Deployed 783c8ae with MkDocs version: 1.6.1

2026-11-13 12:35:05 +00:00 · 2026-09-23 19:24:51 +00:00
parent 01132494ca
commit aa857c835a
10 changed files with 546 additions and 131 deletions
@@ -3217,7 +3217,7 @@
 <td>string</td>
 <td>no</td>
 <td><code>null</code></td>
-<td>Full proxy URI, or a country code when the API key has <code>server_proxy</code>.</td>
+<td>Full proxy URI, a Control D resolver as <code>controld://&lt;resolver&gt;@dns.controld.com</code>, or a country code when the API key has <code>server_proxy</code>.</td>
 </tr>
 <tr>
 <td><code>no_proxy</code></td>
@@ -3332,7 +3332,7 @@
 <td><code>proxy</code></td>
 <td>string</td>
 <td>no</td>
-<td>Full proxy URI, or a country code when the API key has <code>server_proxy</code>.</td>
+<td>Full proxy URI, a Control D resolver as <code>controld://&lt;resolver&gt;@dns.controld.com</code>, or a country code when the API key has <code>server_proxy</code>.</td>
 </tr>
 <tr>
 <td><code>no_proxy</code></td>
@@ -3883,7 +3883,7 @@ ignore it safely. See <a href="../../creating-a-service/#split-episodes">Split e
 <td><code>proxy</code> / <code>no_proxy</code> / <code>no_proxy_download</code> / <code>proxy_download</code></td>
 <td>string / bool / bool / string</td>
 <td><code>null</code> / <code>false</code> / <code>false</code> / <code>null</code></td>
-<td>Proxy controls. <code>proxy</code> and <code>proxy_download</code> must be full proxy URIs unless the API key has <code>server_proxy</code>.</td>
+<td>Proxy controls. <code>proxy</code> and <code>proxy_download</code> must be full proxy URIs unless the API key has <code>server_proxy</code>. A Control D resolver, <code>controld://&lt;resolver&gt;@dns.controld.com</code>, counts as a full proxy URI: the server runs a forwarder for it.</td>
 </tr>
 <tr>
 <td><code>no_folder</code> / <code>no_source</code> / <code>no_mux</code></td>
@@ -4651,7 +4651,7 @@ an HTTP caller would be remote code execution. You configure post-scripts only i
 <p>Make a remote session for a service and title. Authentication runs asynchronously in the background. This call returns immediately with <code>status: "authenticating"</code>, and you then poll the prompt endpoint. The body accepts <code>service</code> and <code>title_id</code> (both required). It also accepts a broad set of optional keys, because the body allows <code>additionalProperties</code>. These are <code>credentials</code> (<code>{username, password, extra?}</code>), <code>cookies</code> (base64 of zlib-compressed Netscape cookie file), <code>proxy</code>, <code>no_proxy</code>, <code>profile</code>, <code>cache</code> (map of forwarded cache files, keyed by the file path relative to the service cache directory with <code>/</code> separators and no <code>.json</code> suffix, so a nested key such as <code>session_web/&lt;sha1&gt;</code> lands in a subdirectory), <code>client_region</code>, <code>proxy_region</code>, <code>cdm_type</code>, <code>range_</code>, <code>vcodec</code>, <code>quality</code>, <code>best_available</code>, <code>dl_params</code>, <code>client</code>, and any service CLI options. <code>proxy_region</code> is the country code the client resolved <code>proxy</code> from; the server matches it against its own accounts. <code>client</code> is a freeform object the dashboard shows as sent (the CLI puts <code>version</code>, <code>code_hash</code>, <code>platform</code> and a redacted <code>argv</code> in it); the server ignores it above 4096 bytes of JSON.</p>
 <p><code>dl_params</code> is an object with the <code>dl</code> track selection: <code>lang</code>, <code>v_lang</code> and <code>a_lang</code> (arrays of language strings), <code>acodec</code> (an array of audio codec names or <code>dl -a</code> aliases such as <code>ddp</code>) and <code>forced_subs</code> (boolean). The service reads these values from <code>ctx.parent.params</code>. The server uses the <code>dl</code> default for each absent or malformed value, and drops an unknown codec name.</p>
 <p>Service CLI options also travel in a nested <code>service_params</code> object, which wins over a flat key with the same name. <code>profile</code> at the top level always means the credentials profile, never a service's own <code>--profile</code> option.</p>
-<p>The <code>proxy</code> value must be a full proxy URI, unless the operator gives your API key <code>server_proxy</code> in the <code>serve.users</code> config. Without it, the server does not resolve country codes with its own proxy providers. It rejects the request with <code>INVALID_PROXY</code> when no <code>proxy</code> is set and the reported <code>client_region</code> differs from the server's region. A request that reports no <code>client_region</code> is not blocked. Pass <code>proxy</code> with your own proxy, or <code>no_proxy</code> to accept the server's own connection. With <code>server_proxy</code>, the server resolves a country code and picks a proxy for your <code>client_region</code> itself.</p>
+<p>The <code>proxy</code> value must be a full proxy URI, unless the operator gives your API key <code>server_proxy</code> in the <code>serve.users</code> config. Without <code>server_proxy</code>, the server does not resolve country codes with its own proxy providers. It rejects the request with <code>INVALID_PROXY</code> when no <code>proxy</code> is set and the reported <code>client_region</code> differs from the server's region. A request that reports no <code>client_region</code> is not blocked. Pass <code>proxy</code> with your own proxy, or <code>no_proxy</code> to accept the server's own connection. With <code>server_proxy</code>, the server resolves a country code and picks a proxy for your <code>client_region</code> itself. A Control D resolver, <code>controld://&lt;resolver&gt;@dns.controld.com</code>, counts as a full proxy URI: the server runs a forwarder for it and needs no Control D configuration of its own.</p>
 <div class="tabbed-set tabbed-alternate" data-tabs="19:1"><input checked="checked" id="__tabbed_19_1" name="__tabbed_19" type="radio" /><div class="tabbed-labels"><label for="__tabbed_19_1">Response <code>200</code></label></div>
 <div class="tabbed-content">
 <div class="tabbed-block">
@@ -2491,7 +2491,12 @@ server does not have to prompt:</p>
  it sits in a different region from the reported one, asking the client to
  pass <code>--proxy</code> with its own proxy, or <code>--no-proxy</code> to accept the server's
  own connection. With <code>server_proxy</code> the server picks a proxy that matches
-  the client region itself</li>
+  the client region itself. For <code>--proxy controld:ca</code> the client points its
+  Control D profile at the region and sends only the resolver, as
+  <code>controld://&lt;resolver&gt;@dns.controld.com</code>. The server counts it as a full proxy
+  URI and runs its own forwarder for it. A bare region skips Control D, because its
+  proxy is a forwarder on the client. See
+  <a href="../../../guide/proxies-and-vpn/#control-d">Control D</a></li>
 <li>Track-selection hints (<code>range_</code>, <code>vcodec</code>, <code>quality</code>, <code>best_available</code>) so
  the server fetches the right manifests</li>
 <li>Your language and audio codec selection (<code>-l</code>, <code>-vl</code>, <code>-al</code>, <code>-a</code>, <code>-fs</code>)
@@ -2514,7 +2519,8 @@ rotates through them. <code>--proxy ca</code> picks a <code>ca</code> account.</
 <p><code>GET /api/services</code> advertises the regions those accounts cover. When your own
 region is not one of them and you set no <code>--proxy</code>, the client resolves a proxy for
 the first advertised region itself, so both sides sit in a region the account
-works in.</p>
+works in. This is a bare region query, so it skips Control D. A server-account
+service does not accept a <code>controld://</code> resolver from the client.</p>
 <p>The server responds immediately with a session ID and a status. Authentication
 runs in the background on the server.</p>
 </div>
@@ -3353,7 +3353,7 @@ and keeps the service's numbering unchanged. Pick an order that covers the whole
 <tbody>
 <tr>
 <td><code>--proxy</code></td>
-<td>Proxy URI, a 2-letter country code resolved from configured providers, or <code>provider:region</code> (e.g. <code>nordvpn:ca</code>, <code>gluetun:us</code>, <code>protonvpn:de:berlin</code>).</td>
+<td>Proxy URI, a country or location code resolved from configured providers, or <code>provider:region</code> (e.g. <code>nordvpn:ca</code>, <code>gluetun:us</code>, <code>protonvpn:de:berlin</code>, <code>controld:yul</code>).</td>
 </tr>
 <tr>
 <td><code>--no-proxy</code></td>
@@ -3463,7 +3463,7 @@ and keeps the service's numbering unchanged. Pick an order that covers the whole
 </tr>
 <tr>
 <td><code>--proxy</code></td>
-<td>Proxy URI, 2-letter country code, or <code>provider:region</code>.</td>
+<td>Proxy URI, country or location code, or <code>provider:region</code> (e.g. <code>controld:ca</code>).</td>
 </tr>
 <tr>
 <td><code>--no-proxy</code></td>
@@ -3900,11 +3900,13 @@ post-scripts and for the full variable list, see
 <div class="language-shell highlight"><span class="filename">Custom group tag and a REPACK label</span><pre><span></span><code><span id="__span-38-1"><a id="__codelineno-38-1" name="__codelineno-38-1" href="#__codelineno-38-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--tag<span class="w"> </span>MYGRP<span class="w"> </span>--repack<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
 </span></code></pre></div>
 <h2 id="proxies">Proxies<a class="headerlink" href="#proxies" title="Permanent link">&para;</a></h2>
-<p><code>--proxy</code> accepts a full proxy URI, a 2-letter country code (resolved through your
-configured proxy providers), or a <code>provider:region</code> form.</p>
+<p><code>--proxy</code> accepts a full proxy URI, a country or location code (resolved through your
+configured proxy providers), or a <code>provider:region</code> form. See
+<a href="../proxies-and-vpn/#how-proxy-resolution-works">Proxies &amp; VPN</a> for the exact grammar.</p>
 <div class="language-shell highlight"><span class="filename">Proxy forms</span><pre><span></span><code><span id="__span-39-1"><a id="__codelineno-39-1" name="__codelineno-39-1" href="#__codelineno-39-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>us<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
 </span><span id="__span-39-2"><a id="__codelineno-39-2" name="__codelineno-39-2" href="#__codelineno-39-2"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>nordvpn:ca<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
-</span><span id="__span-39-3"><a id="__codelineno-39-3" name="__codelineno-39-3" href="#__codelineno-39-3"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span><span class="s1">'http://user:pass@host:8080'</span><span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
+</span><span id="__span-39-3"><a id="__codelineno-39-3" name="__codelineno-39-3" href="#__codelineno-39-3"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>controld:yul<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
+</span><span id="__span-39-4"><a id="__codelineno-39-4" name="__codelineno-39-4" href="#__codelineno-39-4"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span><span class="s1">'http://user:pass@host:8080'</span><span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
 </span></code></pre></div>
 <p>Three related flags:</p>
 <ul>
@@ -3974,11 +3976,23 @@ a content key when the vault misses. You can force one side or the other:</p>
 </ul>
 <div class="language-shell highlight"><span class="filename">Fetch keys only, no download</span><pre><span></span><code><span id="__span-42-1"><a id="__codelineno-42-1" name="__codelineno-42-1" href="#__codelineno-42-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--skip-dl<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
 </span></code></pre></div>
-<p><code>--export</code> writes a JSON file, into the configured exports directory, containing track
-info and the acquired content keys for each title. This is the format consumed by
-<code>unshackle import</code> to reconstruct a download later.</p>
+<p><code>--export</code> writes a <code>mediaexport</code> JSON file into the configured exports directory. It holds
+the manifest, the DRM init data, the content keys and the title metadata for each title.
