Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ

https://iknowwhatyoudownload.com to see what your ip has downloaded.

I've not gotten into self-hosting yet, but as someone who has gotten a Filesharing-Abmahnung amounting to roughly 1700€ I can tell you what I would do. All of this is of course purely theoretical.

Regarding torrenting and piracy, it is my understanding that German law (same with most other countries) has yet to find a decisive answer. But, to keep yourself safe, so far the consensus is as follows:

1. Don't use torrents.
2. If you use torrents, never upload. ('Tis a trap, see below)
3. If you use torrents, use a VPN.

Now let's put this into practice, with examples for each use case. Our goal here is to never break existing German law. The further you go away from option one, the higher the risk of breaking the law.

1. Don't use torrents. If you never interact with anything regarding torrents, you cannot be sued for torrenting, and that's really the only issue in Germany. As far as I'm aware, you're not liable if you simply download or stream something from a website freely accessible on the internet. Examples are streaming sites like Aniwave or download (DDL) sites like DDLbase.net. Hell, you could click on one of them and watch something right now. No one cares. To make this a bit more organized one could even use Cloudstream, which is an app that can aggregate "streaming websites" through external add-ons and it gives you a beautiful UI for it. Available for Linux, Windows and Android.

2. "If you need or want to use torrents, never upload." is what I thought, because it sounds reasonable, right? If you look around on the internet (and in my personal use case) the courts and attorneys that send out these Abmahnungen always seem to take issue with you sharing and uploading files. And mostly music, not movies or TV series. By uploading you're sharing files that do not belong to you. So, if you deactivate uploads on your torrent client, you're done, right? If you don't share, you aren't technically breaking the law, right? Wrong. And for two reasons: (1) The process of downloading something always includes uploading some information about the download. So while you might be able to stop uploading files, you can't stop the upload of other information needed for the correct download of the files. Which leads us to the second reason: (2) These attorneys don’t care what information you’ve uploaded, how much you've uploaded, what parts you’ve uploaded or how long, they just care that they caught you participating - in any way, shape or form - to their tracked torrent. You participated, you necessarily both downloaded and uploaded something, you broke the law. If you want to make sure you don't upload nor download anything, use a Debrid service like RealDebrid which downloads it for you. Of course you're only using it to torrent Linux ISOs for you, so you're not really breaking the law anyway.

3. Now correctly: If you use torrents, use a VPN. You either relegate it to someone else (a Debrid service or a seedbox like Ultra.cc) or you do it yourself by using a VPN. You're not breaking the law by connecting to a VPN or a seedbox.

Now, to the point that you're probably most concerned about. "What if one day sharing Linux ISOs becomes illegal, what if the program or kill-switch fails, what if the VPN actually does sell my data, what if the police use brute-force and physically take the datacenters, what if X or Y protection fails?" Enter layered protection. For example:

• ~~Use a VPN, but also never upload. This way, even if your program accidentally uploads a file, it doesn't matter because your VPN is there.~~ Use a VPN, but also use a Debrid service like RealDebrid that downloads the torrents on your behalf. This way, even if your Debrid service sells your IP, it doesn't matter because your VPN masked it. It is highly unlikely that both fail, and even if there's still a risk, you're statistically in a much better situation than you were before. You're basically doubling your chances of success.
• Use streaming and DDL-websites, but use a VPN too. Let's say your VPN does sell your data and everyone finds out that you, you, did a thing. It doesn't matter, because you were just browsing streaming websites, and no one cares about those.

P.s. This approach doesn't replace using good tools to keep you safe. Similarly, it doesn't matter if you have 5 locks on your front door if they're all made out of chocolate. Use a good VPN, use a good torrent client, use good trackers, etc. And lastly:

Don't stress too much.

A friend of mine uses NordVPN, has a kill-switch on the VPN and uses Stremio with a Debrid service to make sure he never uploads nor downloads any torrents on his server, and paid for it with a Paysafecard that isn't digitally tied to him. Is this perfect? No. He is the farthest away from option number 1 and is exposing himself to risks. He can theoretically be identified if you look up the security footage of where he bought the Paysafecard. NordVPN has not been proven to be as secure as Mullvad, has no diskless servers and the clients aren't open-source. He paid the VPN with his credit card. The single kill-switch can fail. He is still dabbling with torrents by using a Debrid service. He is using public trackers. But remember: The FBI or in your case the Bundesnachrichtendienst will not invade Panama to shut down your VPN, then threaten the developer of your favourite streaming client to install a backdoor to see that it's really you that is pirating this show right now, and then come knocking on your door because you pirated KissXSis or the latest season of Game of Thrones. You're simply dealing with copyright trolls and to quote someone else in this comment section: "Trolls will look for the best return on their trolling". As long as you take just two good precautions, you will be safe from most adversaries. And that's really all you can and want to achieve.

Edit: corrected the "upload" parts. Thanks @retro@infosec.pub!

A VPN is enough for torrenting, as long as the VPN provider isn't logging. I personally use AirVPN because they have port-forwarding but I've used Mullvad before. I also live in Germany and I've never gotten in trouble.

The guide you linked seems a little outdated, Jackett has been replaced by Prowlarr, which is there to have a central location to manage your trackers. If you plan to use Jellyfin, you should also use Jellyseer instead if Overseer. The *arr services are the ones that actually search for the files to download by using the trackers you set up in Prowlarr. You don't need all the *arr services, I only have Sonarr and Radarr, which are for shows and movies respectively. I also have Bazarr for subtitles. AdguardHome is only for ad-blocking, might be useful to you but isn't needed. Idk why that's even in the guide. Flaresolverr is something I've never heard about and I don't use it, so I can't tell you anything about that. Heimdall is something I don't need because I use YunoHost, which has a dashboard already but it might be useful to you.

A VPN is just a relay. Copyright trolls know you are uploading because you are connected to the swarm. Whatever IP address the swarm sees, the trolls will also see.

You can make it harder on them by selecting a VPN provider that doesn't log. You can make it harder for them to put pressure on your VPN by selecting an endpoint in a location unfriendly to trolls. Make them cross multiple jurisdictional boundaries if they want to get to you.

Trolls will look for the best return on their trolling. If they ever decide to come after VPN providers, they will probably target the one with the largest number of pirates in their jurisdiction. Consider a VPN provider outside Germany and the EU. South American or Asian VPN providers might be good choices for you.

Bind gluetun with torrent client for a real kill switch. If you trust your VPN provider then you should be safe. Mullvad is probably the most reputable provider, but since they removed PF I moved to airVPN. I dont live in germany tho 😜

There are other alternatives to torrents, but private trackers should be more safe than public ones. You need invite or pass the interview for most private trackers, but I guess you know that already

go through all the tests on this link: ipleak.net If you see your ip address anywhere then revise your setting
PS: don't forget the torrent leak test, there is one