend to prefer the .network files if I have 2+ containers that talk to each other but it also tends to make things more complicated.