09 Tunnel

qBittorrent only exists inside Windscribe.

Paid Windscribe, WireGuard preferred. Gluetun holds the tunnel and the kill switch. qBittorrent uses that network and publishes nothing of its own. Credentials stay in this browser. They are not sent anywhere unless you probe the qBittorrent address you typed.

Windscribe · wireguardKill switch armedqBit not answering

Windscribe

In the Windscribe app, generate a WireGuard profile for the location you want. Paste it here so the blueprint matches. This page cannot open the tunnel by itself — the stack on your machine does that.

Location labelWireGuard private keyWireGuard addressPreshared keyWebUI port published by GluetunKill switch stays armed if the tunnel drops

qBittorrent

Reach the WebUI through Gluetun, for example the port NPMplus already forwards, or the LAN address of the host. Do not publish 6881 on the host.

What the arrs should use

Download client host is the Gluetun container name, not a public IP. Username and password are the WebUI ones. Category per arr if you like them separated on disk.

Env checklist — secrets left blank on purpose

TZ=America/New_York
WINDSCRIBE_WIREGUARD_PRIVATE_KEY=
WINDSCRIBE_WIREGUARD_PRESHARED_KEY=
WINDSCRIBE_WIREGUARD_ADDRESSES=
WINDSCRIBE_USER=
WINDSCRIBE_PASSWORD=

# VPN type: wireguard. No country filter. Windscribe picks the server.
# host gluetun   port 8080
# Do not give qBittorrent a published port of its own.
# NPMplus is nginx.watchmyemby.media. server1 and jserver stay off Gluetun.
# Paste this stack into Portainer at port.watchmyemby.media.
# No seeding: qBittorrent pauses at completion. Sonarr or Radarr copies, then removes the torrent.