+<code>unshackle import</code> reads it to reconstruct a download later. The importer also reads the
+older unshackle <code>version: 2</code> files and unidl's own export files.</p>
 <div class="language-shell highlight"><span class="filename">Export track info and keys</span><pre><span></span><code><span id="__span-43-1"><a id="__codelineno-43-1" name="__codelineno-43-1" href="#__codelineno-43-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--skip-dl<span class="w"> </span>--export<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
 </span></code></pre></div>
+<p>The export holds a content key for each track your flags selected and no others. To make a
+file another person can use, select generously: for example <code>-a AAC,EC3</code> and every language
+you want them to have. An import can only pick tracks whose key is in the file. A subtitle
+that another tool exported as a direct URL is added next to the manifest's own.</p>
+<div class="admonition warning">
+<p class="admonition-title">The export file is a secret</p>
+<p>It holds the content keys and usually a signed manifest URL. Hand it over on purpose,
+not by accident.</p>
+</div>
+<p>The <a href="https://github.com/unshackle-dl/mediaexport">mediaexport</a> package specifies the
+<code>mediaexport</code> format and is the reader and writer unshackle uses.</p>
 <div class="admonition note">
 <p class="admonition-title">Region is recorded only with a proxy</p>
 <p>When you use <code>--proxy</code>, the export records the region so an import can reproduce the
@@ -913,6 +913,56 @@
    </span>
  </a>
  
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#control-d" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        Control D
+      
+    </span>
+  </a>
+  
+    <nav class="md-nav" aria-label="Control D">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#what-you-need" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        What you need
+      
+    </span>
+  </a>
+  
+</li>
+        
+          <li class="md-nav__item">
+  <a href="#how-unshackle-chooses-a-profile" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        How unshackle chooses a profile
+      
+    </span>
+  </a>
+  
+</li>
+        
+          <li class="md-nav__item">
+  <a href="#troubleshooting-control-d" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        Troubleshooting Control D
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
      
        <li class="md-nav__item">
@@ -2320,6 +2370,56 @@
    </span>
  </a>
  
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#control-d" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        Control D
+      
+    </span>
+  </a>
+  
+    <nav class="md-nav" aria-label="Control D">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#what-you-need" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        What you need
+      
+    </span>
+  </a>
+  
+</li>
+        
+          <li class="md-nav__item">
+  <a href="#how-unshackle-chooses-a-profile" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        How unshackle chooses a profile
+      
+    </span>
+  </a>
+  
+</li>
+        
+          <li class="md-nav__item">
+  <a href="#troubleshooting-control-d" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        Troubleshooting Control D
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
      
        <li class="md-nav__item">
@@ -2511,7 +2611,7 @@ self-hosted tunnels), then ask for a country by its two-letter code and let
 unshackle pick a working server for you.</p>
 <p>The <code>--proxy</code> flag controls proxying, and the proxy providers unshackle supports change
 a query to a real proxy URL: <a href="#basic-static-proxies">basic static proxies</a>,
-<a href="#gluetun">Gluetun</a> (documented in the most detail, since it is the most flexible),
+<a href="#control-d">Control D</a>, <a href="#gluetun">Gluetun</a> (documented in the most detail, since it is the most flexible),
 <a href="#expressvpn">ExpressVPN</a>, <a href="#nordvpn">NordVPN</a>, <a href="#proton-vpn">Proton VPN</a>,
 <a href="#hola">Hola</a>, <a href="#surfshark">Surfshark</a>, and <a href="#windscribe">Windscribe</a>.</p>
 <div class="admonition note">
@@ -2608,19 +2708,32 @@ them in this order.</p>
   asks each loaded proxy provider <strong>in order</strong> and uses the first proxy any of them
   returns.</li>
 </ol>
-<p>unshackle compares the query against a region grammar: a two-letter country code,
-optionally followed by a server number and/or a <code>:city</code> or <code>-city</code> part. It then
+<p>unshackle compares the query against a region grammar: a country or location code of two
+to four letters, with an optional <code>_code</code> part (<code>res_yyz</code>), then an optional server
+number and/or a <code>:city</code> or <code>-city</code> part. A <code>host:port</code> value never matches. It then
 lowercases the query and hands it to the proxy provider. Its section below gives the
 exact forms each proxy provider accepts.</p>
+<p>A Control D resolver, <code>controld://&lt;resolver&gt;@dns.controld.com</code>, is a fourth form. A
+<code>--remote</code> client sends it to a server in place of a proxy URI, and the server starts a
+forwarder for it. See <a href="#control-d">Control D</a>.</p>
 <h3 id="provider-load-order">Provider load order<a class="headerlink" href="#provider-load-order" title="Permanent link">&para;</a></h3>
 <p>When you do a download without <code>--no-proxy</code>, unshackle instantiates every configured
 proxy provider once, in this fixed order. It uses that same order for bare-query
 resolution:</p>
-<p><strong>Basic → ExpressVPN → NordVPN → Proton VPN → Surfshark → Windscribe → Gluetun → Hola</strong></p>
+<p><strong>Basic → ExpressVPN → NordVPN → Proton VPN → Surfshark → Windscribe → Gluetun → Hola → Control D</strong></p>
 <p>So if you have both Basic and NordVPN configured and use <code>--proxy us</code>, a <code>us</code> entry in
 your Basic config wins, because unshackle tries Basic first. To skip ahead to a specific
 proxy provider, prefix the query (<code>--proxy nordvpn:us</code>).</p>
 <div class="admonition note">
+<p class="admonition-title">A bare region reaches Control D last</p>
+<p>unshackle asks Control D for a bare region such as <code>--proxy us</code> only when no other
+loaded proxy provider has a proxy for it. Hola loads automatically when the
+<code>hola-proxy</code> binary is on your <code>PATH</code>, and it comes before Control D. When Control D answers, it changes your Control D
+account: it points a profile at that country, and it can create an <code>unshackle-us</code>
+profile and endpoint. The geofence auto-proxy uses the same order. To use Control D
+directly, prefix the query (<code>--proxy controld:us</code>).</p>
+</div>
+<div class="admonition note">
 <p class="admonition-title">Auto-loading providers</p>
 <p>Most providers only load when you configure them under <code>proxy_providers:</code>. Three are
 special: <strong>ExpressVPN</strong> and <strong>Proton VPN</strong> also load automatically once their cache
@@ -2690,6 +2803,198 @@ them:</p>
 </ul>
 <div class="language-shell highlight"><pre><span></span><code><span id="__span-6-1"><a id="__codelineno-6-1" name="__codelineno-6-1" href="#__codelineno-6-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>de2<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
 </span></code></pre></div>
+<h2 id="control-d">Control D<a class="headerlink" href="#control-d" title="Permanent link">&para;</a></h2>
+<p><a href="https://controld.com">Control D</a> is a DNS service, not a proxy. It answers the hostnames
+it redirects with the IP of a transparent proxy in the region you chose, and that proxy
+relays onwards by SNI. There is no proxy URI to hand to Requests, so this proxy provider runs a
+small <strong>forwarder on loopback</strong>: it resolves each connection through your Control D
+resolver and relays the bytes. Everything downstream (the service session, the downloads,
+<code>--proxy-download</code>) sees an ordinary HTTP proxy.</p>
+<p>unshackle picks the region itself, by pointing a profile's <strong>default rule</strong> at it. A profile
+holds one region at a time, so unshackle gives each region in use a profile of its own,
+each with its own endpoint and its own forwarder port. <code>--proxy controld:yyz
+--proxy-download controld:yul</code> therefore uses two profiles, when two are free: Toronto for
+the service and Montreal for the downloads. When no second profile is free, the second
+region moves the first profile (see <a href="#how-unshackle-chooses-a-profile">step 5</a>).</p>
+<p>Keep both locations in one country. Some CDNs also check the country of the download IP,
+and refuse a <code>--proxy-download</code> exit in another country with a 403. This applies to every
+proxy provider.</p>
+<p><code>unshackle search --proxy controld:ca</code> works the same way as <code>dl</code>.</p>
+<h3 id="what-you-need">What you need<a class="headerlink" href="#what-you-need" title="Permanent link">&para;</a></h3>
+<ul>
+<li><strong>A plan with traffic redirection.</strong> On the personal plans that is <em>Full Control</em>;
+  <em>Some Control</em> has no redirection, and every redirect fails. The 14-day trial includes
+  it. See <a href="https://controld.com/plans">Control D's plans</a> for current prices.</li>
+<li><strong>An API token of type <em>Write</em>.</strong> A <em>Read</em> token cannot change a profile's default rule.
