diff --git a/README.md b/README.md
index ceba37e..7b48e04 100644
--- a/README.md
+++ b/README.md
@@ -72,9 +72,14 @@ If you visit `localhost` you should be able to access the frontend. The same use
 
 ### Test leaks
 
-The Wireguard setup changes the transports of the torrent client, so it's worth checking if anything is leaking.
 https://ipleak.net/
 
 ## Development
 
 `docker-compose -f docker-compose.dev.yml up`
+
+## Todo
+
+- Scan libraries when torrents complete
+- Verify file downloads on client restart
+- Fix issues with prowlarr links
diff --git a/apps/client/src/torrent.go b/apps/client/src/torrent.go
index 17bfb68..c9c9ec9 100644
--- a/apps/client/src/torrent.go
+++ b/apps/client/src/torrent.go
@@ -86,7 +86,7 @@ func (tc *Torrentclient) Add(magnet string) error {
 		}
 	}
 
-	log.Println("Adding torrent:", magnet)
+	log.Println("Adding torrent:", magnet, "with public IPs:", tc.Client.PublicIPs())
 	torrent, err := tc.Client.AddMagnet(magnet)
 
 	if err != nil {
diff --git a/scripts/provision.sh b/scripts/provision.sh
index da599cd..0cf7e38 100644
--- a/scripts/provision.sh
+++ b/scripts/provision.sh
@@ -2,7 +2,11 @@
 # For provisioning a fresh Vultr Alpine instance with block storage attached
 
 apk update && apk upgrade
-apk add docker docker-compose fail2ban rsync
+apk add docker docker-compose fail2ban rsync openvpn
+modprobe tun || exit 0
+echo "tun" >> /etc/modules-load.d/tun.conf
+echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.d/ipv4.conf
+sysctl -p /etc/sysctl.d/ipv4.conf
 mkdir /root/freeflix && mkdir /root/freeflix/config && mkdir /root/freeflix/data
 rc-update add fail2ban
 rc-update add docker boot