Imgur decided to block UK users. Honestly? I don’t really care that much. I haven’t actively browsed the site in years. But it used to be everywhere. Back when Reddit embedded everything on Imgur, maybe fifteen years ago, it was genuinely useful. Then Reddit built their own image hosting, Discord did the same, and Imgur slowly faded into the background.

Except it never fully disappeared. And since the block, I keep stumbling across Imgur links that just show “unavailable.” It’s mildly infuriating.

The Minecraft shader problem#

Here’s a concrete example. I was playing Minecraft with some work colleagues and wanted to try different shaders. Most shader pages embed preview images hosted on Imgur. So I’d click through shader after shader, and every single preview was just gone. I couldn’t see what any of them looked like without the images.

This kind of thing happens constantly now. Old forum posts, Reddit threads, documentation pages, random project READMEs. Imgur links are still scattered across the internet, and in the UK, they’re all broken.

Why I didn’t just install a VPN#

The obvious solution is to use a VPN. Change your location, problem solved. But I have a few issues with that approach.

First, I just upgraded to 2.5 Gbps internet and I don’t want to route all my traffic through a VPN and take the speed hit. I have this bandwidth for a reason.

Second, even if I installed a VPN on my main machine, what about my phone? My laptop? My desktop? Every device would need the VPN running, and I’d have to remember to connect it before browsing. It’s messy.

I wanted something cleaner: a solution that works for every device on my network, automatically, without any client-side configuration.

The network-level approach#

I already run a homelab with Traefik as my reverse proxy, Pi-hole for DNS, and everything declaratively configured with NixOS. If you’ve read my previous post on Docker containers with secrets, you’ll recognise the pattern.

The idea was simple: intercept all requests to i.imgur.com at the DNS level, route them through a VPN-connected container, and serve the images back. Every device on my network automatically uses Pi-hole for DNS via DHCP, so this would be completely transparent.

Here’s the flow:

1. Device requests i.imgur.com
2. Pi-hole returns my Traefik instance’s IP instead
3. Traefik sees the SNI hostname and routes to Gluetun
4. Gluetun tunnels the request through a VPN
5. Nginx (attached to Gluetun’s network) proxies to the real Imgur
6. Image comes back through the tunnel to the device

Why Nginx when I already have Traefik?#

Good question. Gluetun isn’t a reverse proxy. It’s a container that provides VPN connectivity to other containers attached to its network namespace. So I needed something inside Gluetun’s network to actually handle the proxying. Nginx was the simplest choice.

The Nginx config is minimal. It just does TCP passthrough with SNI:

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
worker_connections 1024;
}

stream {
resolver 127.0.0.1 valid=30s;
resolver_timeout 5s;

server {
listen 443;
ssl_preread on;
proxy_pass i.imgur.com:443;
proxy_connect_timeout 10s;
proxy_timeout 60s;
}
}

This listens on port 443, reads the SNI header to confirm the destination, and passes the connection through to the real i.imgur.com. The TLS handshake happens end-to-end; Nginx never sees the decrypted traffic.

The Docker setup#

The compose file runs two containers. Gluetun handles the VPN connection, and Nginx attaches to Gluetun’s network:

version: '3.8'

services:
gluetun:
image: qmcgaw/gluetun:latest
container_name: gluetun
cap_add:
- NET_ADMIN
devices:
- /dev/net/tun:/dev/net/tun
environment:
- VPN_SERVICE_PROVIDER=${VPN_SERVICE_PROVIDER}
- VPN_TYPE=wireguard
- WIREGUARD_PRIVATE_KEY=${WIREGUARD_PRIVATE_KEY}
- SERVER_COUNTRIES=${SERVER_COUNTRIES}
- FIREWALL=on
- FIREWALL_INPUT_PORTS=443
- FIREWALL_OUTBOUND_SUBNETS=10.0.0.0/8
- DOT=on
- DOT_PROVIDERS=cloudflare
- HEALTH_VPN_DURATION_INITIAL=30s
volumes:
- ./gluetun:/gluetun
restart: unless-stopped
networks:
- proxy
healthcheck:
test: ["CMD", "/gluetun-entrypoint", "healthcheck"]
interval: 30s
timeout: 10s
retries: 3
start_period: 30s

imgur-proxy:
image: nginx:alpine
container_name: imgur-proxy
depends_on:
gluetun:
condition: service_healthy
network_mode: "service:gluetun"
volumes:
- ./nginx.conf:/etc/nginx/nginx.conf:ro
restart: unless-stopped

networks:
proxy:
external: true

The key detail is network_mode: "service:gluetun". This makes Nginx share Gluetun’s network stack, so all its traffic automatically goes through the VPN tunnel.

I’m not going to mention which VPN provider I use. It’s one of the major ones with WireGuard support, but honestly I’m not thrilled with it. Use whatever you have.

Traefik routing#

The final piece is telling Traefik to route i.imgur.com traffic to the Gluetun container. This uses TCP routing with TLS passthrough:

tcp:
routers:
imgur-router:
rule: "HostSNI(`i.imgur.com`)"
entryPoints:
- https
service: imgur-service
tls:
passthrough: true
services:
imgur-service:
loadBalancer:
servers:
- address: "gluetun:443"

The passthrough: true is important. It means Traefik doesn’t terminate TLS; it just inspects the SNI header and forwards the connection.

NixOS integration#

Following the same pattern from my Docker with secrets post, I created a systemd service that runs the compose stack with Agenix-managed secrets:

{ pkgs, config, ... }:
let
docker-env = config.age.secrets.docker-imgur-proxy.path;
in
{
systemd.services.imgur-proxy = {
description = "Imgur Proxy with VPN";
after = [
"network.target"
"docker.service"
"docker-create-proxy-network.service"
];
wants = [
"docker.service"
"docker-create-proxy-network.service"
];
serviceConfig = {
ExecStart = "${pkgs.docker}/bin/docker compose --env-file ${docker-env} -f docker-compose.yml up --force-recreate";
ExecStop = "${pkgs.docker}/bin/docker compose -f docker-compose.yml down";
WorkingDirectory = "/home/tymscar/dotfiles/apps/nixos/docker/imgur-proxy";
Restart = "always";
};
wantedBy = [ "multi-user.target" ];
};
}

The VPN credentials are stored encrypted with Agenix, so my entire dotfiles repo stays public while keeping secrets safe.

The result#

Now when any device on my network requests an Imgur image, it works. My phone, my laptop, guest devices, everything. No VPN apps to install, no browser extensions, no manual configuration. Pi-hole intercepts the DNS, Traefik routes the connection, and Gluetun tunnels it through a non-UK exit point.

The latency increase is negligible for loading images, and it only affects Imgur traffic. Everything else still goes direct at full speed.

Is this overkill for viewing the occasional Imgur image? Probably. But it’s a clean solution that requires minimal ongoing maintenance, and it scratches the homelab itch. Plus I can finally see what those Minecraft shaders look like.