From 1a31ff67085f2dfe48ac23d5f0af38580aab761b Mon Sep 17 00:00:00 2001
From: Tom Kendrick <tom@tkendrick.com>
Date: Sun, 18 Jan 2026 15:49:34 +0000
Subject: [PATCH] feat: whitelist traefik subnet

---
 media/arrstack/docker-compose.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/media/arrstack/docker-compose.yml b/media/arrstack/docker-compose.yml
index e5c3a38..75c3f5a 100644
--- a/media/arrstack/docker-compose.yml
+++ b/media/arrstack/docker-compose.yml
@@ -10,6 +10,7 @@ services:
       - /dev/net/tun:/dev/net/tun
     environment:
       - DNS_ADDRESS=8.8.8.8
+      - FIREWALL_OUTBOUND_SUBNETS=172.29.0.0/16
       - VPN_SERVICE_PROVIDER=protonvpn
       - VPN_TYPE=wireguard
       - WIREGUARD_PRIVATE_KEY=${PROTONVPN_WIREGUARD_PRIVATE_KEY}