Self-host Gluetun with Unbind
Deploy Gluetun on your own servers with Unbind. Route the traffic of your other services through a VPN with a built-in HTTP proxy.
Gluetun is a VPN client with a built-in HTTP proxy. Deploy it next to your other services and send their outgoing traffic through your VPN provider.
Deploy it from the template list. It takes a minute or two.
What gets deployed
| Service | Runs |
|---|---|
| Gluetun | qmcgaw/gluetun:v3.41.3 |
Plan for at least 0.5 CPU cores and 0.25 GB of memory.
Gluetun keeps its state on a volume mounted at /gluetun. It has no domain, because only your other services talk to it.
What you fill in
| Input | Description | Default |
|---|---|---|
| VPN Provider | VPN service provider (e.g. "protonvpn"). | |
| WireGuard Private Key | WireGuard private key from your VPN provider. | |
| WireGuard Addresses | Tunnel IP(s) assigned by your provider (e.g. "10.0.0.1/32"). | |
| Storage Size | Size of the storage for Gluetun server data. | 1 GB |
After it deploys
Open the Gluetun service and copy the value of HTTP_PROXY_URL from its variables. On every service that should go through the VPN, set:
HTTP_PROXY=<the HTTP_PROXY_URL value>
HTTPS_PROXY=<the HTTP_PROXY_URL value>Better, reference the variable instead of pasting it, so the value follows Gluetun if it ever changes. Redeploy those services afterwards.
Good to know
- WireGuard only: the template asks for a WireGuard private key and address. Get both from your VPN provider. The Gluetun wiki has a page per provider, and the provider name you type must match the one used there.
- Only proxy-aware traffic is routed: most runtimes and HTTP libraries respect
HTTP_PROXYandHTTPS_PROXY, but not all do. Check from inside the service before you rely on it. - You can change the VPN settings later: the provider, key and address stay editable on the service group.