mirror of https://github.com/wg-easy/wg-easy
Bernd Storath
2 weeks ago
committed by
GitHub
GitHub
21 changed files with 463 additions and 67 deletions
@ -6,13 +6,51 @@ title: Auto Updates |
|||||
|
|
||||
With Docker Compose `wg-easy` can be updated with a single command: |
With Docker Compose `wg-easy` can be updated with a single command: |
||||
|
|
||||
Replace `$DIR` with the directory where your `docker-compose.yml` is located. |
|
||||
|
|
||||
```shell |
```shell |
||||
cd $DIR |
cd /etc/docker/containers/wg-easy |
||||
sudo docker compose up -d --pull always |
sudo docker compose up -d --pull always |
||||
``` |
``` |
||||
|
|
||||
|
### Watchtower |
||||
|
|
||||
|
If you want the updates to be fully automatic you can install Watchtower. This will check for updates every day at 4:00 AM and update the container if a new version is available. |
||||
|
|
||||
|
File: `/etc/docker/containers/watchtower/docker-compose.yml` |
||||
|
|
||||
|
```yaml |
||||
|
services: |
||||
|
watchtower: |
||||
|
image: containrrr/watchtower:latest |
||||
|
volumes: |
||||
|
- /var/run/docker.sock:/var/run/docker.sock |
||||
|
env_file: |
||||
|
- watchtower.env |
||||
|
restart: unless-stopped |
||||
|
``` |
||||
|
|
||||
|
File: `/etc/docker/containers/watchtower/watchtower.env` |
||||
|
|
||||
|
```env |
||||
|
WATCHTOWER_CLEANUP=true |
||||
|
WATCHTOWER_SCHEDULE=0 0 4 * * * |
||||
|
TZ=Europe/Berlin |
||||
|
|
||||
|
# Email |
||||
|
# WATCHTOWER_NOTIFICATIONS_LEVEL=info |
||||
|
# WATCHTOWER_NOTIFICATIONS=email |
||||
|
# [email protected] |
||||
|
# [email protected] |
||||
|
# WATCHTOWER_NOTIFICATION_EMAIL_SERVER=smtp.example.com |
||||
|
# [email protected] |
||||
|
# WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD="SuperSecurePassword" |
||||
|
# WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=587 |
||||
|
``` |
||||
|
|
||||
|
```shell |
||||
|
cd /etc/docker/containers/watchtower |
||||
|
sudo docker compose up -d |
||||
|
``` |
||||
|
|
||||
## Docker Run |
## Docker Run |
||||
|
|
||||
```shell |
```shell |
||||
|
|||||
@ -2,4 +2,183 @@ |
|||||
title: Traefik |
title: Traefik |
||||
--- |
--- |
||||
|
|
||||
TODO |
/// note | Opiniated |
||||
|
|
||||
|
This guide is opinionated. If you use other conventions or folder layouts, feel free to change the commands and paths. |
||||
|
/// |
||||
|
|
||||
|
## Create docker compose project |
||||
|
|
||||
|
```shell |
||||
|
sudo mkdir -p /etc/docker/containers/traefik |
||||
|
cd /etc/docker/containers/traefik |
||||
|
``` |
||||
|
|
||||
|
## Create docker compose file |
||||
|
|
||||
|
File: `/etc/docker/containers/traefik/docker-compose.yml` |
||||
|
|
||||
|
```yaml |
||||
|
services: |
||||
|
traefik: |
||||
|
image: traefik:3.3 |
||||
|
container_name: traefik |
||||
|
restart: unless-stopped |
||||
|
ports: |
||||
|
- "80:80" |
||||
|
- "443:443/tcp" |
||||
|
- "443:443/udp" |
||||
|
volumes: |
||||
|
- /var/run/docker.sock:/var/run/docker.sock |
||||
|
- /etc/docker/volumes/traefik/traefik.yml:/traefik.yml:ro |
||||
|
- /etc/docker/volumes/traefik/traefik_dynamic.yml:/traefik_dynamic.yml:ro |
||||
|
- /etc/docker/volumes/traefik/acme.json:/acme.json |
||||
|
networks: |
||||
|
- traefik |
||||
|
|
||||
|
networks: |
||||
|
traefik: |
||||
|
external: true |
||||
|
``` |
||||
|
|
||||
|
## Create traefik.yml |
||||
|
|
||||
|
File: `/etc/docker/volumes/traefik/traefik.yml` |
||||
|
|
||||
|
```yaml |
||||
|
log: |
||||
|
level: INFO |
||||
|
|
||||
|
entryPoints: |
||||
|
web: |
||||
|
address: ":80/tcp" |
||||
|
http: |
||||
|
redirections: |
||||
|
entryPoint: |
||||
|
to: websecure |