+  Create it in the dashboard under <em>API</em>. If you set <em>Allowed IPs</em> on the token, include
+  the address of each machine that runs unshackle with it.</li>
+</ul>
+<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-7-1"><a id="__codelineno-7-1" name="__codelineno-7-1" href="#__codelineno-7-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
+</span><span id="__span-7-2"><a id="__codelineno-7-2" name="__codelineno-7-2" href="#__codelineno-7-2"></a><span class="w">  </span><span class="nt">controld</span><span class="p">:</span>
+</span><span id="__span-7-3"><a id="__codelineno-7-3" name="__codelineno-7-3" href="#__codelineno-7-3"></a><span class="w">    </span><span class="nt">token</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">api.xxxxxxxxxxxx</span><span class="w">     </span><span class="c1"># a Write API token, from the Control D dashboard</span>
+</span></code></pre></div>
+<div class="language-shell highlight"><pre><span></span><code><span id="__span-8-1"><a id="__codelineno-8-1" name="__codelineno-8-1" href="#__codelineno-8-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>controld:ca<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
+</span></code></pre></div>
+<p>The token is the only required key. You do not need to create a profile or an endpoint,
+or to give a <code>profile</code> and <code>resolver</code>: unshackle creates an <code>unshackle-&lt;region&gt;</code> profile
+and endpoint on your account the first time it needs one, and uses it again on the next
+run. Give <code>profile</code> and <code>resolver</code> only to use a profile that you made yourself (see
+<a href="#how-unshackle-chooses-a-profile">How unshackle chooses a profile</a>).</p>
+<p>The returned proxy is HTTP on loopback,
+<code>http://127.0.0.1:{port}</code>. The locations themselves are read from Control D at startup
+(107 of them across 68 countries, at the time of writing), so there is nothing to list:</p>
+<table>
+<thead>
+<tr>
+<th>Query</th>
+<th>Meaning</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>ca</code></td>
+<td>One of Control D's Canadian locations, at random.</td>
+</tr>
+<tr>
+<td><code>yul</code></td>
+<td>That exact location, by its code.</td>
+</tr>
+<tr>
+<td><code>res_yyz</code></td>
+<td>A residential location, by its code. A country pick never uses a residential location, so name it this way.</td>
+</tr>
+</tbody>
+</table>
+<p>The <a href="../../reference/configuration/network/#controld">configuration reference</a> lists
+every <code>controld</code> config key.</p>
+<h3 id="how-unshackle-chooses-a-profile">How unshackle chooses a profile<a class="headerlink" href="#how-unshackle-chooses-a-profile" title="Permanent link">&para;</a></h3>
+<p>Each region query gets a profile and an endpoint named after it: <code>--proxy controld:ca</code> uses
+<code>unshackle-ca</code>. For each region, unshackle uses the first match in this list:</p>
+<ol>
+<li>A profile that this process already pointed at that region.</li>
+<li>The endpoint named <code>unshackle-&lt;region&gt;</code> on your account, made by an earlier run.</li>
+<li>
+<p>A profile from your config that this process does not use yet. These are optional:</p>
+<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-9-1"><a id="__codelineno-9-1" name="__codelineno-9-1" href="#__codelineno-9-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
+</span><span id="__span-9-2"><a id="__codelineno-9-2" name="__codelineno-9-2" href="#__codelineno-9-2"></a><span class="w">  </span><span class="nt">controld</span><span class="p">:</span>
+</span><span id="__span-9-3"><a id="__codelineno-9-3" name="__codelineno-9-3" href="#__codelineno-9-3"></a><span class="w">    </span><span class="nt">token</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">api.xxxxxxxxxxxx</span>
+</span><span id="__span-9-4"><a id="__codelineno-9-4" name="__codelineno-9-4" href="#__codelineno-9-4"></a><span class="w">    </span><span class="nt">profile</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">abcd123</span><span class="w">        </span><span class="c1"># a profile kept for unshackle, and nothing else</span>
+</span><span id="__span-9-5"><a id="__codelineno-9-5" name="__codelineno-9-5" href="#__codelineno-9-5"></a><span class="w">    </span><span class="nt">resolver</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">efgh456</span><span class="w">       </span><span class="c1"># the resolver ID of an endpoint using that profile</span>
+</span><span id="__span-9-6"><a id="__codelineno-9-6" name="__codelineno-9-6" href="#__codelineno-9-6"></a><span class="w">    </span><span class="nt">profiles</span><span class="p">:</span><span class="w">               </span><span class="c1"># more pairs, in the same shape</span>
+</span><span id="__span-9-7"><a id="__codelineno-9-7" name="__codelineno-9-7" href="#__codelineno-9-7"></a><span class="w">      </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">profile</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">ijkl789</span>
+</span><span id="__span-9-8"><a id="__codelineno-9-8" name="__codelineno-9-8" href="#__codelineno-9-8"></a><span class="w">        </span><span class="nt">resolver</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">mnop012</span>
+</span><span id="__span-9-9"><a id="__codelineno-9-9" name="__codelineno-9-9" href="#__codelineno-9-9"></a><span class="w">    </span><span class="nt">max_profiles</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">4</span><span class="w">         </span><span class="c1"># the most profiles unshackle uses, yours included (default 4)</span>
+</span></code></pre></div>
+<p>The resolver ID is the last part of the endpoint's DoH URL,
+<code>https://dns.controld.com/&lt;resolver&gt;</code>. You can also give the full URL.</p>
+</li>
+<li>
+<p>A new profile and endpoint named <code>unshackle-&lt;region&gt;</code>, while your config pairs plus the
+   <code>unshackle-*</code> endpoints on the account are fewer than <code>max_profiles</code>. unshackle keeps
+   them for the next run. <code>max_profiles</code> limits only this step: unshackle uses every pair
+   in your config, even more than <code>max_profiles</code>.</p>
+</li>
+<li>When no profile is free, a profile moves to the new region, with everything that still
+   uses it. unshackle first moves a profile that this process has not pointed at a region,
+   which another process can still use. Next, it moves the profile that this process
+   pointed at a region first. An <code>unshackle-*</code> profile that moves, and its endpoint, get the
+   new region's name. unshackle logs <code>Every Control D profile is in use; moving profile … to …</code>,
+   and connections already open keep the old exit until they close.</li>
+</ol>
+<p>Because the names live on the account, every unshackle process agrees on them: two runs,
+or two jobs on a <code>serve</code> instance, that ask for <code>ca</code> both use <code>unshackle-ca</code>. Two processes
+can still move a profile under each other when they run out of profiles (step 5).</p>
+<p>unshackle changes only the profiles in your config and the profiles of <code>unshackle-*</code>
+endpoints. It skips an <code>unshackle-*</code> endpoint whose profile an endpoint without that name
+also uses, so unshackle never redirects a profile that serves your own devices. Leave the <code>unshackle-*</code>
+profiles empty: no services, no custom rules. unshackle sets their default rule to
+<code>REDIRECT</code>, and the <em>Services</em> and <em>Custom Rules</em> tabs stay at zero by design. To remove
+them, delete the endpoints and profiles in the dashboard. unshackle creates new ones when
+it next needs them.</p>
+<div class="admonition warning">
+<p class="admonition-title">Business accounts pay per endpoint</p>
+<p>Personal plans allow an unlimited number of profiles and endpoints. Business plans bill
+each endpoint every month, so each <code>unshackle-&lt;country&gt;</code> endpoint adds to the bill. On a business
+account, configure your own pairs, as many as the countries you use at the same time,
+and set <code>max_profiles</code> to that number. unshackle then never creates a profile.</p>
+</div>
+<div class="admonition note">
+<p class="admonition-title">Everything goes through the proxy, including the segments</p>
+<p>With the default rule redirecting, the whole download leaves through Control D's
+transparent proxy. Control D serves it on a best-effort basis. Pair it with <code>--no-proxy-download</code> to
+keep the geo-check on the manifest and the licence while pulling the files over your
+own connection.</p>
+</div>
+<div class="admonition note">
+<p class="admonition-title">The switch is not instant</p>
+<p>unshackle drops its own DNS cache when it changes region, but Control D's edge may
+still serve the previous answer for the remainder of the record's TTL.</p>
+</div>
+<div class="admonition note">
+<p class="admonition-title">Same machine, same IP, over IPv4</p>
+<p>Control D authorises its proxies by source IP: the address that queried DNS is the one
+allowed to use the proxy. The forwarder resolves and connects from the same host, so
+this holds. Control D also answers a redirected name only to a query over IPv4, so the
+forwarder asks over IPv4 even on a host with IPv6, and ignores <code>HTTPS_PROXY</code> for these
+queries.</p>
+<p>The forwarder refuses a connection to an IP address with a <code>502</code>, because an IP address
+skips Control D's DNS and connects from your own address. A request that names a host
+by IP address fails with this proxy provider.</p>
+</div>
+<div class="admonition note">
+<p class="admonition-title">With <code>--remote</code>, the server resolves</p>
+<p>unshackle does not send your API token to a server. For <code>--proxy controld:ca</code> with
+<code>--remote</code>, unshackle points <code>unshackle-ca</code> at Canada with your token, then sends the
+server only that endpoint's resolver ID, as <code>controld://&lt;resolver&gt;@dns.controld.com</code>.
