kenzuya/unshackle
1
0
Fork 2
mirror of https://github.com/unshackle-dl/unshackle.git synced 2026-11-14 21:15:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Deployed 783c8ae with MkDocs version: 1.6.1

Browse Source
This commit is contained in:
2026-09-23 19:24:51 +00:00
parent 01132494ca
commit aa857c835a
10 changed files with 546 additions and 131 deletions
Download Patch File Download Diff File Expand all files Collapse all files
guide/cli-reference/index.html
+2 -2
View File
@@ -3353,7 +3353,7 @@ and keeps the service's numbering unchanged. Pick an order that covers the whole
<tbody>
<tr>
<td><code>--proxy</code></td>
<td>Proxy URI, a 2-letter country code resolved from configured providers, or <code>provider:region</code> (e.g. <code>nordvpn:ca</code>, <code>gluetun:us</code>, <code>protonvpn:de:berlin</code>).</td>
<td>Proxy URI, a country or location code resolved from configured providers, or <code>provider:region</code> (e.g. <code>nordvpn:ca</code>, <code>gluetun:us</code>, <code>protonvpn:de:berlin</code>, <code>controld:yul</code>).</td>
</tr>
<tr>
<td><code>--no-proxy</code></td>
@@ -3463,7 +3463,7 @@ and keeps the service's numbering unchanged. Pick an order that covers the whole
</tr>
<tr>
<td><code>--proxy</code></td>
<td>Proxy URI, 2-letter country code, or <code>provider:region</code>.</td>
<td>Proxy URI, country or location code, or <code>provider:region</code> (e.g. <code>controld:ca</code>).</td>
</tr>
<tr>
<td><code>--no-proxy</code></td>
guide/downloading/index.html
+20 -6
View File
@@ -3900,11 +3900,13 @@ post-scripts and for the full variable list, see
<div class="language-shell highlight"><span class="filename">Custom group tag and a REPACK label</span><pre><span></span><code><span id="__span-38-1"><a id="__codelineno-38-1" name="__codelineno-38-1" href="#__codelineno-38-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--tag<span class="w"> </span>MYGRP<span class="w"> </span>--repack<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
</span></code></pre></div>
<h2 id="proxies">Proxies<a class="headerlink" href="#proxies" title="Permanent link">&para;</a></h2>
<p><code>--proxy</code> accepts a full proxy URI, a 2-letter country code (resolved through your
configured proxy providers), or a <code>provider:region</code> form.</p>
<p><code>--proxy</code> accepts a full proxy URI, a country or location code (resolved through your
configured proxy providers), or a <code>provider:region</code> form. See
<a href="../proxies-and-vpn/#how-proxy-resolution-works">Proxies &amp; VPN</a> for the exact grammar.</p>
<div class="language-shell highlight"><span class="filename">Proxy forms</span><pre><span></span><code><span id="__span-39-1"><a id="__codelineno-39-1" name="__codelineno-39-1" href="#__codelineno-39-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>us<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
</span><span id="__span-39-2"><a id="__codelineno-39-2" name="__codelineno-39-2" href="#__codelineno-39-2"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>nordvpn:ca<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
</span><span id="__span-39-3"><a id="__codelineno-39-3" name="__codelineno-39-3" href="#__codelineno-39-3"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span><span class="s1">'http://user:pass@host:8080'</span><span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
</span><span id="__span-39-3"><a id="__codelineno-39-3" name="__codelineno-39-3" href="#__codelineno-39-3"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>controld:yul<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
</span><span id="__span-39-4"><a id="__codelineno-39-4" name="__codelineno-39-4" href="#__codelineno-39-4"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span><span class="s1">'http://user:pass@host:8080'</span><span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
</span></code></pre></div>
<p>Three related flags:</p>
<ul>
@@ -3974,11 +3976,23 @@ a content key when the vault misses. You can force one side or the other:</p>
</ul>
<div class="language-shell highlight"><span class="filename">Fetch keys only, no download</span><pre><span></span><code><span id="__span-42-1"><a id="__codelineno-42-1" name="__codelineno-42-1" href="#__codelineno-42-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--skip-dl<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
</span></code></pre></div>
<p><code>--export</code> writes a JSON file, into the configured exports directory, containing track
info and the acquired content keys for each title. This is the format consumed by
<code>unshackle import</code> to reconstruct a download later.</p>
<p><code>--export</code> writes a <code>mediaexport</code> JSON file into the configured exports directory. It holds
the manifest, the DRM init data, the content keys and the title metadata for each title.
<code>unshackle import</code> reads it to reconstruct a download later. The importer also reads the
older unshackle <code>version: 2</code> files and unidl's own export files.</p>
<div class="language-shell highlight"><span class="filename">Export track info and keys</span><pre><span></span><code><span id="__span-43-1"><a id="__codelineno-43-1" name="__codelineno-43-1" href="#__codelineno-43-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--skip-dl<span class="w"> </span>--export<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
</span></code></pre></div>
<p>The export holds a content key for each track your flags selected and no others. To make a
file another person can use, select generously: for example <code>-a AAC,EC3</code> and every language
you want them to have. An import can only pick tracks whose key is in the file. A subtitle
that another tool exported as a direct URL is added next to the manifest's own.</p>
<div class="admonition warning">
<p class="admonition-title">The export file is a secret</p>
<p>It holds the content keys and usually a signed manifest URL. Hand it over on purpose,
not by accident.</p>
</div>
<p>The <a href="https://github.com/unshackle-dl/mediaexport">mediaexport</a> package specifies the
<code>mediaexport</code> format and is the reader and writer unshackle uses.</p>
<div class="admonition note">
<p class="admonition-title">Region is recorded only with a proxy</p>
<p>When you use <code>--proxy</code>, the export records the region so an import can reproduce the
guide/proxies-and-vpn/index.html
+387 -77
View File
@@ -913,6 +913,56 @@
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#control-d" class="md-nav__link">
<span class="md-ellipsis">
Control D
</span>
</a>
<nav class="md-nav" aria-label="Control D">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#what-you-need" class="md-nav__link">
<span class="md-ellipsis">
What you need
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#how-unshackle-chooses-a-profile" class="md-nav__link">
<span class="md-ellipsis">
How unshackle chooses a profile
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#troubleshooting-control-d" class="md-nav__link">
<span class="md-ellipsis">
Troubleshooting Control D
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
@@ -2320,6 +2370,56 @@
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#control-d" class="md-nav__link">
<span class="md-ellipsis">
Control D
</span>
</a>
<nav class="md-nav" aria-label="Control D">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#what-you-need" class="md-nav__link">
<span class="md-ellipsis">
What you need
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#how-unshackle-chooses-a-profile" class="md-nav__link">
<span class="md-ellipsis">
How unshackle chooses a profile
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#troubleshooting-control-d" class="md-nav__link">
<span class="md-ellipsis">
Troubleshooting Control D
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
