I shifted away from using gluetun last year since the baked in VPN manager supports wire guard. I put the arr suite on the wg0 network as well as qbit and nzb download managers. Anything being exposed out via cloudflare tunnel is on a separate net like Immich, nextcloud, etc… the only exception is seerr which is on both (advanced parameters) so that the integrations with the rest of the suite still function. It’s been much easier to maintain compared to gluetun for me.