+The server runs its own forwarder with it, from its own address, and needs no Control D
+configuration. The resolver ID lets anyone who has it use that endpoint's proxy, so treat
+it as a secret: unshackle masks it in logs and in stored job parameters.</p>
+<p>The server must run a version of unshackle that knows <code>controld://</code>. An older server
+rejects it with <code>INVALID_PROXY</code>: <code>Proxy provider 'controld' not found</code> when your API key
+has <code>server_proxy</code>, else a message that asks for a full proxy URI. A bare region, such
+as <code>--proxy ca</code>, skips Control D with <code>--remote</code>, because the proxy it gives is on your
+machine. A service whose accounts the server manages does not accept a proxy from the
+client, and that includes a Control D resolver.</p>
+</div>
+<h3 id="troubleshooting-control-d">Troubleshooting Control D<a class="headerlink" href="#troubleshooting-control-d" title="Permanent link">&para;</a></h3>
+<table>
+<thead>
+<tr>
+<th>Symptom</th>
+<th>Cause and fix</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>Proxy check failed</code>, because the exit IP is your own IP.</td>
+<td>The profile does not redirect. Make sure that the plan includes traffic redirection (<em>Full Control</em>, not <em>Some Control</em>). After a region change, wait for the TTL of the previous answer to end.</td>
+</tr>
+<tr>
+<td>A <code>502 Bad Gateway</code> for one host. With <code>-d</code>, the log shows <code>Control D returned no A record for …</code>.</td>
+<td>Control D gave no IPv4 address for that host.</td>
+</tr>
+<tr>
+<td>A <code>502 Bad Gateway</code> for one host only. With <code>-d</code>, the log shows <code>Refused …, an address that Control D cannot redirect</code>.</td>
+<td>The request names the host by IP address. The forwarder refuses it. See the note on IPv4 above.</td>
+</tr>
+<tr>
+<td>An HTTP <code>401</code> or <code>403</code> from <code>api.controld.com</code>.</td>
+<td>The token is a <em>Read</em> token, or its <em>Allowed IPs</em> do not include this machine. Use a <em>Write</em> token.</td>
+</tr>
+<tr>
+<td><code>Control D needs both a profile and a resolver</code> or <code>Control D needs max_profiles of 1 or more</code> at startup.</td>
+<td>The <code>controld</code> config is not valid. Give <code>profile</code> and <code>resolver</code> together, and a <code>max_profiles</code> of 1 or more. Every run fails until you correct it, also a run that does not use Control D.</td>
+</tr>
+<tr>
+<td><code>Could not read Control D's locations</code>.</td>
+<td>unshackle could not get the location list. It tries again at the next Control D query.</td>
+</tr>
+<tr>
+<td>A <code>403</code> for the segments only, with <code>--proxy-download</code> in another country.</td>
+<td>The CDN checks the country of the download IP. Keep <code>--proxy-download</code> in the same country as <code>--proxy</code>.</td>
+</tr>
+</tbody>
+</table>
 <h2 id="gluetun">Gluetun<a class="headerlink" href="#gluetun" title="Permanent link">&para;</a></h2>
 <p>Gluetun is unshackle's most flexible proxy backend, and the one to reach for if you want
 one configuration to cover many VPN providers. Instead of returning a remote proxy URL,
@@ -2719,11 +3024,11 @@ to <code>/dev/net/tun</code> to bring up the tunnel. unshackle requests both aut
 <h3 id="query-format">Query format<a class="headerlink" href="#query-format" title="Permanent link">&para;</a></h3>
 <p>Gluetun uses a nested selector: the proxy provider prefix picks Gluetun, and the rest names the
 <strong>VPN provider</strong> and the <strong>region</strong>.</p>
-<div class="language-text highlight"><pre><span></span><code><span id="__span-7-1"><a id="__codelineno-7-1" name="__codelineno-7-1" href="#__codelineno-7-1"></a>gluetun:&lt;vpn-provider&gt;:&lt;region&gt;
+<div class="language-text highlight"><pre><span></span><code><span id="__span-10-1"><a id="__codelineno-10-1" name="__codelineno-10-1" href="#__codelineno-10-1"></a>gluetun:&lt;vpn-provider&gt;:&lt;region&gt;
 </span></code></pre></div>
-<div class="language-shell highlight"><span class="filename">A Windscribe US exit via Gluetun</span><pre><span></span><code><span id="__span-8-1"><a id="__codelineno-8-1" name="__codelineno-8-1" href="#__codelineno-8-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>gluetun:windscribe:us<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
+<div class="language-shell highlight"><span class="filename">A Windscribe US exit via Gluetun</span><pre><span></span><code><span id="__span-11-1"><a id="__codelineno-11-1" name="__codelineno-11-1" href="#__codelineno-11-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>gluetun:windscribe:us<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
 </span></code></pre></div>
-<div class="language-shell highlight"><span class="filename">A NordVPN Germany exit via Gluetun</span><pre><span></span><code><span id="__span-9-1"><a id="__codelineno-9-1" name="__codelineno-9-1" href="#__codelineno-9-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>gluetun:nordvpn:de<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
+<div class="language-shell highlight"><span class="filename">A NordVPN Germany exit via Gluetun</span><pre><span></span><code><span id="__span-12-1"><a id="__codelineno-12-1" name="__codelineno-12-1" href="#__codelineno-12-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>gluetun:nordvpn:de<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
 </span></code></pre></div>
 <p>After unshackle strips the leading <code>gluetun:</code>, the proxy provider receives exactly
 <code>provider:region</code>. It must be two colon-separated parts, and anything else is an error.