@@ -2511,7 +2611,7 @@ self-hosted tunnels), then ask for a country by its two-letter code and let
unshackle pick a working server for you.</p>
<p>The <code>--proxy</code> flag controls proxying, and the proxy providers unshackle supports change
a query to a real proxy URL: <a href="#basic-static-proxies">basic static proxies</a>,
<a href="#gluetun">Gluetun</a> (documented in the most detail, since it is the most flexible),
<a href="#control-d">Control D</a>, <a href="#gluetun">Gluetun</a> (documented in the most detail, since it is the most flexible),
<a href="#expressvpn">ExpressVPN</a>, <a href="#nordvpn">NordVPN</a>, <a href="#proton-vpn">Proton VPN</a>,
<a href="#hola">Hola</a>, <a href="#surfshark">Surfshark</a>, and <a href="#windscribe">Windscribe</a>.</p>
<div class="admonition note">
@@ -2608,19 +2708,32 @@ them in this order.</p>
asks each loaded proxy provider <strong>in order</strong> and uses the first proxy any of them
returns.</li>
</ol>
<p>unshackle compares the query against a region grammar: a two-letter country code,
optionally followed by a server number and/or a <code>:city</code> or <code>-city</code> part. It then
<p>unshackle compares the query against a region grammar: a country or location code of two
to four letters, with an optional <code>_code</code> part (<code>res_yyz</code>), then an optional server
number and/or a <code>:city</code> or <code>-city</code> part. A <code>host:port</code> value never matches. It then
lowercases the query and hands it to the proxy provider. Its section below gives the
exact forms each proxy provider accepts.</p>
<p>A Control D resolver, <code>controld://&lt;resolver&gt;@dns.controld.com</code>, is a fourth form. A
<code>--remote</code> client sends it to a server in place of a proxy URI, and the server starts a
forwarder for it. See <a href="#control-d">Control D</a>.</p>
<h3 id="provider-load-order">Provider load order<a class="headerlink" href="#provider-load-order" title="Permanent link">&para;</a></h3>
<p>When you do a download without <code>--no-proxy</code>, unshackle instantiates every configured
proxy provider once, in this fixed order. It uses that same order for bare-query
resolution:</p>
<p><strong>Basic → ExpressVPN → NordVPN → Proton VPN → Surfshark → Windscribe → Gluetun → Hola</strong></p>
<p><strong>Basic → ExpressVPN → NordVPN → Proton VPN → Surfshark → Windscribe → Gluetun → Hola → Control D</strong></p>
<p>So if you have both Basic and NordVPN configured and use <code>--proxy us</code>, a <code>us</code> entry in
your Basic config wins, because unshackle tries Basic first. To skip ahead to a specific
proxy provider, prefix the query (<code>--proxy nordvpn:us</code>).</p>
<div class="admonition note">
<p class="admonition-title">A bare region reaches Control D last</p>
<p>unshackle asks Control D for a bare region such as <code>--proxy us</code> only when no other
loaded proxy provider has a proxy for it. Hola loads automatically when the
<code>hola-proxy</code> binary is on your <code>PATH</code>, and it comes before Control D. When Control D answers, it changes your Control D
account: it points a profile at that country, and it can create an <code>unshackle-us</code>
profile and endpoint. The geofence auto-proxy uses the same order. To use Control D
directly, prefix the query (<code>--proxy controld:us</code>).</p>
</div>
<div class="admonition note">
<p class="admonition-title">Auto-loading providers</p>
<p>Most providers only load when you configure them under <code>proxy_providers:</code>. Three are
special: <strong>ExpressVPN</strong> and <strong>Proton VPN</strong> also load automatically once their cache
@@ -2690,6 +2803,198 @@ them:</p>
</ul>
<div class="language-shell highlight"><pre><span></span><code><span id="__span-6-1"><a id="__codelineno-6-1" name="__codelineno-6-1" href="#__codelineno-6-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>de2<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
</span></code></pre></div>
<h2 id="control-d">Control D<a class="headerlink" href="#control-d" title="Permanent link">&para;</a></h2>
<p><a href="https://controld.com">Control D</a> is a DNS service, not a proxy. It answers the hostnames
it redirects with the IP of a transparent proxy in the region you chose, and that proxy
relays onwards by SNI. There is no proxy URI to hand to Requests, so this proxy provider runs a
small <strong>forwarder on loopback</strong>: it resolves each connection through your Control D
resolver and relays the bytes. Everything downstream (the service session, the downloads,
<code>--proxy-download</code>) sees an ordinary HTTP proxy.</p>
<p>unshackle picks the region itself, by pointing a profile's <strong>default rule</strong> at it. A profile
holds one region at a time, so unshackle gives each region in use a profile of its own,
each with its own endpoint and its own forwarder port. <code>--proxy controld:yyz
--proxy-download controld:yul</code> therefore uses two profiles, when two are free: Toronto for
the service and Montreal for the downloads. When no second profile is free, the second
region moves the first profile (see <a href="#how-unshackle-chooses-a-profile">step 5</a>).</p>
<p>Keep both locations in one country. Some CDNs also check the country of the download IP,
and refuse a <code>--proxy-download</code> exit in another country with a 403. This applies to every
proxy provider.</p>
<p><code>unshackle search --proxy controld:ca</code> works the same way as <code>dl</code>.</p>
<h3 id="what-you-need">What you need<a class="headerlink" href="#what-you-need" title="Permanent link">&para;</a></h3>
<ul>
<li><strong>A plan with traffic redirection.</strong> On the personal plans that is <em>Full Control</em>;
<em>Some Control</em> has no redirection, and every redirect fails. The 14-day trial includes
it. See <a href="https://controld.com/plans">Control D's plans</a> for current prices.</li>
<li><strong>An API token of type <em>Write</em>.</strong> A <em>Read</em> token cannot change a profile's default rule.
Create it in the dashboard under <em>API</em>. If you set <em>Allowed IPs</em> on the token, include
the address of each machine that runs unshackle with it.</li>
</ul>
<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-7-1"><a id="__codelineno-7-1" name="__codelineno-7-1" href="#__codelineno-7-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
</span><span id="__span-7-2"><a id="__codelineno-7-2" name="__codelineno-7-2" href="#__codelineno-7-2"></a><span class="w"> </span><span class="nt">controld</span><span class="p">:</span>
</span><span id="__span-7-3"><a id="__codelineno-7-3" name="__codelineno-7-3" href="#__codelineno-7-3"></a><span class="w"> </span><span class="nt">token</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">api.xxxxxxxxxxxx</span><span class="w"> </span><span class="c1"># a Write API token, from the Control D dashboard</span>
</span></code></pre></div>
<div class="language-shell highlight"><pre><span></span><code><span id="__span-8-1"><a id="__codelineno-8-1" name="__codelineno-8-1" href="#__codelineno-8-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>controld:ca<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
</span></code></pre></div>
<p>The token is the only required key. You do not need to create a profile or an endpoint,
or to give a <code>profile</code> and <code>resolver</code>: unshackle creates an <code>unshackle-&lt;region&gt;</code> profile
and endpoint on your account the first time it needs one, and uses it again on the next
run. Give <code>profile</code> and <code>resolver</code> only to use a profile that you made yourself (see
<a href="#how-unshackle-chooses-a-profile">How unshackle chooses a profile</a>).</p>
<p>The returned proxy is HTTP on loopback,
<code>http://127.0.0.1:{port}</code>. The locations themselves are read from Control D at startup
(107 of them across 68 countries, at the time of writing), so there is nothing to list:</p>
