Add gluetun endpoint watcher (5-minute systemd timer)

When gluetun is unhealthy, re-dig the WireGuard peer hostname, update
wg0.conf Endpoint, recreate gluetun then qbittorrent, and verify the
VPN exit IP. Keeps torrent path alive when provider endpoints rotate.

ansible/group_vars/all.yml

@@ -186,6 +186,10 @@ ufw_lan_tcp_ports:
   - { port: 3002, comment: "Forgejo HTTP" }
   - { port: 2222, comment: "Forgejo Git SSH" }
 
+# WireGuard peer hostname for gluetun-endpoint-watch
+wireguard_endpoint_host: las-183-wg.whiskergalaxy.com
+wireguard_endpoint_port: "443"
+
 # Forgejo (self-hosted Git)
 forgejo_domain: "192.168.8.123"
 forgejo_http_port: 3002

ansible/roles/stack/tasks/main.yml

@@ -277,6 +277,38 @@
   failed_when: false
   tags: [stack]
 
+- name: Ensure gluetun-endpoint-watch.sh is executable
+  ansible.builtin.file:
+    path: "{{ stack_root }}/scripts/gluetun-endpoint-watch.sh"
+    mode: "0755"
+    owner: "{{ stack_owner }}"
+    group: "{{ stack_group }}"
+  tags: [stack, gluetun-watch]
+
+- name: Install gluetun endpoint watch systemd unit
+  ansible.builtin.template:
+    src: gluetun-endpoint-watch.service.j2
+    dest: /etc/systemd/system/gluetun-endpoint-watch.service
+    mode: "0644"
+  notify: Reload systemd
+  tags: [stack, gluetun-watch]
+
+- name: Install gluetun endpoint watch timer (every 5 minutes)
+  ansible.builtin.template:
+    src: gluetun-endpoint-watch.timer.j2
+    dest: /etc/systemd/system/gluetun-endpoint-watch.timer
+    mode: "0644"
+  notify: Reload systemd
+  tags: [stack, gluetun-watch]
+
+- name: Enable and start gluetun endpoint watch timer
+  ansible.builtin.systemd:
+    name: gluetun-endpoint-watch.timer
+    enabled: true
+    state: started
+    daemon_reload: true
+  tags: [stack, gluetun-watch]
+
 # ---------------------------------------------------------------------------
 # Persist stack across reboots
 # - Every service in docker-compose.yml uses restart: unless-stopped

ansible/roles/stack/templates/env.j2

@@ -39,3 +39,7 @@ FORGEJO_SSH_PORT={{ forgejo_ssh_port }}
 FORGEJO_DOMAIN={{ forgejo_domain }}
 FORGEJO_ROOT_URL={{ forgejo_root_url }}
 FORGEJO_DISABLE_REGISTRATION=false
+
+# WireGuard peer hostname for gluetun-endpoint-watch (re-dig when tunnel dies)
+WIREGUARD_ENDPOINT_HOST={{ wireguard_endpoint_host | default('las-183-wg.whiskergalaxy.com') }}
+WIREGUARD_ENDPOINT_PORT={{ wireguard_endpoint_port | default('443') }}

ansible/roles/stack/templates/gluetun-endpoint-watch.service.j2

@@ -0,0 +1,19 @@
+[Unit]
+Description=Watch gluetun health and refresh WireGuard endpoint if needed
+After=docker.service network-online.target
+Requires=docker.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User={{ stack_owner }}
+Group={{ stack_group }}
+WorkingDirectory={{ stack_root }}
+Environment=STACK_DIR={{ stack_root }}
+Environment=HOME=/home/{{ stack_owner }}
+# Host is set in .env (WIREGUARD_ENDPOINT_HOST); script also reads .env
+ExecStart={{ stack_root }}/scripts/gluetun-endpoint-watch.sh
+Nice=10
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/stack/templates/gluetun-endpoint-watch.timer.j2

@@ -0,0 +1,12 @@
+[Unit]
+Description=Run gluetun endpoint watch every 5 minutes
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=5min
+AccuracySec=30s
+Persistent=true
+Unit=gluetun-endpoint-watch.service
+
+[Install]
+WantedBy=timers.target