Hey all. I set up SparkBox today, but cannot get the VPN working to complete the media downloads (I only have 8 of 15 apps running). I am not sure where I am going wrong. I have set up my WireGuard config in Proton, but it just does not seem to be liking SparkBox at the moment. Any help will be appreciated. WIll happily supply more information to get this resolved. Thanks!
6 replies
Chris wrote:
Welcome to SparkBox — a VPN that won't connect is one of the most common first-day snags, and it's fixable. The quickest way to see exactly what's wrong is to SSH into your box and run: sudo sparkbox doctor Scroll to the [VPN Tunnel] section — it checks gluetun's health and prints the actual error line from your VPN, so you're not guessing in the dark. With ProtonVPN over WireGuard, the usual culprits are WIREGUARDPRIVATEKEY being set to the server's key instead of your own client private key, or WIREGUARDADDRESSES missing its CIDR suffix (it needs to look like 10.2.0.2/32). Paste the [VPN Tunnel] output back here and we'll pin it down together. — Chris
AxolotlArcana wrote:
[VPN Tunnel] [ERROR] Gluetun is unhealthy — VPN tunnel is not established Last error(s) from gluetun: 2026-07-22T05:20:21+02:00 ERROR default route not found: in 4 route(s) Common fixes: - WIREGUARDPRIVATEKEY must be YOUR client private key (not the server PublicKey) - WIREGUARDADDRESSES needs CIDR form, e.g. 10.2.0.2/32 - SERVERCITIES must match a city in gluetun's list for your provider (leave blank to let gluetun pick) Edit: sudo nano /opt/sparkbox/.env → fix offending line → sudo sparkbox restart media
Chris wrote:
Nice work pulling the doctor output — that pinpoints it. "default route not found" means gluetun never brought the WireGuard tunnel up, so it had no route to add. With ProtonVPN that almost always traces to the values in your /opt/sparkbox/.env not matching your downloaded Proton config. Re-open your Proton WireGuard configuration file and confirm: WIREGUARDPRIVATEKEY = its PrivateKey, WIREGUARDADDRESSES = its Address in CIDR form (e.g. 10.2.0.2/32), VPNPROVIDER=protonvpn, and SERVERCOUNTRIES names a real country. No need to paste those keys here — just check them. Then run sudo sparkbox up media and re-run doctor. If it still won't come up, say so and I'll flag it to Tom.
AxolotlArcana wrote:
Checked that it was all correct, and when running sudo sparkbox up media I got the following [INFO] media: configuration changed — recreating its containers [+] up 10/11 ✔ Container sb-bazarr Started 3.8s ✔ Container sb-deunhealth Started 3.5s ✔ Container sb-jellyfin-media Started 3.8s ✔ Container sb-seerr Started 3.8s ⠴ Container sb-gluetun Starting 3.8s ✔ Container sb-flaresolverr Recreated 0.1s ✔ Container sb-prowlarr Recreated 0.1s ✔ Container sb-sonarr Recreated 0.1s ✔ Container sb-radarr Recreated 0.1s ✔ Container sb-qbittorrent Recreated 0.1s ✔ Container sb-sabnzbd Recreated 0.1s Error response from daemon: failed to set up container networking: driver failed programming external connectivity on endpoint sb-gluetun (72b3c746cca7074aed416a9e288477064844b2a1af6e6dba6c3bce0b92e758d5): failed to bind host port 0.0.0.0:8989/tcp: address already in use
Chris wrote:
Good news — this is a different, simpler issue than the config, and your VPN values look fine now. The key is that last line: it can't bind host port 8989 because the address is already in use. 8989 is Sonarr's port, and since your media apps all ride through the VPN container, gluetun publishes their ports for them — so if anything else on your Mint machine already holds 8989, gluetun can't start, and that stalls the whole stack. Usually it's a leftover container from an earlier attempt. To find what's holding it, run: sudo ss -ltnp | grep :8989 (or: docker ps -a --filter publish=8989 ). Stop or remove that, then run sudo sparkbox up media again. If 8989 is already clear and it still won't bind, paste the output and I'll flag it straight to Tom. — Chris
AxolotlArcana wrote:
Got the VPN up and running. Thank you so much for the assist! Now to set up the rest. Thanks again!