<table>
<thead>
<tr>
<th>Query</th>
<th>Meaning</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>ca</code></td>
<td>One of Control D's Canadian locations, at random.</td>
</tr>
<tr>
<td><code>yul</code></td>
<td>That exact location, by its code.</td>
</tr>
<tr>
<td><code>res_yyz</code></td>
<td>A residential location, by its code. A country pick never uses a residential location, so name it this way.</td>
</tr>
</tbody>
</table>
<p>The <a href="../../reference/configuration/network/#controld">configuration reference</a> lists
every <code>controld</code> config key.</p>
<h3 id="how-unshackle-chooses-a-profile">How unshackle chooses a profile<a class="headerlink" href="#how-unshackle-chooses-a-profile" title="Permanent link">&para;</a></h3>
<p>Each region query gets a profile and an endpoint named after it: <code>--proxy controld:ca</code> uses
<code>unshackle-ca</code>. For each region, unshackle uses the first match in this list:</p>
<ol>
<li>A profile that this process already pointed at that region.</li>
<li>The endpoint named <code>unshackle-&lt;region&gt;</code> on your account, made by an earlier run.</li>
<li>
<p>A profile from your config that this process does not use yet. These are optional:</p>
<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-9-1"><a id="__codelineno-9-1" name="__codelineno-9-1" href="#__codelineno-9-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
</span><span id="__span-9-2"><a id="__codelineno-9-2" name="__codelineno-9-2" href="#__codelineno-9-2"></a><span class="w"> </span><span class="nt">controld</span><span class="p">:</span>
</span><span id="__span-9-3"><a id="__codelineno-9-3" name="__codelineno-9-3" href="#__codelineno-9-3"></a><span class="w"> </span><span class="nt">token</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">api.xxxxxxxxxxxx</span>
</span><span id="__span-9-4"><a id="__codelineno-9-4" name="__codelineno-9-4" href="#__codelineno-9-4"></a><span class="w"> </span><span class="nt">profile</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">abcd123</span><span class="w"> </span><span class="c1"># a profile kept for unshackle, and nothing else</span>
</span><span id="__span-9-5"><a id="__codelineno-9-5" name="__codelineno-9-5" href="#__codelineno-9-5"></a><span class="w"> </span><span class="nt">resolver</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">efgh456</span><span class="w"> </span><span class="c1"># the resolver ID of an endpoint using that profile</span>
</span><span id="__span-9-6"><a id="__codelineno-9-6" name="__codelineno-9-6" href="#__codelineno-9-6"></a><span class="w"> </span><span class="nt">profiles</span><span class="p">:</span><span class="w"> </span><span class="c1"># more pairs, in the same shape</span>
</span><span id="__span-9-7"><a id="__codelineno-9-7" name="__codelineno-9-7" href="#__codelineno-9-7"></a><span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">profile</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">ijkl789</span>
</span><span id="__span-9-8"><a id="__codelineno-9-8" name="__codelineno-9-8" href="#__codelineno-9-8"></a><span class="w"> </span><span class="nt">resolver</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">mnop012</span>
</span><span id="__span-9-9"><a id="__codelineno-9-9" name="__codelineno-9-9" href="#__codelineno-9-9"></a><span class="w"> </span><span class="nt">max_profiles</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">4</span><span class="w"> </span><span class="c1"># the most profiles unshackle uses, yours included (default 4)</span>
</span></code></pre></div>
<p>The resolver ID is the last part of the endpoint's DoH URL,
<code>https://dns.controld.com/&lt;resolver&gt;</code>. You can also give the full URL.</p>
</li>
<li>
<p>A new profile and endpoint named <code>unshackle-&lt;region&gt;</code>, while your config pairs plus the
<code>unshackle-*</code> endpoints on the account are fewer than <code>max_profiles</code>. unshackle keeps
them for the next run. <code>max_profiles</code> limits only this step: unshackle uses every pair
in your config, even more than <code>max_profiles</code>.</p>
</li>
<li>When no profile is free, a profile moves to the new region, with everything that still
uses it. unshackle first moves a profile that this process has not pointed at a region,
which another process can still use. Next, it moves the profile that this process
pointed at a region first. An <code>unshackle-*</code> profile that moves, and its endpoint, get the
new region's name. unshackle logs <code>Every Control D profile is in use; moving profile … to …</code>,
and connections already open keep the old exit until they close.</li>
</ol>
<p>Because the names live on the account, every unshackle process agrees on them: two runs,
or two jobs on a <code>serve</code> instance, that ask for <code>ca</code> both use <code>unshackle-ca</code>. Two processes
can still move a profile under each other when they run out of profiles (step 5).</p>
<p>unshackle changes only the profiles in your config and the profiles of <code>unshackle-*</code>
endpoints. It skips an <code>unshackle-*</code> endpoint whose profile an endpoint without that name
also uses, so unshackle never redirects a profile that serves your own devices. Leave the <code>unshackle-*</code>
profiles empty: no services, no custom rules. unshackle sets their default rule to
<code>REDIRECT</code>, and the <em>Services</em> and <em>Custom Rules</em> tabs stay at zero by design. To remove
them, delete the endpoints and profiles in the dashboard. unshackle creates new ones when
it next needs them.</p>
<div class="admonition warning">
<p class="admonition-title">Business accounts pay per endpoint</p>
<p>Personal plans allow an unlimited number of profiles and endpoints. Business plans bill
each endpoint every month, so each <code>unshackle-&lt;country&gt;</code> endpoint adds to the bill. On a business
account, configure your own pairs, as many as the countries you use at the same time,
and set <code>max_profiles</code> to that number. unshackle then never creates a profile.</p>
</div>
<div class="admonition note">
<p class="admonition-title">Everything goes through the proxy, including the segments</p>
<p>With the default rule redirecting, the whole download leaves through Control D's
transparent proxy. Control D serves it on a best-effort basis. Pair it with <code>--no-proxy-download</code> to
keep the geo-check on the manifest and the licence while pulling the files over your
own connection.</p>
</div>
<div class="admonition note">
<p class="admonition-title">The switch is not instant</p>
<p>unshackle drops its own DNS cache when it changes region, but Control D's edge may
still serve the previous answer for the remainder of the record's TTL.</p>
</div>
<div class="admonition note">
<p class="admonition-title">Same machine, same IP, over IPv4</p>
<p>Control D authorises its proxies by source IP: the address that queried DNS is the one
allowed to use the proxy. The forwarder resolves and connects from the same host, so
this holds. Control D also answers a redirected name only to a query over IPv4, so the
forwarder asks over IPv4 even on a host with IPv6, and ignores <code>HTTPS_PROXY</code> for these
queries.</p>
<p>The forwarder refuses a connection to an IP address with a <code>502</code>, because an IP address
skips Control D's DNS and connects from your own address. A request that names a host
by IP address fails with this proxy provider.</p>
</div>
<div class="admonition note">
<p class="admonition-title">With <code>--remote</code>, the server resolves</p>
<p>unshackle does not send your API token to a server. For <code>--proxy controld:ca</code> with
<code>--remote</code>, unshackle points <code>unshackle-ca</code> at Canada with your token, then sends the
server only that endpoint's resolver ID, as <code>controld://&lt;resolver&gt;@dns.controld.com</code>.
