Help to setup Syncthing through gluetun

[qdm12]

From @umbongodrink on #500 :

I have now been trying to get gluetun to work in conjunction with syncthing, so that my syncthing traffic goes through my PIA vpn connection. My new docker-compose.yml file is this:

version: "3.7"
services:
  gluetun:
    image: qmcgaw/gluetun:latest   
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    ports:
      - 8888:8888/tcp # HTTP proxy
      - 8388:8388/tcp # Shadowsocks
      - 8388:8388/udp # Shadowsocks
      - 8000:8000/tcp # Built-in HTTP control server

      - 8384:8384 # Syncthing Port web access
      - 22000:22000/tcp # Syncthing 
      - 22000:22000/udp # Syncthing
      - 21027:21027/udp # Syncthing
      
    volumes:
      - /home/pi/Documents/docker/gluetun/volume:/gluetun
    environment:
      - OPENVPN_USER=
      - OPENVPN_PASSWORD=
      - VPNSP=private internet access
      - REGION=Netherlands
      - PORT_FORWARDING=on
      - PORT_FORWARDING_STATUS_FILE=/gluetun/forwarded_port
      - OPENVPN_CIPHER=aes-256-gcm
      - OPENVPN_AUTH=sha256
      - TZ=Europe/London
    restart: always

  syncthing:
    image: ghcr.io/linuxserver/syncthing
    container_name: syncthing
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/London
    volumes:
      - /home/pi/Documents/docker/syncthing/config:/config
      - /home/pi/Documents/tempmovies:/data1
#      - /path/to/data2:/data2s
#    ports:
#      - 8384:8384
#      - 22000:22000/tcp
#      - 22000:22000/udp
#      - 21027:21027/udp
    restart: unless-stopped
    network_mode: "service:gluetun"

When I bring this yml up, both come up healthy.

However, when I try to reach the syncthing web UI on port 8384, I am prompted for authentication which I give, but then I am never admitted to the UI, the webpage is constantly loading (or never fully loads). Furthermore, when I try to issue a docker ps, I don't receive anything in return apart from the generic docker category headers, and my tty crashes. Any thoughts on this? (I appreciate that syncthing isn't your application and if you don't want to assist, no problem at all.:-) )

Just a question if you don't mind please? Can you recommend a docker bittorrent client that will work in conjunction with gluetun? Having done all this work I would like to take advantage of gluetun. Or should I look for a container that has a bittorrent client and vpn combined into it as an all-in-one?

[qdm12]

I have now been trying to get gluetun to work in conjunction with syncthing, so that my syncthing traffic goes through my PIA vpn connection

If you want to have Syncthing receiving data through the VPN, you need to change the Syncthing (internal) listening port 22000 to match the forwarded port you obtain from PIA. You can leave the port 8388 as it is. There is also no point publishing 22000 in the ports section with - 22000:22000/tcp since you want to access it through the VPN and not through your LAN.

Now a few things:

• PIA has been notoriously bad at port forwarding for whatever reason. I could not make it to connect to <vpn-ip>:<forwarded-port> with a server listening on the forwarded port in gluetun. The issue happened out of gluetun as well with openvpn on my host. And that issue does not happen with other VPN providers supporting port forwarding like Mullvad or Vyprvpn, so definitely a PIA problem. Maybe it works now, but you might want to try with some dumb http listening server (maybe try github.com/qdm12/port-checker).
• You will have to change the Syncthing listening port 22000 to the forwarded port every 60 days since your forwarded port becomes expired after 60 days I believe.

However, when I try to reach the syncthing web UI on port 8384, I am prompted for authentication which I give, but then I am never admitted to the UI, the webpage is constantly loading

Seems like it's crashing in a loop somehow. Check the logs with docker logs -f syncthing (stop following it with CTRL+C), maybe a permission issue 🤔 If there is no log, try to launch gluetun and syncthing with docker-compose up without the -d to have the logs as they come in. Pressing CTRL+C will stop the containers.

Just a question if you don't mind please? Can you recommend a docker bittorrent client that will work in conjunction with gluetun?

I've been using linuxserver's deluge image forever with gluetun as a connected container.

Or should I look for a container that has a bittorrent client and vpn combined into it as an all-in-one?

Actually that's a matter of Docker philosophy and VPN 😄

• The Docker philosophy states that you should run only one focused application by container. Compose containers (aka microservices) is the way ™️
• When your VPN client container crashes/restarts, the connected containers don't recover their connection because of how Docker routing works. So that is why many people (including early 2021 me) bundle multiple applications in the same container.

Now gluetun has a self healing mechanism, restarting openvpn if it crashes or doesn't work anymore without exiting the container, such that it should never restart the container, it will just show as unhealthy and try to self-heal. So now there is no point in having a VPN container with other things in there.

Gluetun already comes with some http proxy + shadowsocks proxy servers since these are coded in the same Go language as the rest of the program and add only a few Kilobytes to the image. It also comes with unbound since DNS is also a critical piece privacy/security wise, and it would be sad to miss out if you don't know.

I wouldn't add a torrent client in there, since you can just add a well known container connected through gluetun. I'm also a byte maniac, so if I can add a torrent client for 100KB extra, then sure. But right now, deluge and all weight a few hundreds MBs 😢

[umbongodrink]

Wow, lots of information here, thank you, and indeed, thank you very much for having a look at the syncthing combination with gluetun.

the issue happened out of gluetun as well with openvpn on my host. And that issue does not happen with other VPN providers supporting port forwarding like Mullvad or Vyprvpn, so definitely a PIA problem.

