Optional qBittorrent + generic Gluetun VPN integration

Read this before enabling the profile

Import-only does not use BitTorrent and does not require a VPN. The qBittorrent lane is optional and must never start implicitly.

Local torrent users should consider their local laws, content rights, tracker rules, and provider terms. Peers in a public swarm can observe the peer IP. A properly configured VPN can reduce direct IP exposure, but it is not a guarantee of anonymity or permission.

Omakase does not endorse a commercial VPN provider. Gluetun is used as a provider-neutral gateway and can follow its own supported-provider or custom WireGuard/OpenVPN configuration.

Network boundary

The reference profile gives qBittorrent:

network_mode: service:gluetun;
no independent network namespace;
no direct host ports;
one exact Omakase category;
one exact save root;
ordinary deletion disabled.

The WebUI is published through Gluetun on loopback. Omakase does not manage host routes and never silently falls back to the normal host network.

Start only after import proof

Configure Gluetun according to its official documentation and confirm the release’s legal notice. Then start the explicit profile:

bash

docker compose --env-file .env.local -f compose.local.yaml \
  --profile qbittorrent-vpn up -d

qBittorrent prints a temporary WebUI password on first start. Replace it immediately and store the chosen API credentials only in the secret environment file.

Scope of Omakase access

Omakase creates or uses one exact omakase category rooted at /downloads/omakase. It refuses matching jobs outside that category.

Deletion is off by default. Even the exceptional provider operation removes only the torrent job with local-file deletion disabled.

Doctor evidence

Run the VPN portion of Doctor from the Docker host. The application container intentionally does not receive the Docker socket.

bash

omakase plus doctor \
  --data-dir /opt/omakase/data/omakase \
  --import-root /srv/omakase/import \
  --library-root /srv/omakase/library \
  --acquisition-mode qbittorrent \
  --vpn-mode gluetun \
  --plex-url http://127.0.0.1:32400 \
  --qbittorrent-url http://127.0.0.1:8080

Doctor requires Gluetun health, /dev/net/tun, NET_ADMIN, the built-in firewall, the shared namespace, and the absence of an independent qBittorrent port binding.

For an existing externally tunneled qBittorrent instance, provide the exact interface and interface address. Doctor refuses readiness when either binding is ambiguous.