The server runs its own forwarder with it, from its own address, and needs no Control D
configuration. The resolver ID lets anyone who has it use that endpoint's proxy, so treat
it as a secret: unshackle masks it in logs and in stored job parameters.</p>
<p>The server must run a version of unshackle that knows <code>controld://</code>. An older server
rejects it with <code>INVALID_PROXY</code>: <code>Proxy provider 'controld' not found</code> when your API key
has <code>server_proxy</code>, else a message that asks for a full proxy URI. A bare region, such
as <code>--proxy ca</code>, skips Control D with <code>--remote</code>, because the proxy it gives is on your
machine. A service whose accounts the server manages does not accept a proxy from the
client, and that includes a Control D resolver.</p>
</div>
<h3 id="troubleshooting-control-d">Troubleshooting Control D<a class="headerlink" href="#troubleshooting-control-d" title="Permanent link">&para;</a></h3>
<table>
<thead>
<tr>
<th>Symptom</th>
<th>Cause and fix</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>Proxy check failed</code>, because the exit IP is your own IP.</td>
<td>The profile does not redirect. Make sure that the plan includes traffic redirection (<em>Full Control</em>, not <em>Some Control</em>). After a region change, wait for the TTL of the previous answer to end.</td>
</tr>
<tr>
<td>A <code>502 Bad Gateway</code> for one host. With <code>-d</code>, the log shows <code>Control D returned no A record for …</code>.</td>
<td>Control D gave no IPv4 address for that host.</td>
</tr>
<tr>
<td>A <code>502 Bad Gateway</code> for one host only. With <code>-d</code>, the log shows <code>Refused …, an address that Control D cannot redirect</code>.</td>
<td>The request names the host by IP address. The forwarder refuses it. See the note on IPv4 above.</td>
</tr>
<tr>
<td>An HTTP <code>401</code> or <code>403</code> from <code>api.controld.com</code>.</td>
<td>The token is a <em>Read</em> token, or its <em>Allowed IPs</em> do not include this machine. Use a <em>Write</em> token.</td>
</tr>
<tr>
<td><code>Control D needs both a profile and a resolver</code> or <code>Control D needs max_profiles of 1 or more</code> at startup.</td>
<td>The <code>controld</code> config is not valid. Give <code>profile</code> and <code>resolver</code> together, and a <code>max_profiles</code> of 1 or more. Every run fails until you correct it, also a run that does not use Control D.</td>
</tr>
<tr>
<td><code>Could not read Control D's locations</code>.</td>
<td>unshackle could not get the location list. It tries again at the next Control D query.</td>
</tr>
<tr>
<td>A <code>403</code> for the segments only, with <code>--proxy-download</code> in another country.</td>
<td>The CDN checks the country of the download IP. Keep <code>--proxy-download</code> in the same country as <code>--proxy</code>.</td>
</tr>
</tbody>
</table>
<h2 id="gluetun">Gluetun<a class="headerlink" href="#gluetun" title="Permanent link">&para;</a></h2>
<p>Gluetun is unshackle's most flexible proxy backend, and the one to reach for if you want
one configuration to cover many VPN providers. Instead of returning a remote proxy URL,
@@ -2719,11 +3024,11 @@ to <code>/dev/net/tun</code> to bring up the tunnel. unshackle requests both aut
<h3 id="query-format">Query format<a class="headerlink" href="#query-format" title="Permanent link">&para;</a></h3>
<p>Gluetun uses a nested selector: the proxy provider prefix picks Gluetun, and the rest names the
<strong>VPN provider</strong> and the <strong>region</strong>.</p>
<div class="language-text highlight"><pre><span></span><code><span id="__span-7-1"><a id="__codelineno-7-1" name="__codelineno-7-1" href="#__codelineno-7-1"></a>gluetun:&lt;vpn-provider&gt;:&lt;region&gt;
<div class="language-text highlight"><pre><span></span><code><span id="__span-10-1"><a id="__codelineno-10-1" name="__codelineno-10-1" href="#__codelineno-10-1"></a>gluetun:&lt;vpn-provider&gt;:&lt;region&gt;
</span></code></pre></div>
<div class="language-shell highlight"><span class="filename">A Windscribe US exit via Gluetun</span><pre><span></span><code><span id="__span-8-1"><a id="__codelineno-8-1" name="__codelineno-8-1" href="#__codelineno-8-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>gluetun:windscribe:us<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
<div class="language-shell highlight"><span class="filename">A Windscribe US exit via Gluetun</span><pre><span></span><code><span id="__span-11-1"><a id="__codelineno-11-1" name="__codelineno-11-1" href="#__codelineno-11-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>gluetun:windscribe:us<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
</span></code></pre></div>
<div class="language-shell highlight"><span class="filename">A NordVPN Germany exit via Gluetun</span><pre><span></span><code><span id="__span-9-1"><a id="__codelineno-9-1" name="__codelineno-9-1" href="#__codelineno-9-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>gluetun:nordvpn:de<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
<div class="language-shell highlight"><span class="filename">A NordVPN Germany exit via Gluetun</span><pre><span></span><code><span id="__span-12-1"><a id="__codelineno-12-1" name="__codelineno-12-1" href="#__codelineno-12-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>gluetun:nordvpn:de<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
</span></code></pre></div>
<p>After unshackle strips the leading <code>gluetun:</code>, the proxy provider receives exactly
<code>provider:region</code>. It must be two colon-separated parts, and anything else is an error.
@@ -2733,36 +3038,36 @@ unshackle normalises friendly names to Gluetun's identifiers (for example <code>
<h3 id="configuration">Configuration<a class="headerlink" href="#configuration" title="Permanent link">&para;</a></h3>
<p>Each VPN provider you want to use gets an entry under <code>providers:</code>, carrying its VPN type,
credentials, and how your region aliases map onto Gluetun's server selectors.</p>
<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-10-1"><a id="__codelineno-10-1" name="__codelineno-10-1" href="#__codelineno-10-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
</span><span id="__span-10-2"><a id="__codelineno-10-2" name="__codelineno-10-2" href="#__codelineno-10-2"></a><span class="w"> </span><span class="nt">gluetun</span><span class="p">:</span>
</span><span id="__span-10-3"><a id="__codelineno-10-3" name="__codelineno-10-3" href="#__codelineno-10-3"></a><span class="w"> </span><span class="nt">providers</span><span class="p">:</span>
</span><span id="__span-10-4"><a id="__codelineno-10-4" name="__codelineno-10-4" href="#__codelineno-10-4"></a><span class="w"> </span><span class="nt">windscribe</span><span class="p">:</span>
</span><span id="__span-10-5"><a id="__codelineno-10-5" name="__codelineno-10-5" href="#__codelineno-10-5"></a><span class="w"> </span><span class="nt">vpn_type</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">wireguard</span>
</span><span id="__span-10-6"><a id="__codelineno-10-6" name="__codelineno-10-6" href="#__codelineno-10-6"></a><span class="w"> </span><span class="nt">credentials</span><span class="p">:</span>
</span><span id="__span-10-7"><a id="__codelineno-10-7" name="__codelineno-10-7" href="#__codelineno-10-7"></a><span class="w"> </span><span class="nt">private_key</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_WIREGUARD_PRIVATE_KEY</span>
</span><span id="__span-10-8"><a id="__codelineno-10-8" name="__codelineno-10-8" href="#__codelineno-10-8"></a><span class="w"> </span><span class="nt">addresses</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_WIREGUARD_ADDRESS</span>
</span><span id="__span-10-9"><a id="__codelineno-10-9" name="__codelineno-10-9" href="#__codelineno-10-9"></a><span class="w"> </span><span class="nt">preshared_key</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_PRESHARED_KEY</span>
</span><span id="__span-10-10"><a id="__codelineno-10-10" name="__codelineno-10-10" href="#__codelineno-10-10"></a><span class="w"> </span><span class="nt">server_countries</span><span class="p">:</span>
</span><span id="__span-10-11"><a id="__codelineno-10-11" name="__codelineno-10-11" href="#__codelineno-10-11"></a><span class="w"> </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">US</span>
</span><span id="__span-10-12"><a id="__codelineno-10-12" name="__codelineno-10-12" href="#__codelineno-10-12"></a><span class="w"> </span><span class="nt">uk</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">GB</span>
</span><span id="__span-10-13"><a id="__codelineno-10-13" name="__codelineno-10-13" href="#__codelineno-10-13"></a><span class="w"> </span><span class="nt">server_cities</span><span class="p">:</span><span class="w"> </span><span class="p p-Indicator">{}</span>
