Wireguard + Transmission 
It's turtles all the way down: as this runs on one of my home raspberry PIs, the Github Action needs to prepare the deployment and execute it on my DigitalOcean droplet. This droplet, in turn, has access to my (IPv6) home network where it ultimately redeploys the correctly configured docker container.
Because of the additional "hops", the environment variables also need to be carefully pushed around for correct operation.
Rebuilding the docker image is necessary if/when my VPN service changes requirements or you need to rework some of the internal bells & whistles (media server requirements, etc.) or it's time to use latest version of OS + software.
Used everyday by my bender slackbot after he determines which is the most performant VPN server.