@@ -2733,36 +3038,36 @@ unshackle normalises friendly names to Gluetun's identifiers (for example <code>
 <h3 id="configuration">Configuration<a class="headerlink" href="#configuration" title="Permanent link">&para;</a></h3>
 <p>Each VPN provider you want to use gets an entry under <code>providers:</code>, carrying its VPN type,
 credentials, and how your region aliases map onto Gluetun's server selectors.</p>
-<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-10-1"><a id="__codelineno-10-1" name="__codelineno-10-1" href="#__codelineno-10-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
-</span><span id="__span-10-2"><a id="__codelineno-10-2" name="__codelineno-10-2" href="#__codelineno-10-2"></a><span class="w">  </span><span class="nt">gluetun</span><span class="p">:</span>
-</span><span id="__span-10-3"><a id="__codelineno-10-3" name="__codelineno-10-3" href="#__codelineno-10-3"></a><span class="w">    </span><span class="nt">providers</span><span class="p">:</span>
-</span><span id="__span-10-4"><a id="__codelineno-10-4" name="__codelineno-10-4" href="#__codelineno-10-4"></a><span class="w">      </span><span class="nt">windscribe</span><span class="p">:</span>
-</span><span id="__span-10-5"><a id="__codelineno-10-5" name="__codelineno-10-5" href="#__codelineno-10-5"></a><span class="w">        </span><span class="nt">vpn_type</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">wireguard</span>
-</span><span id="__span-10-6"><a id="__codelineno-10-6" name="__codelineno-10-6" href="#__codelineno-10-6"></a><span class="w">        </span><span class="nt">credentials</span><span class="p">:</span>
-</span><span id="__span-10-7"><a id="__codelineno-10-7" name="__codelineno-10-7" href="#__codelineno-10-7"></a><span class="w">          </span><span class="nt">private_key</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_WIREGUARD_PRIVATE_KEY</span>
-</span><span id="__span-10-8"><a id="__codelineno-10-8" name="__codelineno-10-8" href="#__codelineno-10-8"></a><span class="w">          </span><span class="nt">addresses</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_WIREGUARD_ADDRESS</span>
-</span><span id="__span-10-9"><a id="__codelineno-10-9" name="__codelineno-10-9" href="#__codelineno-10-9"></a><span class="w">          </span><span class="nt">preshared_key</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_PRESHARED_KEY</span>
-</span><span id="__span-10-10"><a id="__codelineno-10-10" name="__codelineno-10-10" href="#__codelineno-10-10"></a><span class="w">        </span><span class="nt">server_countries</span><span class="p">:</span>
-</span><span id="__span-10-11"><a id="__codelineno-10-11" name="__codelineno-10-11" href="#__codelineno-10-11"></a><span class="w">          </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">US</span>
-</span><span id="__span-10-12"><a id="__codelineno-10-12" name="__codelineno-10-12" href="#__codelineno-10-12"></a><span class="w">          </span><span class="nt">uk</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">GB</span>
-</span><span id="__span-10-13"><a id="__codelineno-10-13" name="__codelineno-10-13" href="#__codelineno-10-13"></a><span class="w">        </span><span class="nt">server_cities</span><span class="p">:</span><span class="w"> </span><span class="p p-Indicator">{}</span>
-</span><span id="__span-10-14"><a id="__codelineno-10-14" name="__codelineno-10-14" href="#__codelineno-10-14"></a><span class="w">        </span><span class="nt">server_hostnames</span><span class="p">:</span><span class="w"> </span><span class="p p-Indicator">{}</span>
-</span><span id="__span-10-15"><a id="__codelineno-10-15" name="__codelineno-10-15" href="#__codelineno-10-15"></a><span class="w">        </span><span class="nt">extra_env</span><span class="p">:</span><span class="w"> </span><span class="p p-Indicator">{}</span>
-</span><span id="__span-10-16"><a id="__codelineno-10-16" name="__codelineno-10-16" href="#__codelineno-10-16"></a><span class="w">      </span><span class="nt">nordvpn</span><span class="p">:</span>
-</span><span id="__span-10-17"><a id="__codelineno-10-17" name="__codelineno-10-17" href="#__codelineno-10-17"></a><span class="w">        </span><span class="nt">vpn_type</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">wireguard</span>
-</span><span id="__span-10-18"><a id="__codelineno-10-18" name="__codelineno-10-18" href="#__codelineno-10-18"></a><span class="w">        </span><span class="nt">credentials</span><span class="p">:</span>
-</span><span id="__span-10-19"><a id="__codelineno-10-19" name="__codelineno-10-19" href="#__codelineno-10-19"></a><span class="w">          </span><span class="nt">private_key</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_WIREGUARD_PRIVATE_KEY</span>
-</span><span id="__span-10-20"><a id="__codelineno-10-20" name="__codelineno-10-20" href="#__codelineno-10-20"></a><span class="w">        </span><span class="nt">server_countries</span><span class="p">:</span>
-</span><span id="__span-10-21"><a id="__codelineno-10-21" name="__codelineno-10-21" href="#__codelineno-10-21"></a><span class="w">          </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">US</span>
-</span><span id="__span-10-22"><a id="__codelineno-10-22" name="__codelineno-10-22" href="#__codelineno-10-22"></a><span class="w">          </span><span class="nt">de</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">DE</span>
-</span><span id="__span-10-23"><a id="__codelineno-10-23" name="__codelineno-10-23" href="#__codelineno-10-23"></a>
-</span><span id="__span-10-24"><a id="__codelineno-10-24" name="__codelineno-10-24" href="#__codelineno-10-24"></a><span class="w">    </span><span class="c1"># Global settings (all optional)</span>
-</span><span id="__span-10-25"><a id="__codelineno-10-25" name="__codelineno-10-25" href="#__codelineno-10-25"></a><span class="w">    </span><span class="nt">base_port</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">8888</span>
-</span><span id="__span-10-26"><a id="__codelineno-10-26" name="__codelineno-10-26" href="#__codelineno-10-26"></a><span class="w">    </span><span class="nt">auto_cleanup</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">true</span>
-</span><span id="__span-10-27"><a id="__codelineno-10-27" name="__codelineno-10-27" href="#__codelineno-10-27"></a><span class="w">    </span><span class="nt">container_prefix</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">unshackle-gluetun</span>
-</span><span id="__span-10-28"><a id="__codelineno-10-28" name="__codelineno-10-28" href="#__codelineno-10-28"></a><span class="w">    </span><span class="nt">auth_user</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">null</span>
-</span><span id="__span-10-29"><a id="__codelineno-10-29" name="__codelineno-10-29" href="#__codelineno-10-29"></a><span class="w">    </span><span class="nt">auth_password</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">null</span>
-</span><span id="__span-10-30"><a id="__codelineno-10-30" name="__codelineno-10-30" href="#__codelineno-10-30"></a><span class="w">    </span><span class="nt">verify_ip</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">true</span>
+<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-13-1"><a id="__codelineno-13-1" name="__codelineno-13-1" href="#__codelineno-13-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
+</span><span id="__span-13-2"><a id="__codelineno-13-2" name="__codelineno-13-2" href="#__codelineno-13-2"></a><span class="w">  </span><span class="nt">gluetun</span><span class="p">:</span>
+</span><span id="__span-13-3"><a id="__codelineno-13-3" name="__codelineno-13-3" href="#__codelineno-13-3"></a><span class="w">    </span><span class="nt">providers</span><span class="p">:</span>
+</span><span id="__span-13-4"><a id="__codelineno-13-4" name="__codelineno-13-4" href="#__codelineno-13-4"></a><span class="w">      </span><span class="nt">windscribe</span><span class="p">:</span>
+</span><span id="__span-13-5"><a id="__codelineno-13-5" name="__codelineno-13-5" href="#__codelineno-13-5"></a><span class="w">        </span><span class="nt">vpn_type</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">wireguard</span>
+</span><span id="__span-13-6"><a id="__codelineno-13-6" name="__codelineno-13-6" href="#__codelineno-13-6"></a><span class="w">        </span><span class="nt">credentials</span><span class="p">:</span>
+</span><span id="__span-13-7"><a id="__codelineno-13-7" name="__codelineno-13-7" href="#__codelineno-13-7"></a><span class="w">          </span><span class="nt">private_key</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_WIREGUARD_PRIVATE_KEY</span>
+</span><span id="__span-13-8"><a id="__codelineno-13-8" name="__codelineno-13-8" href="#__codelineno-13-8"></a><span class="w">          </span><span class="nt">addresses</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_WIREGUARD_ADDRESS</span>
+</span><span id="__span-13-9"><a id="__codelineno-13-9" name="__codelineno-13-9" href="#__codelineno-13-9"></a><span class="w">          </span><span class="nt">preshared_key</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_PRESHARED_KEY</span>
+</span><span id="__span-13-10"><a id="__codelineno-13-10" name="__codelineno-13-10" href="#__codelineno-13-10"></a><span class="w">        </span><span class="nt">server_countries</span><span class="p">:</span>
+</span><span id="__span-13-11"><a id="__codelineno-13-11" name="__codelineno-13-11" href="#__codelineno-13-11"></a><span class="w">          </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">US</span>
+</span><span id="__span-13-12"><a id="__codelineno-13-12" name="__codelineno-13-12" href="#__codelineno-13-12"></a><span class="w">          </span><span class="nt">uk</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">GB</span>
+</span><span id="__span-13-13"><a id="__codelineno-13-13" name="__codelineno-13-13" href="#__codelineno-13-13"></a><span class="w">        </span><span class="nt">server_cities</span><span class="p">:</span><span class="w"> </span><span class="p p-Indicator">{}</span>
+</span><span id="__span-13-14"><a id="__codelineno-13-14" name="__codelineno-13-14" href="#__codelineno-13-14"></a><span class="w">        </span><span class="nt">server_hostnames</span><span class="p">:</span><span class="w"> </span><span class="p p-Indicator">{}</span>