</span><span id="__span-10-14"><a id="__codelineno-10-14" name="__codelineno-10-14" href="#__codelineno-10-14"></a><span class="w"> </span><span class="nt">server_hostnames</span><span class="p">:</span><span class="w"> </span><span class="p p-Indicator">{}</span>
</span><span id="__span-10-15"><a id="__codelineno-10-15" name="__codelineno-10-15" href="#__codelineno-10-15"></a><span class="w"> </span><span class="nt">extra_env</span><span class="p">:</span><span class="w"> </span><span class="p p-Indicator">{}</span>
</span><span id="__span-10-16"><a id="__codelineno-10-16" name="__codelineno-10-16" href="#__codelineno-10-16"></a><span class="w"> </span><span class="nt">nordvpn</span><span class="p">:</span>
</span><span id="__span-10-17"><a id="__codelineno-10-17" name="__codelineno-10-17" href="#__codelineno-10-17"></a><span class="w"> </span><span class="nt">vpn_type</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">wireguard</span>
</span><span id="__span-10-18"><a id="__codelineno-10-18" name="__codelineno-10-18" href="#__codelineno-10-18"></a><span class="w"> </span><span class="nt">credentials</span><span class="p">:</span>
</span><span id="__span-10-19"><a id="__codelineno-10-19" name="__codelineno-10-19" href="#__codelineno-10-19"></a><span class="w"> </span><span class="nt">private_key</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_WIREGUARD_PRIVATE_KEY</span>
</span><span id="__span-10-20"><a id="__codelineno-10-20" name="__codelineno-10-20" href="#__codelineno-10-20"></a><span class="w"> </span><span class="nt">server_countries</span><span class="p">:</span>
</span><span id="__span-10-21"><a id="__codelineno-10-21" name="__codelineno-10-21" href="#__codelineno-10-21"></a><span class="w"> </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">US</span>
</span><span id="__span-10-22"><a id="__codelineno-10-22" name="__codelineno-10-22" href="#__codelineno-10-22"></a><span class="w"> </span><span class="nt">de</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">DE</span>
</span><span id="__span-10-23"><a id="__codelineno-10-23" name="__codelineno-10-23" href="#__codelineno-10-23"></a>
</span><span id="__span-10-24"><a id="__codelineno-10-24" name="__codelineno-10-24" href="#__codelineno-10-24"></a><span class="w"> </span><span class="c1"># Global settings (all optional)</span>
</span><span id="__span-10-25"><a id="__codelineno-10-25" name="__codelineno-10-25" href="#__codelineno-10-25"></a><span class="w"> </span><span class="nt">base_port</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">8888</span>
</span><span id="__span-10-26"><a id="__codelineno-10-26" name="__codelineno-10-26" href="#__codelineno-10-26"></a><span class="w"> </span><span class="nt">auto_cleanup</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">true</span>
</span><span id="__span-10-27"><a id="__codelineno-10-27" name="__codelineno-10-27" href="#__codelineno-10-27"></a><span class="w"> </span><span class="nt">container_prefix</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">unshackle-gluetun</span>
</span><span id="__span-10-28"><a id="__codelineno-10-28" name="__codelineno-10-28" href="#__codelineno-10-28"></a><span class="w"> </span><span class="nt">auth_user</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">null</span>
</span><span id="__span-10-29"><a id="__codelineno-10-29" name="__codelineno-10-29" href="#__codelineno-10-29"></a><span class="w"> </span><span class="nt">auth_password</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">null</span>
</span><span id="__span-10-30"><a id="__codelineno-10-30" name="__codelineno-10-30" href="#__codelineno-10-30"></a><span class="w"> </span><span class="nt">verify_ip</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">true</span>
<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-13-1"><a id="__codelineno-13-1" name="__codelineno-13-1" href="#__codelineno-13-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
</span><span id="__span-13-2"><a id="__codelineno-13-2" name="__codelineno-13-2" href="#__codelineno-13-2"></a><span class="w"> </span><span class="nt">gluetun</span><span class="p">:</span>
</span><span id="__span-13-3"><a id="__codelineno-13-3" name="__codelineno-13-3" href="#__codelineno-13-3"></a><span class="w"> </span><span class="nt">providers</span><span class="p">:</span>
</span><span id="__span-13-4"><a id="__codelineno-13-4" name="__codelineno-13-4" href="#__codelineno-13-4"></a><span class="w"> </span><span class="nt">windscribe</span><span class="p">:</span>
</span><span id="__span-13-5"><a id="__codelineno-13-5" name="__codelineno-13-5" href="#__codelineno-13-5"></a><span class="w"> </span><span class="nt">vpn_type</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">wireguard</span>
</span><span id="__span-13-6"><a id="__codelineno-13-6" name="__codelineno-13-6" href="#__codelineno-13-6"></a><span class="w"> </span><span class="nt">credentials</span><span class="p">:</span>
</span><span id="__span-13-7"><a id="__codelineno-13-7" name="__codelineno-13-7" href="#__codelineno-13-7"></a><span class="w"> </span><span class="nt">private_key</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_WIREGUARD_PRIVATE_KEY</span>
</span><span id="__span-13-8"><a id="__codelineno-13-8" name="__codelineno-13-8" href="#__codelineno-13-8"></a><span class="w"> </span><span class="nt">addresses</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_WIREGUARD_ADDRESS</span>
</span><span id="__span-13-9"><a id="__codelineno-13-9" name="__codelineno-13-9" href="#__codelineno-13-9"></a><span class="w"> </span><span class="nt">preshared_key</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_PRESHARED_KEY</span>
</span><span id="__span-13-10"><a id="__codelineno-13-10" name="__codelineno-13-10" href="#__codelineno-13-10"></a><span class="w"> </span><span class="nt">server_countries</span><span class="p">:</span>
</span><span id="__span-13-11"><a id="__codelineno-13-11" name="__codelineno-13-11" href="#__codelineno-13-11"></a><span class="w"> </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">US</span>
</span><span id="__span-13-12"><a id="__codelineno-13-12" name="__codelineno-13-12" href="#__codelineno-13-12"></a><span class="w"> </span><span class="nt">uk</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">GB</span>
</span><span id="__span-13-13"><a id="__codelineno-13-13" name="__codelineno-13-13" href="#__codelineno-13-13"></a><span class="w"> </span><span class="nt">server_cities</span><span class="p">:</span><span class="w"> </span><span class="p p-Indicator">{}</span>
</span><span id="__span-13-14"><a id="__codelineno-13-14" name="__codelineno-13-14" href="#__codelineno-13-14"></a><span class="w"> </span><span class="nt">server_hostnames</span><span class="p">:</span><span class="w"> </span><span class="p p-Indicator">{}</span>
</span><span id="__span-13-15"><a id="__codelineno-13-15" name="__codelineno-13-15" href="#__codelineno-13-15"></a><span class="w"> </span><span class="nt">extra_env</span><span class="p">:</span><span class="w"> </span><span class="p p-Indicator">{}</span>
</span><span id="__span-13-16"><a id="__codelineno-13-16" name="__codelineno-13-16" href="#__codelineno-13-16"></a><span class="w"> </span><span class="nt">nordvpn</span><span class="p">:</span>
</span><span id="__span-13-17"><a id="__codelineno-13-17" name="__codelineno-13-17" href="#__codelineno-13-17"></a><span class="w"> </span><span class="nt">vpn_type</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">wireguard</span>
</span><span id="__span-13-18"><a id="__codelineno-13-18" name="__codelineno-13-18" href="#__codelineno-13-18"></a><span class="w"> </span><span class="nt">credentials</span><span class="p">:</span>
</span><span id="__span-13-19"><a id="__codelineno-13-19" name="__codelineno-13-19" href="#__codelineno-13-19"></a><span class="w"> </span><span class="nt">private_key</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_WIREGUARD_PRIVATE_KEY</span>
</span><span id="__span-13-20"><a id="__codelineno-13-20" name="__codelineno-13-20" href="#__codelineno-13-20"></a><span class="w"> </span><span class="nt">server_countries</span><span class="p">:</span>
</span><span id="__span-13-21"><a id="__codelineno-13-21" name="__codelineno-13-21" href="#__codelineno-13-21"></a><span class="w"> </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">US</span>
</span><span id="__span-13-22"><a id="__codelineno-13-22" name="__codelineno-13-22" href="#__codelineno-13-22"></a><span class="w"> </span><span class="nt">de</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">DE</span>
</span><span id="__span-13-23"><a id="__codelineno-13-23" name="__codelineno-13-23" href="#__codelineno-13-23"></a>
</span><span id="__span-13-24"><a id="__codelineno-13-24" name="__codelineno-13-24" href="#__codelineno-13-24"></a><span class="w"> </span><span class="c1"># Global settings (all optional)</span>
