Why this Configuration?
- True Data Sovereignty: 100% GDPR-compliant on-premises deployment. You own your configuration and data without vendor lock-in.
- Hardware Agnostic: Optimized and verified across low-power ARM64 SBCs (Raspberry Pi 5) and x86_64 hypervisors (Proxmox VE LXC & VM).
- Engine Freedom: Tested and supported under standard Docker Engine and unprivileged rootless Podman.
- Platform Verification: Requires NET_ADMIN capability and /dev/net/tun device.
Quick Start (Standalone Docker Compose)
The snippet below is immediately ready to run in any standard Docker or Podman environment:
services:
gluetun:
image: "ghcr.io/qdm12/gluetun:latest"
container_name: njorddeploy-gluetun
cap_add:
- NET_ADMIN
devices:
- /dev/net/tun:/dev/net/tun
ports:
- "8000:8000/tcp" # Gluetun control server API
- "8888:8888/tcp" # HTTP proxy
- "8388:8388/tcp" # Shadowsocks TCP
- "8388:8388/udp" # Shadowsocks UDP
volumes:
- "./data/gluetun:/gluetun"
environment:
- "VPN_SERVICE_PROVIDER=custom"
- "VPN_TYPE=wireguard"
- "WIREGUARD_PRIVATE_KEY=wireguard_private_key"
- "WIREGUARD_ADDRESSES=wireguard_addresses"
- "VPN_ENDPOINT_IP=vpn_endpoint_ip"
- "VPN_ENDPOINT_PORT=51820"
- "TZ=Etc/UTC"
- "PUID=1000"
- "PGID=1000"
user: "0:0"
networks:
- njorddeploy_net
networks:
njorddeploy_net:
Start the service directly via the command line: docker compose up -d
Configuration & Environment Variables
Key configuration parameters and defaults derived from the NjordDeploy component template:
| Variable | Default Value | Description |
|---|---|---|
GLUETUN_CONTROL_PORT |
8000 |
The port for Gluetun's internal control server API. |
GLUETUN_HTTP_PROXY_PORT |
8888 |
The port for the built-in HTTP proxy server. |
GLUETUN_SHADOWSOCKS_PORT |
8388 |
The port for the built-in Shadowsocks proxy server (TCP and UDP). |
VPN_SERVICE_PROVIDER |
custom |
Your VPN service provider (e.g., ivpn, nordvpn, private internet access, custom). |
VPN_TYPE |
wireguard |
The VPN protocol type (e.g., openvpn, wireguard). |
WIREGUARD_PRIVATE_KEY |
*None* |
Your Wireguard private key, if using Wireguard. |
WIREGUARD_ADDRESSES |
*None* |
Your Wireguard IP addresses (e.g., 172.16.0.1/32), if using Wireguard. |
VPN_ENDPOINT_IP |
*None* |
The IP address of your VPN server endpoint. Required for 'custom' provider. |
VPN_ENDPOINT_PORT |
51820 |
The port of your VPN server endpoint. Required for 'custom' provider. |
TZ |
Etc/UTC |
Container timezone (e.g., Europe/London, America/New_York). |
PUID |
1000 |
User ID for permissions. Set to 0 for root if experiencing permission issues. |
PGID |
1000 |
Group ID for permissions. Set to 0 for root if experiencing permission issues. |
Ecosystem & Enterprise Integration
- Reverse Proxy Ingress Ready: Pre-configured for Caddy, Traefik, or Nginx Proxy Manager with automatic Let's Encrypt TLS certificates.
- Zero-Trust Mesh VPN: Seamless integration with WireGuard or Tailscale/Headscale mesh networks for secure remote administration.
- Transactional State Backups: Ready for point-in-time database dumps and container-safe persistent volume freezing.
Effortless Management with NjordDeploy
Deploy, monitor, and update this service with a single click on your own hardware via the NjordDeploy Configurator.