Thanks for trying. Could you get syncthing to successfully work then when your vpn provider was Mullvad or Vyprvpn?
If yes, would you mind sharing a sample docker-compose.yml with gluetun and syncthing successfully working? That would be most appreciated.

I would be willing to invest in another vpn provider if it it enables gluetun to be a one-stop-shop with syncthing and let's say deluge going through it.

I've been using linuxserver's deluge image forever with gluetun as a connected container.

ah great tip! Is this the one you're referring to please?
https://docs.linuxserver.io/images/docker-deluge
If it is, would you mind if I respond with a docker-compose.yml file with the ports and config going through gluetun (with you checking it)?

The Docker philosophy states that you should run only one focused application by container. Compose containers (aka microservices) is the way ™️

Yes absolutely, nicely put (or referred to).

Now gluetun has a self healing mechanism, restarting openvpn if it crashes or doesn't work anymore without exiting the container, such that it should never restart the container, it will just show as unhealthy and try to self-heal. So now there is no point in having a VPN container with other things in there.

Yes those are great advantages of gluetun. Really cool.

Gluetun already comes with some http proxy + shadowsocks proxy servers since these are coded in the same Go language as the rest of the program and add only a few Kilobytes to the image. It also comes with unbound since DNS is also a critical piece privacy/security wise, and it would be sad to miss out if you don't know.

Really great points! 🙌🏽

[qdm12]

Small notes:

• you might want to use the image syncthing/syncthing. Not that i don't trust linuxserver.io, but why not just trust the people developing syncthing directly 😉
• You can remove OPENVPN_AUTH=sha256 since it defaults to sha256 for the default strong encryption preset.
• You can remove VPNSP=private internet access since it defaults to PIA (for historical reasons though, so up to you haha)

Start from this perhaps

version: '3'

services:
  gluetun:
    image: qmcgaw/gluetun:latest   
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    ports:
      - 8112:8112/tcp # Deluge web ui
      - 8384:8384/tcp # Syncthing web ui      
    volumes:
      - /home/pi/Documents/docker/gluetun/volume:/gluetun
    environment:
      - OPENVPN_USER=
      - OPENVPN_PASSWORD=
      - VPNSP=private internet access
      - REGION=Netherlands
      - PORT_FORWARDING=on
      - PORT_FORWARDING_STATUS_FILE=/gluetun/forwarded_port
      - OPENVPN_CIPHER=aes-256-gcm
      - OPENVPN_AUTH=sha256
      - TZ=Europe/London
    restart: always

  syncthing:
    image: syncthing/syncthing:1
    container_name: syncthing
    network_mode: "service:gluetun"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/London
    volumes:
      - /home/pi/Documents/docker/syncthing/config:/config
      - /home/pi/Documents/tempmovies:/data1
    restart: unless-stopped

  deluge:
    image: linuxserver/deluge
    container_name: deluge
    network_mode: "service:gluetun"
    volumes:
      - ./deluge:/config
      - ./downloads:/downloads
    environment:
      - PUID=1000
      - PGID=1000
    restart: unless-stopped

TODOs:

• Find a way to change Syncthing listening port, no idea how to. Maybe through the web ui.
• Configure deluge to store downloads in /downloads through its web ui

[umbongodrink]

Thank you (as ever) for all of that.

I've taken out Syncthing for now based on what we discussed above, specifically relating to the forwarding port.

I've got Deluge to work with the above .yml file.

Questions:

1. in the above yml you didn't include a port to open as the inbound port for Deluge, and publish it as part of gluetun's ports, was that deliberate?
2. does the PORT_FORWARDING=on environmental option in gluetun take care of the inbound port mapping for Deluge automatically?

I'm just a bit confused as I would have thought that without explicitly mapping an inbound port in gluetun and having the deluge container use that (ie being manually set in the Deluge webUI) that Deluge would have very limited connectivity.

3. could I ask you please what vpn you use, whether Mullvad or Vyprvpn or some other?
   I'm going to try one to see if I can get the forwarded port working for Syncthing with a vpn provider other than PIA, since having it routed through gluetun would be desirable I think.

Thank you

[qdm12]

1. I only included the web ui port for Deluge. The port you can forward for Deluge is optional, and I really don't need it (being a passive node instead of active is fine to me). It apparently brings slightly faster speeds, but I never noticed the difference.
2. No it only takes care of getting the port from PIA (which is a hell lot complicated since 2021), and allow the port through the firewall on the vpn network interface. If you want Deluge to listen on the forwarded port, you would have to change the listening port in the web ui to the forwarded port (or use https://github.com/jawilson/deluge-piaportplugin which is mentioned in the Wiki somewhere as well 😄).
3. I use Mullvad. I think it's one of the most expensive though. But it works well, and I enjoyed adding them to gluetun unlike some others (cough cough vpnunlimited, cyberghost crossing my mind). Their tech stack I've seen on their Github is impressive as well (Go, Rust and Typescript) so it looks like their engineers "know their shit". PIA is not bad though, they were the first ones to be supported on gluetun, back when gluetun was even named private-internet-access-docker and was just a shell script, long time 😆 But before, have a try with qmcgaw/srv for example, assuming your PIA port is 9876 and your VPN IP is 5.6.7.8:

docker run -it --rm --network_mode="container:gluetun" -e HTTP_SERVER_ADDRESS=":9876" qmcgaw/port-checker

And then with your browser try to access http://5.6.7.8:9876 see if it works.

[umbongodrink]

Oh and I found this
https://github.com/jawilson/deluge-piaportplugin
🧐

[qdm12]

Indeed 😉 It's mentioned there: https://github.com/qdm12/gluetun/wiki/Port-forwarding#deluge