</span><span id="__span-13-25"><a id="__codelineno-13-25" name="__codelineno-13-25" href="#__codelineno-13-25"></a><span class="w"> </span><span class="nt">base_port</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">8888</span>
</span><span id="__span-13-26"><a id="__codelineno-13-26" name="__codelineno-13-26" href="#__codelineno-13-26"></a><span class="w"> </span><span class="nt">auto_cleanup</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">true</span>
</span><span id="__span-13-27"><a id="__codelineno-13-27" name="__codelineno-13-27" href="#__codelineno-13-27"></a><span class="w"> </span><span class="nt">container_prefix</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">unshackle-gluetun</span>
</span><span id="__span-13-28"><a id="__codelineno-13-28" name="__codelineno-13-28" href="#__codelineno-13-28"></a><span class="w"> </span><span class="nt">auth_user</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">null</span>
</span><span id="__span-13-29"><a id="__codelineno-13-29" name="__codelineno-13-29" href="#__codelineno-13-29"></a><span class="w"> </span><span class="nt">auth_password</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">null</span>
</span><span id="__span-13-30"><a id="__codelineno-13-30" name="__codelineno-13-30" href="#__codelineno-13-30"></a><span class="w"> </span><span class="nt">verify_ip</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">true</span>
</span></code></pre></div>
<p><strong>Per-provider keys:</strong></p>
<table>
@@ -2938,22 +3243,22 @@ device-login flow, obtains proxy-capable locations from Express's API, and retur
authenticated HTTPS proxy. The device login runs once. After that, the cached refresh
token keeps you signed in headlessly.</p>
<p>Enable it and do a download interactively once:</p>
<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-11-1"><a id="__codelineno-11-1" name="__codelineno-11-1" href="#__codelineno-11-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
</span><span id="__span-11-2"><a id="__codelineno-11-2" name="__codelineno-11-2" href="#__codelineno-11-2"></a><span class="w"> </span><span class="nt">expressvpn</span><span class="p">:</span>
</span><span id="__span-11-3"><a id="__codelineno-11-3" name="__codelineno-11-3" href="#__codelineno-11-3"></a><span class="w"> </span><span class="nt">enable</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">true</span>
<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-14-1"><a id="__codelineno-14-1" name="__codelineno-14-1" href="#__codelineno-14-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
</span><span id="__span-14-2"><a id="__codelineno-14-2" name="__codelineno-14-2" href="#__codelineno-14-2"></a><span class="w"> </span><span class="nt">expressvpn</span><span class="p">:</span>
</span><span id="__span-14-3"><a id="__codelineno-14-3" name="__codelineno-14-3" href="#__codelineno-14-3"></a><span class="w"> </span><span class="nt">enable</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">true</span>
</span></code></pre></div>
<p>With <code>enable: true</code> and an interactive terminal, unshackle prints a code and a URL to
enter it at. Once you approve it, unshackle caches the tokens and reuses them
automatically, so later runs need no terminal. ExpressVPN also <strong>auto-loads</strong> once its token cache exists, so you can
drop <code>enable</code> after the first login, but you can keep a YAML block to pin regions or
servers:</p>
<div class="language-yaml highlight"><span class="filename">unshackle.yaml (optional)</span><pre><span></span><code><span id="__span-12-1"><a id="__codelineno-12-1" name="__codelineno-12-1" href="#__codelineno-12-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
</span><span id="__span-12-2"><a id="__codelineno-12-2" name="__codelineno-12-2" href="#__codelineno-12-2"></a><span class="w"> </span><span class="nt">expressvpn</span><span class="p">:</span>
</span><span id="__span-12-3"><a id="__codelineno-12-3" name="__codelineno-12-3" href="#__codelineno-12-3"></a><span class="w"> </span><span class="nt">region_map</span><span class="p">:</span>
</span><span id="__span-12-4"><a id="__codelineno-12-4" name="__codelineno-12-4" href="#__codelineno-12-4"></a><span class="w"> </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">ny-02</span><span class="w"> </span><span class="c1"># prefer New York, server 02 for the US</span>
</span><span id="__span-12-5"><a id="__codelineno-12-5" name="__codelineno-12-5" href="#__codelineno-12-5"></a><span class="w"> </span><span class="nt">gb</span><span class="p">:</span><span class="w"> </span><span class="c1"># empty = smart random location</span>
</span><span id="__span-12-6"><a id="__codelineno-12-6" name="__codelineno-12-6" href="#__codelineno-12-6"></a><span class="w"> </span><span class="nt">server_map</span><span class="p">:</span>
</span><span id="__span-12-7"><a id="__codelineno-12-7" name="__codelineno-12-7" href="#__codelineno-12-7"></a><span class="w"> </span><span class="nt">myserver</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">usny-newyork-2</span>
<div class="language-yaml highlight"><span class="filename">unshackle.yaml (optional)</span><pre><span></span><code><span id="__span-15-1"><a id="__codelineno-15-1" name="__codelineno-15-1" href="#__codelineno-15-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
</span><span id="__span-15-2"><a id="__codelineno-15-2" name="__codelineno-15-2" href="#__codelineno-15-2"></a><span class="w"> </span><span class="nt">expressvpn</span><span class="p">:</span>
</span><span id="__span-15-3"><a id="__codelineno-15-3" name="__codelineno-15-3" href="#__codelineno-15-3"></a><span class="w"> </span><span class="nt">region_map</span><span class="p">:</span>
</span><span id="__span-15-4"><a id="__codelineno-15-4" name="__codelineno-15-4" href="#__codelineno-15-4"></a><span class="w"> </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">ny-02</span><span class="w"> </span><span class="c1"># prefer New York, server 02 for the US</span>
</span><span id="__span-15-5"><a id="__codelineno-15-5" name="__codelineno-15-5" href="#__codelineno-15-5"></a><span class="w"> </span><span class="nt">gb</span><span class="p">:</span><span class="w"> </span><span class="c1"># empty = smart random location</span>
</span><span id="__span-15-6"><a id="__codelineno-15-6" name="__codelineno-15-6" href="#__codelineno-15-6"></a><span class="w"> </span><span class="nt">server_map</span><span class="p">:</span>
</span><span id="__span-15-7"><a id="__codelineno-15-7" name="__codelineno-15-7" href="#__codelineno-15-7"></a><span class="w"> </span><span class="nt">myserver</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">usny-newyork-2</span>
</span></code></pre></div>
<p><strong>Default file location:</strong></p>
<table>
@@ -3013,13 +3318,13 @@ token is never briefly world-readable.</p>
<p>NordVPN uses your <strong>Service Credentials</strong>, not your normal NordVPN login. Make them
from the <a href="https://my.nordaccount.com/dashboard/nordvpn/">NordVPN dashboard</a> under manual
setup. They are a long random username/password pair, not your email and password.</p>
<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-13-1"><a id="__codelineno-13-1" name="__codelineno-13-1" href="#__codelineno-13-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
</span><span id="__span-13-2"><a id="__codelineno-13-2" name="__codelineno-13-2" href="#__codelineno-13-2"></a><span class="w"> </span><span class="nt">nordvpn</span><span class="p">:</span>
</span><span id="__span-13-3"><a id="__codelineno-13-3" name="__codelineno-13-3" href="#__codelineno-13-3"></a><span class="w"> </span><span class="nt">username</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_USERNAME</span>
</span><span id="__span-13-4"><a id="__codelineno-13-4" name="__codelineno-13-4" href="#__codelineno-13-4"></a><span class="w"> </span><span class="nt">password</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_PASSWORD</span>
</span><span id="__span-13-5"><a id="__codelineno-13-5" name="__codelineno-13-5" href="#__codelineno-13-5"></a><span class="w"> </span><span class="nt">server_map</span><span class="p">:</span><span class="w"> </span><span class="c1"># optional: pin specific server IDs</span>
</span><span id="__span-13-6"><a id="__codelineno-13-6" name="__codelineno-13-6" href="#__codelineno-13-6"></a><span class="w"> </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">1234</span>
</span><span id="__span-13-7"><a id="__codelineno-13-7" name="__codelineno-13-7" href="#__codelineno-13-7"></a><span class="w"> </span><span class="nt">us:seattle</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">5678</span>
<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-16-1"><a id="__codelineno-16-1" name="__codelineno-16-1" href="#__codelineno-16-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
</span><span id="__span-16-2"><a id="__codelineno-16-2" name="__codelineno-16-2" href="#__codelineno-16-2"></a><span class="w"> </span><span class="nt">nordvpn</span><span class="p">:</span>