||||
|
scheme: https |
||||
|
websecure: |
||||
|
address: ":443/tcp" |
||||
|
http: |
||||
|
middlewares: |
||||
|
- compress@file |
||||
|
- hsts@file |
||||
|
tls: |
||||
|
certResolver: letsencrypt |
||||
|
http3: {} |
||||
|
|
||||
|
api: |
||||
|
dashboard: true |
||||
|
|
||||
|
certificatesResolvers: |
||||
|
letsencrypt: |
||||
|
acme: |
||||
|
email: [email protected]$ |
||||
|
storage: acme.json |
||||
|
httpChallenge: |
||||
|
entryPoint: web |
||||
|
|
||||
|
providers: |
||||
|
docker: |
||||
|
watch: true |
||||
|
network: traefik |
||||
|
exposedByDefault: false |
||||
|
file: |
||||
|
filename: traefik_dynamic.yml |
||||
|
|
||||
|
serversTransport: |
||||
|
insecureSkipVerify: true |
||||
|
``` |
||||
|
|
||||
|
## Create traefik_dynamic.yml |
||||
|
|
||||
|
File: `/etc/docker/volumes/traefik/traefik_dynamic.yml` |
||||
|
|
||||
|
```yaml |
||||
|
http: |
||||
|
middlewares: |
||||
|
services: |
||||
|
basicAuth: |
||||
|
users: |
||||
|
- "$username$:$password$" |
||||
|
compress: |
||||
|
compress: {} |
||||
|
hsts: |
||||
|
headers: |
||||
|
stsSeconds: 2592000 |
||||
|
routers: |
||||
|
api: |
||||
|
rule: Host(`traefik.$example.com$`) |
||||
|
entrypoints: |
||||
|
- websecure |
||||
|
middlewares: |
||||
|
- services |
||||
|
service: api@internal |
||||
|
|
||||
|
tls: |
||||
|
options: |
||||
|
default: |
||||
|
cipherSuites: |
||||
|
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 |
||||
|
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 |
||||
|
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 |
||||
|
sniStrict: true |
||||
|
``` |
||||
|
|
||||
|
## Create acme.json |
||||
|
|
||||
|
```shell |
||||
|
sudo touch /etc/docker/volumes/traefik/acme.json |
||||
|
sudo chmod 600 /etc/docker/volumes/traefik/acme.json |
||||
|
``` |
||||
|
|
||||
|
## Create network |
||||
|
|
||||
|
```shell |
||||
|
sudo docker network create traefik |
||||
|
``` |
||||
|
|
||||
|
## Start traefik |
||||
|
|
||||
|
```shell |
||||
|
sudo docker-compose up -d |
||||
|
``` |
||||
|
|
||||
|
You can no access the Traefik dashboard at `https://traefik.$example.com$` with the credentials you set in `traefik_dynamic.yml`. |
||||
|
|
||||
|
## Add Labels to wg-easy |
||||
|
|
||||
|
To add labels to your `wg-easy` service, you can add the following to your `docker-compose.yml` file: |
||||
|
|
||||
|
File: `/etc/docker/containers/wg-easy/docker-compose.yml` |
||||
|
|
||||
|
```yaml |
||||
|
services: |
||||
|
wg-easy: |
||||
|
... |
||||
|
container_name: wg-easy |
||||
|
networks: |
||||
|
... |
||||
|
traefik: {} |
||||
|
labels: |
||||
|
- "traefik.enable=true" |
||||
|
- "traefik.http.routers.wg-easy.rule=Host(`wg-easy.$example.com$`)" |
||||
|
- "traefik.http.routers.wg-easy.entrypoints=websecure" |
||||
|
- "traefik.http.routers.wg-easy.service=wg-easy" |
||||
|
- "traefik.http.services.wg-easy.loadbalancer.server.port=51821" |
||||
|
... |
||||
|
|
||||
|
networks: |
||||
|
... |
||||
|
traefik: |
||||
|
external: true |
||||
|
``` |
||||
|
|
||||
|
## Restart wg-easy |
||||
|
|
||||
|
```shell |
||||
|
cd /etc/docker/containers/wg-easy |
||||
|
sudo docker-compose up -d |
||||
|
``` |
||||
|
|
||||
|
You can now access `wg-easy` at `https://wg-easy.$example.com$` and start the setup. |
||||
|
|||||
@ -0,0 +1,97 @@ |
|||||
|
--- |
||||
|
title: FAQ |
||||
|
hide: |
||||
|
- navigation |
||||
|
--- |
||||
|
|
||||
|
Here are some frequently asked questions or errors about `wg-easy`. If you have a question that is not answered here, please feel free to open a discussion on GitHub. |
||||
|
|
||||
|