+</span><span id="__span-13-15"><a id="__codelineno-13-15" name="__codelineno-13-15" href="#__codelineno-13-15"></a><span class="w">        </span><span class="nt">extra_env</span><span class="p">:</span><span class="w"> </span><span class="p p-Indicator">{}</span>
+</span><span id="__span-13-16"><a id="__codelineno-13-16" name="__codelineno-13-16" href="#__codelineno-13-16"></a><span class="w">      </span><span class="nt">nordvpn</span><span class="p">:</span>
+</span><span id="__span-13-17"><a id="__codelineno-13-17" name="__codelineno-13-17" href="#__codelineno-13-17"></a><span class="w">        </span><span class="nt">vpn_type</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">wireguard</span>
+</span><span id="__span-13-18"><a id="__codelineno-13-18" name="__codelineno-13-18" href="#__codelineno-13-18"></a><span class="w">        </span><span class="nt">credentials</span><span class="p">:</span>
+</span><span id="__span-13-19"><a id="__codelineno-13-19" name="__codelineno-13-19" href="#__codelineno-13-19"></a><span class="w">          </span><span class="nt">private_key</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_WIREGUARD_PRIVATE_KEY</span>
+</span><span id="__span-13-20"><a id="__codelineno-13-20" name="__codelineno-13-20" href="#__codelineno-13-20"></a><span class="w">        </span><span class="nt">server_countries</span><span class="p">:</span>
+</span><span id="__span-13-21"><a id="__codelineno-13-21" name="__codelineno-13-21" href="#__codelineno-13-21"></a><span class="w">          </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">US</span>
+</span><span id="__span-13-22"><a id="__codelineno-13-22" name="__codelineno-13-22" href="#__codelineno-13-22"></a><span class="w">          </span><span class="nt">de</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">DE</span>
+</span><span id="__span-13-23"><a id="__codelineno-13-23" name="__codelineno-13-23" href="#__codelineno-13-23"></a>
+</span><span id="__span-13-24"><a id="__codelineno-13-24" name="__codelineno-13-24" href="#__codelineno-13-24"></a><span class="w">    </span><span class="c1"># Global settings (all optional)</span>
+</span><span id="__span-13-25"><a id="__codelineno-13-25" name="__codelineno-13-25" href="#__codelineno-13-25"></a><span class="w">    </span><span class="nt">base_port</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">8888</span>
+</span><span id="__span-13-26"><a id="__codelineno-13-26" name="__codelineno-13-26" href="#__codelineno-13-26"></a><span class="w">    </span><span class="nt">auto_cleanup</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">true</span>
+</span><span id="__span-13-27"><a id="__codelineno-13-27" name="__codelineno-13-27" href="#__codelineno-13-27"></a><span class="w">    </span><span class="nt">container_prefix</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">unshackle-gluetun</span>
+</span><span id="__span-13-28"><a id="__codelineno-13-28" name="__codelineno-13-28" href="#__codelineno-13-28"></a><span class="w">    </span><span class="nt">auth_user</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">null</span>
+</span><span id="__span-13-29"><a id="__codelineno-13-29" name="__codelineno-13-29" href="#__codelineno-13-29"></a><span class="w">    </span><span class="nt">auth_password</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">null</span>
+</span><span id="__span-13-30"><a id="__codelineno-13-30" name="__codelineno-13-30" href="#__codelineno-13-30"></a><span class="w">    </span><span class="nt">verify_ip</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">true</span>
 </span></code></pre></div>
 <p><strong>Per-provider keys:</strong></p>
 <table>
@@ -2938,22 +3243,22 @@ device-login flow, obtains proxy-capable locations from Express's API, and retur
 authenticated HTTPS proxy. The device login runs once. After that, the cached refresh
 token keeps you signed in headlessly.</p>
 <p>Enable it and do a download interactively once:</p>
-<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-11-1"><a id="__codelineno-11-1" name="__codelineno-11-1" href="#__codelineno-11-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
-</span><span id="__span-11-2"><a id="__codelineno-11-2" name="__codelineno-11-2" href="#__codelineno-11-2"></a><span class="w">  </span><span class="nt">expressvpn</span><span class="p">:</span>
-</span><span id="__span-11-3"><a id="__codelineno-11-3" name="__codelineno-11-3" href="#__codelineno-11-3"></a><span class="w">    </span><span class="nt">enable</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">true</span>
+<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-14-1"><a id="__codelineno-14-1" name="__codelineno-14-1" href="#__codelineno-14-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
+</span><span id="__span-14-2"><a id="__codelineno-14-2" name="__codelineno-14-2" href="#__codelineno-14-2"></a><span class="w">  </span><span class="nt">expressvpn</span><span class="p">:</span>
+</span><span id="__span-14-3"><a id="__codelineno-14-3" name="__codelineno-14-3" href="#__codelineno-14-3"></a><span class="w">    </span><span class="nt">enable</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">true</span>
 </span></code></pre></div>
 <p>With <code>enable: true</code> and an interactive terminal, unshackle prints a code and a URL to
 enter it at. Once you approve it, unshackle caches the tokens and reuses them
 automatically, so later runs need no terminal. ExpressVPN also <strong>auto-loads</strong> once its token cache exists, so you can
 drop <code>enable</code> after the first login, but you can keep a YAML block to pin regions or
 servers:</p>
-<div class="language-yaml highlight"><span class="filename">unshackle.yaml (optional)</span><pre><span></span><code><span id="__span-12-1"><a id="__codelineno-12-1" name="__codelineno-12-1" href="#__codelineno-12-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
-</span><span id="__span-12-2"><a id="__codelineno-12-2" name="__codelineno-12-2" href="#__codelineno-12-2"></a><span class="w">  </span><span class="nt">expressvpn</span><span class="p">:</span>
-</span><span id="__span-12-3"><a id="__codelineno-12-3" name="__codelineno-12-3" href="#__codelineno-12-3"></a><span class="w">    </span><span class="nt">region_map</span><span class="p">:</span>
-</span><span id="__span-12-4"><a id="__codelineno-12-4" name="__codelineno-12-4" href="#__codelineno-12-4"></a><span class="w">      </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">ny-02</span><span class="w">       </span><span class="c1"># prefer New York, server 02 for the US</span>
-</span><span id="__span-12-5"><a id="__codelineno-12-5" name="__codelineno-12-5" href="#__codelineno-12-5"></a><span class="w">      </span><span class="nt">gb</span><span class="p">:</span><span class="w">             </span><span class="c1"># empty = smart random location</span>
-</span><span id="__span-12-6"><a id="__codelineno-12-6" name="__codelineno-12-6" href="#__codelineno-12-6"></a><span class="w">    </span><span class="nt">server_map</span><span class="p">:</span>
-</span><span id="__span-12-7"><a id="__codelineno-12-7" name="__codelineno-12-7" href="#__codelineno-12-7"></a><span class="w">      </span><span class="nt">myserver</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">usny-newyork-2</span>
+<div class="language-yaml highlight"><span class="filename">unshackle.yaml (optional)</span><pre><span></span><code><span id="__span-15-1"><a id="__codelineno-15-1" name="__codelineno-15-1" href="#__codelineno-15-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
+</span><span id="__span-15-2"><a id="__codelineno-15-2" name="__codelineno-15-2" href="#__codelineno-15-2"></a><span class="w">  </span><span class="nt">expressvpn</span><span class="p">:</span>
+</span><span id="__span-15-3"><a id="__codelineno-15-3" name="__codelineno-15-3" href="#__codelineno-15-3"></a><span class="w">    </span><span class="nt">region_map</span><span class="p">:</span>
+</span><span id="__span-15-4"><a id="__codelineno-15-4" name="__codelineno-15-4" href="#__codelineno-15-4"></a><span class="w">      </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">ny-02</span><span class="w">       </span><span class="c1"># prefer New York, server 02 for the US</span>
+</span><span id="__span-15-5"><a id="__codelineno-15-5" name="__codelineno-15-5" href="#__codelineno-15-5"></a><span class="w">      </span><span class="nt">gb</span><span class="p">:</span><span class="w">             </span><span class="c1"># empty = smart random location</span>
+</span><span id="__span-15-6"><a id="__codelineno-15-6" name="__codelineno-15-6" href="#__codelineno-15-6"></a><span class="w">    </span><span class="nt">server_map</span><span class="p">:</span>
+</span><span id="__span-15-7"><a id="__codelineno-15-7" name="__codelineno-15-7" href="#__codelineno-15-7"></a><span class="w">      </span><span class="nt">myserver</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">usny-newyork-2</span>
 </span></code></pre></div>
 <p><strong>Default file location:</strong></p>
 <table>
@@ -3013,13 +3318,13 @@ token is never briefly world-readable.</p>
 <p>NordVPN uses your <strong>Service Credentials</strong>, not your normal NordVPN login. Make them
 from the <a href="https://my.nordaccount.com/dashboard/nordvpn/">NordVPN dashboard</a> under manual
 setup. They are a long random username/password pair, not your email and password.</p>
-<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-13-1"><a id="__codelineno-13-1" name="__codelineno-13-1" href="#__codelineno-13-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
-</span><span id="__span-13-2"><a id="__codelineno-13-2" name="__codelineno-13-2" href="#__codelineno-13-2"></a><span class="w">  </span><span class="nt">nordvpn</span><span class="p">:</span>
-</span><span id="__span-13-3"><a id="__codelineno-13-3" name="__codelineno-13-3" href="#__codelineno-13-3"></a><span class="w">    </span><span class="nt">username</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_USERNAME</span>