</span><span id="__span-16-3"><a id="__codelineno-16-3" name="__codelineno-16-3" href="#__codelineno-16-3"></a><span class="w"> </span><span class="nt">username</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_USERNAME</span>
</span><span id="__span-16-4"><a id="__codelineno-16-4" name="__codelineno-16-4" href="#__codelineno-16-4"></a><span class="w"> </span><span class="nt">password</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_PASSWORD</span>
</span><span id="__span-16-5"><a id="__codelineno-16-5" name="__codelineno-16-5" href="#__codelineno-16-5"></a><span class="w"> </span><span class="nt">server_map</span><span class="p">:</span><span class="w"> </span><span class="c1"># optional: pin specific server IDs</span>
</span><span id="__span-16-6"><a id="__codelineno-16-6" name="__codelineno-16-6" href="#__codelineno-16-6"></a><span class="w"> </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">1234</span>
</span><span id="__span-16-7"><a id="__codelineno-16-7" name="__codelineno-16-7" href="#__codelineno-16-7"></a><span class="w"> </span><span class="nt">us:seattle</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">5678</span>
</span></code></pre></div>
<p><strong>Required keys:</strong> <code>username</code>, <code>password</code>. unshackle validates them up front: the
combined username and password must be exactly 48 alphanumeric characters (case-insensitive), and
@@ -3064,7 +3369,7 @@ country-code confusion that <code>uk</code> invites.</p>
</table>
<p>The returned proxy is HTTPS on <strong>port 89</strong> (NordVPN disabled its plain-HTTP proxies on
port 80 in 2021).</p>
<div class="language-shell highlight"><pre><span></span><code><span id="__span-14-1"><a id="__codelineno-14-1" name="__codelineno-14-1" href="#__codelineno-14-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>nordvpn:us:seattle<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
<div class="language-shell highlight"><pre><span></span><code><span id="__span-17-1"><a id="__codelineno-17-1" name="__codelineno-17-1" href="#__codelineno-17-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>nordvpn:us:seattle<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
</span></code></pre></div>
<h2 id="proton-vpn">Proton VPN<a class="headerlink" href="#proton-vpn" title="Permanent link">&para;</a></h2>
<p>Proton VPN supports two authentication methods, and unshackle can work with either. Note
@@ -3075,9 +3380,9 @@ that free Proton accounts work, but Proton limits them to its free-tier exit cou
<p>Proton's TV device-login flow gives a self-sustaining, refreshable sign-in. This is
the only method that can refresh itself headlessly, so it keeps working without
re-exporting anything. Enable it and do a download interactively once:</p>
<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-15-1"><a id="__codelineno-15-1" name="__codelineno-15-1" href="#__codelineno-15-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
</span><span id="__span-15-2"><a id="__codelineno-15-2" name="__codelineno-15-2" href="#__codelineno-15-2"></a><span class="w"> </span><span class="nt">protonvpn</span><span class="p">:</span>
</span><span id="__span-15-3"><a id="__codelineno-15-3" name="__codelineno-15-3" href="#__codelineno-15-3"></a><span class="w"> </span><span class="nt">enable</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">true</span>
<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-18-1"><a id="__codelineno-18-1" name="__codelineno-18-1" href="#__codelineno-18-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
</span><span id="__span-18-2"><a id="__codelineno-18-2" name="__codelineno-18-2" href="#__codelineno-18-2"></a><span class="w"> </span><span class="nt">protonvpn</span><span class="p">:</span>
</span><span id="__span-18-3"><a id="__codelineno-18-3" name="__codelineno-18-3" href="#__codelineno-18-3"></a><span class="w"> </span><span class="nt">enable</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">true</span>
</span></code></pre></div>
<p>With <code>enable: true</code> and an interactive terminal, unshackle prints a code and asks you
to enter it at <a href="https://account.proton.me/vpn/tv/code">account.proton.me/vpn/tv/code</a>.
@@ -3170,7 +3475,7 @@ previous run's log line (e.g. <code>DE#203</code>) instead.</p>
<a href="https://github.com/Snawoot/hola-proxy"><code>hola-proxy</code></a> binary, and <strong>auto-loads</strong> whenever
that binary is found on your <code>PATH</code>. If you query Hola but the binary is missing, the
proxy provider raises an error that tells you to install it.</p>
<div class="language-shell highlight"><span class="filename">Install hola-proxy, then just query a country</span><pre><span></span><code><span id="__span-16-1"><a id="__codelineno-16-1" name="__codelineno-16-1" href="#__codelineno-16-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>hola:us<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
<div class="language-shell highlight"><span class="filename">Install hola-proxy, then just query a country</span><pre><span></span><code><span id="__span-19-1"><a id="__codelineno-19-1" name="__codelineno-19-1" href="#__codelineno-19-1"></a>unshackle<span class="w"> </span>dl<span class="w"> </span>--proxy<span class="w"> </span>hola:us<span class="w"> </span>EXAMPLE<span class="w"> </span><span class="m">81234567</span>
</span></code></pre></div>
<p><strong>Query forms:</strong> a two-letter country code (e.g. <code>us</code>, <code>gb</code>). unshackle asks <code>hola-proxy</code>
for available proxies in that country and picks one at random, returning an HTTP proxy.</p>
@@ -3183,12 +3488,12 @@ only datacenter proxies.</p>
<h2 id="surfshark">Surfshark<a class="headerlink" href="#surfshark" title="Permanent link">&para;</a></h2>
<p>Surfshark, like NordVPN, uses <strong>Service Credentials</strong> rather than your login. Make
them from the <a href="https://my.surfshark.com/vpn/manual-setup/main/openvpn">Surfshark manual-setup page</a>.</p>
<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-17-1"><a id="__codelineno-17-1" name="__codelineno-17-1" href="#__codelineno-17-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
</span><span id="__span-17-2"><a id="__codelineno-17-2" name="__codelineno-17-2" href="#__codelineno-17-2"></a><span class="w"> </span><span class="nt">surfsharkvpn</span><span class="p">:</span>
</span><span id="__span-17-3"><a id="__codelineno-17-3" name="__codelineno-17-3" href="#__codelineno-17-3"></a><span class="w"> </span><span class="nt">username</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_USERNAME</span>
</span><span id="__span-17-4"><a id="__codelineno-17-4" name="__codelineno-17-4" href="#__codelineno-17-4"></a><span class="w"> </span><span class="nt">password</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_PASSWORD</span>
</span><span id="__span-17-5"><a id="__codelineno-17-5" name="__codelineno-17-5" href="#__codelineno-17-5"></a><span class="w"> </span><span class="nt">server_map</span><span class="p">:</span><span class="w"> </span><span class="c1"># optional</span>
</span><span id="__span-17-6"><a id="__codelineno-17-6" name="__codelineno-17-6" href="#__codelineno-17-6"></a><span class="w"> </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">1234</span>
<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-20-1"><a id="__codelineno-20-1" name="__codelineno-20-1" href="#__codelineno-20-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
</span><span id="__span-20-2"><a id="__codelineno-20-2" name="__codelineno-20-2" href="#__codelineno-20-2"></a><span class="w"> </span><span class="nt">surfsharkvpn</span><span class="p">:</span>
</span><span id="__span-20-3"><a id="__codelineno-20-3" name="__codelineno-20-3" href="#__codelineno-20-3"></a><span class="w"> </span><span class="nt">username</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_USERNAME</span>
</span><span id="__span-20-4"><a id="__codelineno-20-4" name="__codelineno-20-4" href="#__codelineno-20-4"></a><span class="w"> </span><span class="nt">password</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_PASSWORD</span>
</span><span id="__span-20-5"><a id="__codelineno-20-5" name="__codelineno-20-5" href="#__codelineno-20-5"></a><span class="w"> </span><span class="nt">server_map</span><span class="p">:</span><span class="w"> </span><span class="c1"># optional</span>
</span><span id="__span-20-6"><a id="__codelineno-20-6" name="__codelineno-20-6" href="#__codelineno-20-6"></a><span class="w"> </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">1234</span>
</span></code></pre></div>
<p><strong>Required keys:</strong> <code>username</code>, <code>password</code>, validated with the same 48-character rule as
NordVPN (combined username+password must be 48 alphanumeric characters, case-insensitive, no <code>@</code>).
