Add VPN kill switch verification and improve Watchtower visibility

Author: liamvibecodes

README.md

@@ -77,6 +77,7 @@ Then open Tidarr at `http://localhost:8484` to authenticate with your Tidal acco
 | Log prune | Daily | Removes log files older than 30 days |
 | Franchise sort | After Kometa | Sorts franchise collection movies by release date in Plex |
 | VPN failover | Every 2 min (optional) | Auto-switches between ProtonVPN and NordVPN on sustained failure |
+| Watchtower | Weekly (optional) | Auto-pulls latest container images and recreates updated services |
 
 ## One-Command Install
 
@@ -107,6 +108,8 @@ bash scripts/configure.sh
 bash scripts/install-launchd-jobs.sh
 ```
 
+The `watchtower` line above enables automatic container image updates (checks weekly). It's optional but recommended so your services stay patched without manual pulls.
+
 ## Full Setup Guide
 
 See [SETUP.md](SETUP.md) for the complete walkthrough.
@@ -136,7 +139,7 @@ Optional music:
                    Tidarr (Tidal FLAC downloads) ----^
 ```
 
-All download traffic routes through ProtonVPN (with optional NordVPN failover). Everything else uses your normal connection. All services auto-start on boot and self-heal if they go down.
+All download traffic routes through ProtonVPN (with optional NordVPN failover). Gluetun's built-in kill switch blocks traffic if the VPN drops, so your real IP is never exposed through the tunnel. Everything else uses your normal connection. All services auto-start on boot and self-heal if they go down.
 
 ## Scripts
 

SETUP.md

@@ -98,6 +98,39 @@ docker compose --profile autoupdate up -d watchtower
 
 ---
 
+## Verify Your VPN Kill Switch
+
+Once the stack is running, confirm your real IP is never exposed through the VPN tunnel:
+
+```bash
+# 1. Check the VPN's IP (should be your VPN provider, not your ISP)
+docker exec gluetun sh -c 'wget -qO- https://ipinfo.io/ip'
+
+# 2. Check your real IP (run outside Docker)
+curl -s https://ipinfo.io/ip
+
+# 3. Confirm they're different
+```
+
+To test the kill switch (traffic should be blocked when the VPN drops):
+
+```bash
+# Kill the VPN process inside the container
+docker exec gluetun sh -c 'killall -SIGUSR1 openvpn'
+
+# Try reaching the internet from inside the VPN namespace — should fail/timeout
+docker exec gluetun sh -c 'wget -qO- --timeout=5 https://ipinfo.io/ip'
+
+# Restore the VPN
+docker restart gluetun
+```
+
+If the second `wget` returns an IP instead of timing out, your kill switch isn't working. Check your Gluetun configuration.
+
+> **macOS note:** On macOS, Docker runs inside a Linux VM (OrbStack or Docker Desktop). The kill switch blocks traffic at the container/VM level, not at the macOS network layer. This means containers routed through Gluetun are protected, but apps running directly on macOS are not affected. This is normal and expected.
+
+---
+
 ## Step 5: Auto-Configure Services
 
 ```bash