mirror of
https://github.com/aykhans/my-self-host-services.git
synced 2026-10-17 12:33:53 +00:00
71 lines
2.1 KiB
YAML
71 lines
2.1 KiB
YAML
services:
|
|
wg-easy:
|
|
image: ghcr.io/wg-easy/wg-easy:15
|
|
container_name: wg-easy
|
|
# Kernel 6.18+ dropped the legacy iptables modules; the image defaults to
|
|
# legacy iptables, so wg-quick's NAT rules fail ("can't initialize iptables
|
|
# table nat"). Point iptables/ip6tables at the nft backend (which works with
|
|
# the modern kernel) before running the normal entrypoint.
|
|
entrypoint:
|
|
- /bin/sh
|
|
- -c
|
|
- ln -sf /usr/sbin/iptables-nft /etc/alternatives/iptables && ln -sf /usr/sbin/ip6tables-nft /etc/alternatives/ip6tables && exec docker-entrypoint.sh "$$@"
|
|
- --
|
|
command: ["/usr/bin/dumb-init", "node", "server/index.mjs"]
|
|
labels:
|
|
- "com.centurylinklabs.watchtower.enable=true"
|
|
networks:
|
|
caddy:
|
|
interface_name: wgeth1
|
|
wg:
|
|
ipv4_address: 10.42.42.42
|
|
ipv6_address: fdcc:ad94:bacf:61a3::2a
|
|
interface_name: wgeth0
|
|
environment:
|
|
WG_DEVICE: wgeth0
|
|
EXPERIMENTAL_AWG: "true"
|
|
# NixOS has no /lib/modules, so the modinfo-based auto-detect fails; the
|
|
# amneziawg module is loaded on the host (nix-config boot.kernelModules).
|
|
OVERRIDE_AUTO_AWG: awg
|
|
DISABLE_IPV6: "true"
|
|
volumes:
|
|
- ./data:/etc/wireguard
|
|
- /lib/modules:/lib/modules:ro
|
|
ports:
|
|
- "51820:51820/udp"
|
|
# - "51821:51821/tcp"
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "timeout 5s sh -c \"awg show | grep -q interface\""]
|
|
interval: 60s
|
|
timeout: 5s
|
|
retries: 3
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- SYS_MODULE
|
|
sysctls:
|
|
- net.ipv4.ip_forward=1
|
|
- net.ipv4.conf.all.src_valid_mark=1
|
|
- net.ipv6.conf.all.disable_ipv6=0
|
|
- net.ipv6.conf.all.forwarding=1
|
|
- net.ipv6.conf.default.forwarding=1
|
|
logging:
|
|
driver: "json-file"
|
|
options:
|
|
max-size: "100m"
|
|
max-file: "3"
|
|
|
|
networks:
|
|
caddy:
|
|
name: caddy
|
|
driver: bridge
|
|
external: true
|
|
wg:
|
|
driver: bridge
|
|
enable_ipv6: true
|
|
ipam:
|
|
driver: default
|
|
config:
|
|
- subnet: 10.42.42.0/24
|
|
- subnet: fdcc:ad94:bacf:61a3::/64
|