{ config, pkgs, ... }:
let
  protonvpnConfig = {
    VPN_SERVICE_PROVIDER = "protonvpn";
    VPN_PORT_FORWARDING = "on";
    VPN_PORT_FORWARDING_PROVIDER="protonvpn";
  };
  gluetunConfig = {
    SHADOWSOCKS = "on";
    HTTPPROXY = "on";
    HTTPPROXY_STEALTH = "on";

    FIREWALL_OUTBOUND_SUBNETS="10.11.0.0/24";
    DNS_UPSTREAM_RESOLVERS = "cloudflare"; 
    
    BLOCK_SURVEILLANCE="on";
    BLOCK_ADS="on";
    BLOCK_MALICIOUS="on";
  };
in
{
  virtualisation.oci-containers.containers = {
    # protonvpn
    pvpn-de-01 = {
      autoStart = true;
      image = "qmcgaw/gluetun:latest";
      capabilities = { NET_ADMIN = true; };
      devices = [ "/dev/net/tun:/dev/net/tun" ];
      environmentFiles = [
        "/etc/secrets/gluetun.env"
      ];
      environment = {
        # GLUETUN ENV VARS #
        VPN_TYPE="openvpn";
        SERVER_COUNTRIES = "Germany";
        VPN_INTERFACE="tun0";
        
      } // protonvpnConfig // gluetunConfig;
      ports = [ 
        # gluetun
        "8000:8000" 
        "7001:8388/tcp"
        "7001:8388/udp"
        "8001:8888"

        # qbittorrent
        "8080:8080"
        "6881:6881/tcp"
        "6881:6881/udp"

        # jdownloader
        "5800:5800"
      ];
    };
  };
}