version: "3.7"
services:
  gluetun:
    image: qmcgaw/private-internet-access
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    network_mode: bridge
    ports:
      - 8888:8888/tcp # Tinyproxy
      - 8388:8388/tcp # Shadowsocks
      - 8388:8388/udp # Shadowsocks
      - 8000:8000/tcp # Built-in HTTP control server
    # command:
    environment:
      # More variables are available, see the readme table
      - VPNSP=private internet access
      - PROTOCOL=udp
      - OPENVPN_VERBOSITY=1
      - OPENVPN_ROOT=no
      - OPENVPN_TARGET_IP=
      - TZ=

      # PIA, Windscribe, Surfshark and Cyberghost only
      - REGION=Austria
      - USER=js89ds7
      - PASSWORD=8fd9s239G

      # PIA only
      - PIA_ENCRYPTION=strong
      - PORT_FORWARDING=off

      # Mullvad only
      - COUNTRY=Sweden
      - CITY=
      - ISP=

      # Mullvad and Windscribe only
      - PORT=

      # Cyberghost only
      - CYBERGHOST_GROUP=Premium UDP Europe
      - CLIENT_KEY=

      # DNS over TLS
      - DOT=on
      - DOT_PROVIDERS=cloudflare
      - DOT_IPV6=off
      - DOT_VERBOSITY=1
      - BLOCK_MALICIOUS=on
      - BLOCK_SURVEILLANCE=off
      - BLOCK_ADS=off
      - UNBLOCK=
      - DNS_UPDATE_PERIOD=24h
      # Firewall
      - EXTRA_SUBNETS=
      # Shadowsocks
      - SHADOWSOCKS=off
      - SHADOWSOCKS_PASSWORD=
      # Tinyproxy
      - TINYPROXY=off
      - TINYPROXY_USER=
      - TINYPROXY_PASSWORD=
    restart: always