🔒 VPNnet — WireGuard VPN + Tailscale Exit Node

Host: Homelab · Compose: Homelab/VPNnet/compose.yaml
Stack name: vpnnet

1. Overview

A Gluetun WireGuard VPN container connected to ProtonVPN (Sydney), paired with a Tailscale sidecar that advertises this exit node to the Tailscale network. Other containers can route through this stack for VPN connectivity, and Tailscale users on the network can use it as an exit node.

2. Architecture & Services

Service	Image	Port	Role
`tailscale-proton-sydney`	`tailscale/tailscale:v1.102.4`	—	Tailscale node advertising this VPN as an exit node
`vpn-proton-syd`	`qmcgaw/gluetun:v3.41.3`	`8391`, `8391`, `8891`	WireGuard VPN client (ProtonVPN Sydney)

3. Networking

container:vpn-proton-syd — Shares network namespace with target container (Shares network namespace with target container (Shares network namespace with target container (Shares network namespace with target container (Shares network namespace with target container (Shares network namespace with target container (Shares network namespace with target container (—)))))))
traefik — —
vpn-net — External network for containers routing traffic through this VPN.

4. Persistent Storage

| Container | Host Path / Volume | Description | |---|---|---|| | tailscale-proton-sydney | /docker/data/vpn/vpn-proton-syd/tailscale | Tailscale node identity | | vpn-proton-syd | /docker/data/vpn/vpn-proton-syd/gluetun/ | Gluetun state and certs |

5. Environment Variables

Variable	Service	Description
`TS_AUTHKEY`	`tailscale-proton-sydney`	Tailscale auth key (from `.env`)
`TS_EXTRA_ARGS`	`tailscale-proton-sydney`	`--advertise-exit-node`
`TS_HOSTNAME`	`tailscale-proton-sydney`	`Proton-Sydney`
`TS_STATE_DIR`	`tailscale-proton-sydney`	—
`HTTPPROXY`	`vpn-proton-syd`	`on` — enables HTTP proxy
`SERVER_CITIES`	`vpn-proton-syd`	`Sydney`
`SHADOWSOCKS`	`vpn-proton-syd`	`on` — enables ShadowSocks proxy
`VPN_SERVICE_PROVIDER`	`vpn-proton-syd`	`protonvpn`
`VPN_TYPE`	`vpn-proton-syd`	`wireguard`
`WIREGUARD_PRIVATE_KEY`	`vpn-proton-syd`	ProtonVPN WireGuard private key

6. Access & Usage

# Start
docker compose -f Homelab/VPNnet/compose.yaml up -d

# Verify VPN IP
docker exec vpn-proton-syd curl -s https://api.ipify.org

# Check Tailscale status
docker exec tailscale-proton-sydney tailscale status

To use this VPN from another container:

network_mode: container:vpn-proton-syd

7. Maintenance & Backup

# Update
docker compose -f Homelab/VPNnet/compose.yaml pull
docker compose -f Homelab/VPNnet/compose.yaml up -d

# Backup Tailscale identity
rsync -av /docker/data/vpn/vpn-proton-syd/tailscale/ /backup/vpnnet/tailscale/

[!CAUTION] WIREGUARD_PRIVATE_KEY is currently hardcoded in the compose file. Move it to .env before pushing to any remote repository.