-</span><span id="__span-13-4"><a id="__codelineno-13-4" name="__codelineno-13-4" href="#__codelineno-13-4"></a><span class="w">    </span><span class="nt">password</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_PASSWORD</span>
-</span><span id="__span-13-5"><a id="__codelineno-13-5" name="__codelineno-13-5" href="#__codelineno-13-5"></a><span class="w">    </span><span class="nt">server_map</span><span class="p">:</span><span class="w">                </span><span class="c1"># optional: pin specific server IDs</span>
-</span><span id="__span-13-6"><a id="__codelineno-13-6" name="__codelineno-13-6" href="#__codelineno-13-6"></a><span class="w">      </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">1234</span>
-</span><span id="__span-13-7"><a id="__codelineno-13-7" name="__codelineno-13-7" href="#__codelineno-13-7"></a><span class="w">      </span><span class="nt">us:seattle</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">5678</span>
+<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-16-1"><a id="__codelineno-16-1" name="__codelineno-16-1" href="#__codelineno-16-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
+</span><span id="__span-16-2"><a id="__codelineno-16-2" name="__codelineno-16-2" href="#__codelineno-16-2"></a><span class="w">  </span><span class="nt">nordvpn</span><span class="p">:</span>
+</span><span id="__span-16-3"><a id="__codelineno-16-3" name="__codelineno-16-3" href="#__codelineno-16-3"></a><span class="w">    </span><span class="nt">username</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_USERNAME</span>
+</span><span id="__span-16-4"><a id="__codelineno-16-4" name="__codelineno-16-4" href="#__codelineno-16-4"></a><span class="w">    </span><span class="nt">password</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_PASSWORD</span>
+</span><span id="__span-16-5"><a id="__codelineno-16-5" name="__codelineno-16-5" href="#__codelineno-16-5"></a><span class="w">    </span><span class="nt">server_map</span><span class="p">:</span><span class="w">                </span><span class="c1"># optional: pin specific server IDs</span>
+</span><span id="__span-16-6"><a id="__codelineno-16-6" name="__codelineno-16-6" href="#__codelineno-16-6"></a><span class="w">      </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">1234</span>
+</span><span id="__span-16-7"><a id="__codelineno-16-7" name="__codelineno-16-7" href="#__codelineno-16-7"></a><span class="w">      </span><span class="nt">us:seattle</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">5678</span>
 </span></code></pre></div>
 <p><strong>Required keys:</strong> <code>username</code>, <code>password</code>. unshackle validates them up front: the
 combined username and password must be exactly 48 alphanumeric characters (case-insensitive), and
@@ -3064,7 +3369,7 @@ country-code confusion that <code>uk</code> invites.</p>
 </table>
 <p>The returned proxy is HTTPS on <strong>port 89</strong> (NordVPN disabled its plain-HTTP proxies on
 port 80 in 2021).</p>
-<div class="language-shell highlight"><pre><span></span><code><span id="__span-14-1"><a id="__codelineno-14-1" name="__codelineno-14-1" href="#__codelineno-14-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>nordvpn:us:seattle<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
+<div class="language-shell highlight"><pre><span></span><code><span id="__span-17-1"><a id="__codelineno-17-1" name="__codelineno-17-1" href="#__codelineno-17-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>nordvpn:us:seattle<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
 </span></code></pre></div>
 <h2 id="proton-vpn">Proton VPN<a class="headerlink" href="#proton-vpn" title="Permanent link">&para;</a></h2>
 <p>Proton VPN supports two authentication methods, and unshackle can work with either. Note
@@ -3075,9 +3380,9 @@ that free Proton accounts work, but Proton limits them to its free-tier exit cou
 <p>Proton's TV device-login flow gives a self-sustaining, refreshable sign-in. This is
 the only method that can refresh itself headlessly, so it keeps working without
 re-exporting anything. Enable it and do a download interactively once:</p>
-<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-15-1"><a id="__codelineno-15-1" name="__codelineno-15-1" href="#__codelineno-15-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
-</span><span id="__span-15-2"><a id="__codelineno-15-2" name="__codelineno-15-2" href="#__codelineno-15-2"></a><span class="w">  </span><span class="nt">protonvpn</span><span class="p">:</span>
-</span><span id="__span-15-3"><a id="__codelineno-15-3" name="__codelineno-15-3" href="#__codelineno-15-3"></a><span class="w">    </span><span class="nt">enable</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">true</span>
+<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-18-1"><a id="__codelineno-18-1" name="__codelineno-18-1" href="#__codelineno-18-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
+</span><span id="__span-18-2"><a id="__codelineno-18-2" name="__codelineno-18-2" href="#__codelineno-18-2"></a><span class="w">  </span><span class="nt">protonvpn</span><span class="p">:</span>
+</span><span id="__span-18-3"><a id="__codelineno-18-3" name="__codelineno-18-3" href="#__codelineno-18-3"></a><span class="w">    </span><span class="nt">enable</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">true</span>
 </span></code></pre></div>
 <p>With <code>enable: true</code> and an interactive terminal, unshackle prints a code and asks you
 to enter it at <a href="https://account.proton.me/vpn/tv/code">account.proton.me/vpn/tv/code</a>.
@@ -3170,7 +3475,7 @@ previous run's log line (e.g. <code>DE#203</code>) instead.</p>
 <a href="https://github.com/Snawoot/hola-proxy"><code>hola-proxy</code></a> binary, and <strong>auto-loads</strong> whenever
 that binary is found on your <code>PATH</code>. If you query Hola but the binary is missing, the
 proxy provider raises an error that tells you to install it.</p>
-<div class="language-shell highlight"><span class="filename">Install hola-proxy, then just query a country</span><pre><span></span><code><span id="__span-16-1"><a id="__codelineno-16-1" name="__codelineno-16-1" href="#__codelineno-16-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>hola:us<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
+<div class="language-shell highlight"><span class="filename">Install hola-proxy, then just query a country</span><pre><span></span><code><span id="__span-19-1"><a id="__codelineno-19-1" name="__codelineno-19-1" href="#__codelineno-19-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>hola:us<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
 </span></code></pre></div>
 <p><strong>Query forms:</strong> a two-letter country code (e.g. <code>us</code>, <code>gb</code>). unshackle asks <code>hola-proxy</code>
 for available proxies in that country and picks one at random, returning an HTTP proxy.</p>
@@ -3183,12 +3488,12 @@ only datacenter proxies.</p>
 <h2 id="surfshark">Surfshark<a class="headerlink" href="#surfshark" title="Permanent link">&para;</a></h2>
 <p>Surfshark, like NordVPN, uses <strong>Service Credentials</strong> rather than your login. Make
 them from the <a href="https://my.surfshark.com/vpn/manual-setup/main/openvpn">Surfshark manual-setup page</a>.</p>
-<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-17-1"><a id="__codelineno-17-1" name="__codelineno-17-1" href="#__codelineno-17-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
-</span><span id="__span-17-2"><a id="__codelineno-17-2" name="__codelineno-17-2" href="#__codelineno-17-2"></a><span class="w">  </span><span class="nt">surfsharkvpn</span><span class="p">:</span>
-</span><span id="__span-17-3"><a id="__codelineno-17-3" name="__codelineno-17-3" href="#__codelineno-17-3"></a><span class="w">    </span><span class="nt">username</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_USERNAME</span>
-</span><span id="__span-17-4"><a id="__codelineno-17-4" name="__codelineno-17-4" href="#__codelineno-17-4"></a><span class="w">    </span><span class="nt">password</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_PASSWORD</span>
-</span><span id="__span-17-5"><a id="__codelineno-17-5" name="__codelineno-17-5" href="#__codelineno-17-5"></a><span class="w">    </span><span class="nt">server_map</span><span class="p">:</span><span class="w">                </span><span class="c1"># optional</span>
-</span><span id="__span-17-6"><a id="__codelineno-17-6" name="__codelineno-17-6" href="#__codelineno-17-6"></a><span class="w">      </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">1234</span>
+<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-20-1"><a id="__codelineno-20-1" name="__codelineno-20-1" href="#__codelineno-20-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
+</span><span id="__span-20-2"><a id="__codelineno-20-2" name="__codelineno-20-2" href="#__codelineno-20-2"></a><span class="w">  </span><span class="nt">surfsharkvpn</span><span class="p">:</span>
+</span><span id="__span-20-3"><a id="__codelineno-20-3" name="__codelineno-20-3" href="#__codelineno-20-3"></a><span class="w">    </span><span class="nt">username</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_USERNAME</span>
+</span><span id="__span-20-4"><a id="__codelineno-20-4" name="__codelineno-20-4" href="#__codelineno-20-4"></a><span class="w">    </span><span class="nt">password</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_PASSWORD</span>
+</span><span id="__span-20-5"><a id="__codelineno-20-5" name="__codelineno-20-5" href="#__codelineno-20-5"></a><span class="w">    </span><span class="nt">server_map</span><span class="p">:</span><span class="w">                </span><span class="c1"># optional</span>
+</span><span id="__span-20-6"><a id="__codelineno-20-6" name="__codelineno-20-6" href="#__codelineno-20-6"></a><span class="w">      </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">1234</span>
 </span></code></pre></div>
 <p><strong>Required keys:</strong> <code>username</code>, <code>password</code>, validated with the same 48-character rule as
 NordVPN (combined username+password must be 48 alphanumeric characters, case-insensitive, no <code>@</code>).
