🔒 VPNnet — WireGuard VPN + Tailscale Exit Node

Host: Homelab · Compose: Homelab/VPNnet/compose.yaml
Stack name: vpnnet

1. Overview

A Gluetun WireGuard VPN container connected to ProtonVPN (Sydney), paired with a Tailscale sidecar that advertises this exit node to the Tailscale network. Other containers can route through this stack for VPN connectivity, and Tailscale users on the network can use it as an exit node.

2. Architecture & Services

Service	Image	Port	Role
`vpn-proton-syd`	`qmcgaw/gluetun:v3.41.1`	`8391` (SS), `8891` (HTTP proxy)	WireGuard VPN client (ProtonVPN Sydney)
`tailscale-proton-sydney`	`tailscale/tailscale:v1.98.4`	—	Tailscale node advertising this VPN as an exit node

3. Networking

vpn-net — External network for containers routing traffic through this VPN.
tailscale-proton-sydney uses network_mode: container:vpn-proton-syd — it shares the VPN container's network namespace, so all Tailscale traffic exits through ProtonVPN.
Gluetun also provides:
ShadowSocks proxy on 8391
HTTP proxy on 8891

4. Persistent Storage

Container	Host Path	Description
`vpn-proton-syd`	`/docker/data/vpn/vpn-proton-syd/gluetun/`	Gluetun state and certs
`tailscale-proton-sydney`	`/docker/data/vpn/vpn-proton-syd/tailscale`	Tailscale node identity

5. Environment Variables

Variable	Service	Description
`VPN_SERVICE_PROVIDER`	`gluetun`	`protonvpn`
`VPN_TYPE`	`gluetun`	`wireguard`
`WIREGUARD_PRIVATE_KEY`	`gluetun`	ProtonVPN WireGuard private key
`SERVER_CITIES`	`gluetun`	`Sydney`
`HTTPPROXY`	`gluetun`	`on` — enables HTTP proxy
`SHADOWSOCKS`	`gluetun`	`on` — enables ShadowSocks proxy
`TS_AUTHKEY`	`tailscale`	Tailscale auth key (from `.env`)
`TS_HOSTNAME`	`tailscale`	`Proton-Sydney`
`TS_EXTRA_ARGS`	`tailscale`	`--advertise-exit-node`

6. Access & Usage

# Start
docker compose -f Homelab/VPNnet/compose.yaml up -d

# Verify VPN IP
docker exec vpn-proton-syd curl -s https://api.ipify.org

# Check Tailscale status
docker exec tailscale-proton-sydney tailscale status

To use this VPN from another container:

network_mode: container:vpn-proton-syd

7. Maintenance & Backup

# Update
docker compose -f Homelab/VPNnet/compose.yaml pull
docker compose -f Homelab/VPNnet/compose.yaml up -d

# Backup Tailscale identity
rsync -av /docker/data/vpn/vpn-proton-syd/tailscale/ /backup/vpnnet/tailscale/

[!CAUTION] WIREGUARD_PRIVATE_KEY is currently hardcoded in the compose file. Move it to .env before pushing to any remote repository.