Note re-resolving provider endpoints and PersistentKeepalive when the tunnel sets up but healthchecks fail with DNS i/o timeouts.
Docker Compose media stack (gluetun, *arr, Jellyfin), Ternary-Bonsai AI (Open WebUI, Forgejo, optional OpenHands), and Ansible bootstrap for the SER5 Ubuntu host.