@@ -3221,13 +3526,13 @@ NordVPN (combined username+password must be 48 alphanumeric characters, case-ins
<p>Windscribe uses <strong>Service Credentials</strong> from its
<a href="https://windscribe.com/getconfig/openvpn">OpenVPN config page</a>. unshackle only makes
sure that a username and a password are present (there is no 48-character rule).</p>
<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-18-1"><a id="__codelineno-18-1" name="__codelineno-18-1" href="#__codelineno-18-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
</span><span id="__span-18-2"><a id="__codelineno-18-2" name="__codelineno-18-2" href="#__codelineno-18-2"></a><span class="w"> </span><span class="nt">windscribevpn</span><span class="p">:</span>
</span><span id="__span-18-3"><a id="__codelineno-18-3" name="__codelineno-18-3" href="#__codelineno-18-3"></a><span class="w"> </span><span class="nt">username</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_USERNAME</span>
</span><span id="__span-18-4"><a id="__codelineno-18-4" name="__codelineno-18-4" href="#__codelineno-18-4"></a><span class="w"> </span><span class="nt">password</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_PASSWORD</span>
</span><span id="__span-18-5"><a id="__codelineno-18-5" name="__codelineno-18-5" href="#__codelineno-18-5"></a><span class="w"> </span><span class="nt">server_map</span><span class="p">:</span><span class="w"> </span><span class="c1"># optional: alias -&gt; hostname</span>
</span><span id="__span-18-6"><a id="__codelineno-18-6" name="__codelineno-18-6" href="#__codelineno-18-6"></a><span class="w"> </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">us-east.totallyacdn.com</span>
</span><span id="__span-18-7"><a id="__codelineno-18-7" name="__codelineno-18-7" href="#__codelineno-18-7"></a><span class="w"> </span><span class="nt">us:seattle</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">us-seattle.totallyacdn.com</span>
<div class="language-yaml highlight"><span class="filename">unshackle.yaml</span><pre><span></span><code><span id="__span-21-1"><a id="__codelineno-21-1" name="__codelineno-21-1" href="#__codelineno-21-1"></a><span class="nt">proxy_providers</span><span class="p">:</span>
</span><span id="__span-21-2"><a id="__codelineno-21-2" name="__codelineno-21-2" href="#__codelineno-21-2"></a><span class="w"> </span><span class="nt">windscribevpn</span><span class="p">:</span>
</span><span id="__span-21-3"><a id="__codelineno-21-3" name="__codelineno-21-3" href="#__codelineno-21-3"></a><span class="w"> </span><span class="nt">username</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_USERNAME</span>
</span><span id="__span-21-4"><a id="__codelineno-21-4" name="__codelineno-21-4" href="#__codelineno-21-4"></a><span class="w"> </span><span class="nt">password</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">YOUR_SERVICE_PASSWORD</span>
</span><span id="__span-21-5"><a id="__codelineno-21-5" name="__codelineno-21-5" href="#__codelineno-21-5"></a><span class="w"> </span><span class="nt">server_map</span><span class="p">:</span><span class="w"> </span><span class="c1"># optional: alias -&gt; hostname</span>
</span><span id="__span-21-6"><a id="__codelineno-21-6" name="__codelineno-21-6" href="#__codelineno-21-6"></a><span class="w"> </span><span class="nt">us</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">us-east.totallyacdn.com</span>
</span><span id="__span-21-7"><a id="__codelineno-21-7" name="__codelineno-21-7" href="#__codelineno-21-7"></a><span class="w"> </span><span class="nt">us:seattle</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">us-seattle.totallyacdn.com</span>
</span></code></pre></div>
<p><strong>Required keys:</strong> <code>username</code>, <code>password</code>. <code>server_map</code> optionally maps a region (or
<code>region:city</code>) directly to a hostname.</p>
@@ -3269,16 +3574,21 @@ developer note below.</p>
<p>unshackle has <strong>two</strong> proxy-resolution code paths that are intentionally not
identical:</p>
<ul>
<li><code>unshackle/commands/dl.py</code> inlines its own logic and loads <strong>all eight</strong> providers,
<li><code>unshackle/commands/dl.py</code> inlines its own logic and loads <strong>all nine</strong> providers,
including Windscribe and Gluetun.</li>
<li><code>unshackle/core/proxies/resolve.py::initialize_proxy_providers()</code> is the shared
resolver used by the REST API handlers and the remote-service client. It <strong>omits</strong>
Windscribe and Gluetun.</li>
</ul>
<p>Both paths accept the same query grammar (a direct URI, a <code>provider:query</code>, or a bare
country query tried against providers in order), but the set of available providers
differs. Keep this in mind when you add a proxy provider: an entry in <code>dl.py</code> does not
make it available over the API, and the opposite is also true.</p>
<p>Both paths accept the same query grammar (a direct URI, a <code>provider:query</code>, a bare
country query tried against providers in order, or a <code>controld://</code> resolver), but the
set of available providers differs. Keep this in mind when you add a proxy provider:
an entry in <code>dl.py</code> does not make it available over the API, and the opposite is also
true.</p>
<p>The remote-service client resolves <code>--proxy</code> with its own
<code>resolve_remote_proxy_arg()</code>. It changes a <code>controld:</code> query to a <code>controld://</code>
resolver for the server with <code>get_remote_proxy()</code>, and it removes Control D from a bare
query, because a loopback forwarder is of no use to a server on another machine.</p>
</div>
<div class="admonition note">
<p class="admonition-title">Implementing a new provider (developers)</p>