@@ -3221,13 +3526,13 @@ NordVPN (combined username+password must be 48 alphanumeric characters, case-ins
 <p>Windscribe uses <strong>Service Credentials</strong> from its
 <a href="https://windscribe.com/getconfig/openvpn">OpenVPN config page</a>. unshackle only makes
 sure that a username and a password are present (there is no 48-character rule).</p>
-<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-18-1"><a id="__codelineno-18-1" name="__codelineno-18-1" href="#__codelineno-18-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
-</span><span id="__span-18-2"><a id="__codelineno-18-2" name="__codelineno-18-2" href="#__codelineno-18-2"></a><span class="w">  </span><span class="nt">windscribevpn</span><span class="p">:</span>
-</span><span id="__span-18-3"><a id="__codelineno-18-3" name="__codelineno-18-3" href="#__codelineno-18-3"></a><span class="w">    </span><span class="nt">username</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_USERNAME</span>
-</span><span id="__span-18-4"><a id="__codelineno-18-4" name="__codelineno-18-4" href="#__codelineno-18-4"></a><span class="w">    </span><span class="nt">password</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_PASSWORD</span>
-</span><span id="__span-18-5"><a id="__codelineno-18-5" name="__codelineno-18-5" href="#__codelineno-18-5"></a><span class="w">    </span><span class="nt">server_map</span><span class="p">:</span><span class="w">                       </span><span class="c1"># optional: alias -&gt; hostname</span>
-</span><span id="__span-18-6"><a id="__codelineno-18-6" name="__codelineno-18-6" href="#__codelineno-18-6"></a><span class="w">      </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">us-east.totallyacdn.com</span>
-</span><span id="__span-18-7"><a id="__codelineno-18-7" name="__codelineno-18-7" href="#__codelineno-18-7"></a><span class="w">      </span><span class="nt">us:seattle</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">us-seattle.totallyacdn.com</span>
+<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-21-1"><a id="__codelineno-21-1" name="__codelineno-21-1" href="#__codelineno-21-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
+</span><span id="__span-21-2"><a id="__codelineno-21-2" name="__codelineno-21-2" href="#__codelineno-21-2"></a><span class="w">  </span><span class="nt">windscribevpn</span><span class="p">:</span>
+</span><span id="__span-21-3"><a id="__codelineno-21-3" name="__codelineno-21-3" href="#__codelineno-21-3"></a><span class="w">    </span><span class="nt">username</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_USERNAME</span>
+</span><span id="__span-21-4"><a id="__codelineno-21-4" name="__codelineno-21-4" href="#__codelineno-21-4"></a><span class="w">    </span><span class="nt">password</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_PASSWORD</span>
+</span><span id="__span-21-5"><a id="__codelineno-21-5" name="__codelineno-21-5" href="#__codelineno-21-5"></a><span class="w">    </span><span class="nt">server_map</span><span class="p">:</span><span class="w">                       </span><span class="c1"># optional: alias -&gt; hostname</span>
+</span><span id="__span-21-6"><a id="__codelineno-21-6" name="__codelineno-21-6" href="#__codelineno-21-6"></a><span class="w">      </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">us-east.totallyacdn.com</span>
+</span><span id="__span-21-7"><a id="__codelineno-21-7" name="__codelineno-21-7" href="#__codelineno-21-7"></a><span class="w">      </span><span class="nt">us:seattle</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">us-seattle.totallyacdn.com</span>
 </span></code></pre></div>
 <p><strong>Required keys:</strong> <code>username</code>, <code>password</code>. <code>server_map</code> optionally maps a region (or
 <code>region:city</code>) directly to a hostname.</p>
@@ -3269,16 +3574,21 @@ developer note below.</p>
 <p>unshackle has <strong>two</strong> proxy-resolution code paths that are intentionally not
 identical:</p>
 <ul>
-<li><code>unshackle/commands/dl.py</code> inlines its own logic and loads <strong>all eight</strong> providers,
+<li><code>unshackle/commands/dl.py</code> inlines its own logic and loads <strong>all nine</strong> providers,
  including Windscribe and Gluetun.</li>
 <li><code>unshackle/core/proxies/resolve.py::initialize_proxy_providers()</code> is the shared
  resolver used by the REST API handlers and the remote-service client. It <strong>omits</strong>
  Windscribe and Gluetun.</li>
 </ul>
-<p>Both paths accept the same query grammar (a direct URI, a <code>provider:query</code>, or a bare
-country query tried against providers in order), but the set of available providers
-differs. Keep this in mind when you add a proxy provider: an entry in <code>dl.py</code> does not
-make it available over the API, and the opposite is also true.</p>
+<p>Both paths accept the same query grammar (a direct URI, a <code>provider:query</code>, a bare
+country query tried against providers in order, or a <code>controld://</code> resolver), but the
+set of available providers differs. Keep this in mind when you add a proxy provider:
+an entry in <code>dl.py</code> does not make it available over the API, and the opposite is also
+true.</p>
+<p>The remote-service client resolves <code>--proxy</code> with its own
+<code>resolve_remote_proxy_arg()</code>. It changes a <code>controld:</code> query to a <code>controld://</code>
+resolver for the server with <code>get_remote_proxy()</code>, and it removes Control D from a bare
+query, because a loopback forwarder is of no use to a server on another machine.</p>
 </div>
 <div class="admonition note">
 <p class="admonition-title">Implementing a new provider (developers)</p>
@@ -2153,7 +2153,7 @@ at a title and it will:</p>
 </tr>
 <tr>
 <td>Proxies</td>
-<td>Basic proxies plus NordVPN, ProtonVPN, Surfshark, Windscribe, ExpressVPN, Gluetun, and Hola providers</td>
+<td>Basic proxies plus Control D, NordVPN, ProtonVPN, Surfshark, Windscribe, ExpressVPN, Gluetun, and Hola providers</td>
 </tr>
 <tr>
 <td>Services</td>
@@ -1220,6 +1220,23 @@
    </span>
  </a>
  
+    <nav class="md-nav" aria-label="proxy_providers">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#controld" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        controld
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
      
    </ul>
@@ -2026,6 +2043,23 @@
    </span>
  </a>
  
+    <nav class="md-nav" aria-label="proxy_providers">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#controld" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        controld
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
 </li>
      
    </ul>
@@ -2205,6 +2239,12 @@ for the full proxy provider guide. Recognised proxy providers and their exit por
 <td>as specified</td>
 </tr>
 <tr>
+<td>Control D</td>
+<td><code>controld</code></td>
+<td>Write API token (profile/resolver pairs optional)</td>
+<td><code>http://127.0.0.1:{port}</code> (local forwarder)</td>
+</tr>
+<tr>
 <td>NordVPN</td>
 <td><code>nordvpn</code></td>
 <td><strong>service</strong> credentials (48 chars combined)</td>
@@ -2258,6 +2298,51 @@ for the full proxy provider guide. Recognised proxy providers and their exit por
 </span><span id="__span-2-8"><a id="__codelineno-2-8" name="__codelineno-2-8" href="#__codelineno-2-8"></a><span class="w">    </span><span class="nt">username</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">&lt;service username&gt;</span>
 </span><span id="__span-2-9"><a id="__codelineno-2-9" name="__codelineno-2-9" href="#__codelineno-2-9"></a><span class="w">    </span><span class="nt">password</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">&lt;service password&gt;</span>
 </span></code></pre></div>
+<h3 id="controld"><code>controld</code><a class="headerlink" href="#controld" title="Permanent link">&para;</a></h3>
+<p>Config keys of the Control D proxy provider. See
+<a href="../../../guide/proxies-and-vpn/#control-d">Control D</a> for how unshackle uses them.</p>
+<table>
+<thead>
+<tr>
+<th>Key</th>
+<th>Type</th>
+<th>Default</th>
+<th>Meaning</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>token</code></td>
+<td><code>str</code></td>
+<td>required</td>
+<td>A Control D API token of type <em>Write</em>.</td>
+</tr>
+<tr>
+<td><code>profile</code></td>
+<td><code>str</code></td>
+<td>none</td>
+<td>Optional. The ID of a profile you made for unshackle. Give it together with <code>resolver</code>. Without it, unshackle creates <code>unshackle-&lt;region&gt;</code> profiles itself.</td>
+</tr>
+<tr>
+<td><code>resolver</code></td>
+<td><code>str</code></td>
+<td>none</td>
+<td>Optional. The resolver ID of an endpoint that uses <code>profile</code>, or its DoH URL <code>https://dns.controld.com/&lt;resolver&gt;</code>.</td>
+</tr>
+<tr>
+<td><code>profiles</code></td>
+<td><code>list</code></td>
+<td><code>[]</code></td>
+<td>Optional. More pairs, each a mapping with <code>profile</code> and <code>resolver</code>.</td>
+</tr>
+<tr>
+<td><code>max_profiles</code></td>
+<td><code>int</code></td>
+<td><code>4</code></td>
+<td>The most profiles unshackle uses: your pairs plus the <code>unshackle-*</code> endpoints on the account. It must be 1 or more. unshackle creates an <code>unshackle-&lt;region&gt;</code> profile and endpoint only while the total is lower.</td>
+</tr>
+</tbody>
+</table>
 <div class="admonition note">
 <p class="admonition-title">Provider loading differs between CLI and REST server</p>
 <p>The <code>dl</code> CLI loads all providers, including <code>windscribevpn</code> and <code>gluetun</code>. The REST API /
@@ -2,154 +2,154 @@
 <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
    <url>
         <loc>https://docs.unshackle.dev/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/dev/creating-a-service/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/dev/service-architecture/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/dev/rest-api/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/dev/rest-api/authentication/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/dev/rest-api/dashboard/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/dev/rest-api/endpoints/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/dev/rest-api/errors/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/dev/rest-api/job-lifecycle/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/dev/rest-api/quickstart/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/dev/rest-api/remote-sessions/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/getting-started/configuration-file/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/getting-started/installation/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/getting-started/quickstart/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/guide/cli-reference/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/guide/downloading/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/guide/drm-and-cdm/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/guide/output-and-naming/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/guide/proxies-and-vpn/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/guide/subtitles/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/guide/troubleshooting/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/guide/vaults/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/reference/api/config/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/reference/api/drm/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/reference/api/service/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/reference/api/titles/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/reference/api/tracks/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/reference/configuration/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/reference/configuration/directories/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/reference/configuration/download/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/reference/configuration/drm/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/reference/configuration/example/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/reference/configuration/misc/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/reference/configuration/network/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/reference/configuration/output/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/reference/configuration/post-scripts/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/reference/configuration/services/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
    <url>
         <loc>https://docs.unshackle.dev/reference/configuration/vaults/</loc>
-         <lastmod>2026-09-22</lastmod>
+         <lastmod>2026-09-23</lastmod>
    </url>
 </urlset>