## Error: WireGuard exited with the error: Cannot find device "wg0" |
||||
|
|
||||
|
This error indicates that the WireGuard interface `wg0` does not exist. This can happen if the WireGuard kernel module is not loaded or if the interface was not created properly. |
||||
|
|
||||
|
To resolve this issue, you can try the following steps: |
||||
|
|
||||
|
1. **Load the WireGuard kernel module**: If the WireGuard kernel module is not loaded, you can load it manually by running: |
||||
|
|
||||
|
```bash |
||||
|
sudo modprobe wireguard |
||||
|
``` |
||||
|
|
||||
|
2. **Load the WireGuard kernel module on boot**: If you want to ensure that the WireGuard kernel module is loaded automatically on boot, you can add it to the `/etc/modules` file: |
||||
|
|
||||
|
```bash |
||||
|
echo "wireguard" | sudo tee -a /etc/modules |
||||
|
``` |
||||
|
|
||||
|
## can't initialize iptables table `nat': Table does not exist (do you need to insmod?) |
||||
|
|
||||
|
This error indicates that the `nat` table in `iptables` does not exist. This can happen if the `iptables` kernel module is not loaded or if the `nat` table is not supported by your kernel. |
||||
|
|
||||
|
To resolve this issue, you can try the following steps: |
||||
|
|
||||
|
1. **Load the `nat` kernel module**: If the `nat` kernel module is not loaded, you can load it manually by running: |
||||
|
|
||||
|
```bash |
||||
|
sudo modprobe iptable_nat |
||||
|
``` |
||||
|
|
||||
|
2. **Load the `nat` kernel module on boot**: If you want to ensure that the `nat` kernel module is loaded automatically on boot, you can add it to the `/etc/modules` file: |
||||
|
|
||||
|
```bash |
||||
|
echo "iptable_nat" | sudo tee -a /etc/modules |
||||
|
``` |
||||
|
|
||||
|
## can't initialize ip6tables table `nat': Table does not exist (do you need to insmod?) |
||||
|
|
||||
|
This error indicates that the `nat` table in `ip6tables` does not exist. This can happen if the `ip6tables` kernel module is not loaded or if the `nat` table is not supported by your kernel. |
||||
|
|
||||
|
To resolve this issue, you can try the following steps: |
||||
|
|
||||
|
1. **Load the `nat` kernel module**: If the `nat` kernel module is not loaded, you can load it manually by running: |
||||
|
|
||||
|
```bash |
||||
|
sudo modprobe ip6table_nat |
||||
|
``` |
||||
|
|
||||
|
2. **Load the `nat` kernel module on boot**: If you want to ensure that the `nat` kernel module is loaded automatically on boot, you can add it to the `/etc/modules` file: |
||||
|
|
||||
|
```bash |
||||
|
echo "ip6table_nat" | sudo tee -a /etc/modules |
||||
|
``` |
||||
|
|
||||
|
## can't initialize iptables table `filter': Permission denied |
||||
|
|
||||
|
This error indicates that the `filter` table in `iptables` cannot be initialized due to permission issues. This can happen if you are not running the command with sufficient privileges. |
||||
|
|
||||
|
To resolve this issue, you can try the following steps: |
||||
|
|
||||
|
1. **Load the `filter` kernel module**: If the `filter` kernel module is not loaded, you can load it manually by running: |
||||
|
|
||||
|
```bash |
||||
|
sudo modprobe iptable_filter |
||||
|
``` |
||||
|
|
||||
|
2. **Load the `filter` kernel module on boot**: If you want to ensure that the `filter` kernel module is loaded automatically on boot, you can add it to the `/etc/modules` file: |
||||
|
|
||||
|
```bash |
||||
|
echo "iptable_filter" | sudo tee -a /etc/modules |
||||
|
``` |
||||
|
|
||||
|
## can't initialize ip6tables table `filter': Permission denied |
||||
|
|
||||
|
This error indicates that the `filter` table in `ip6tables` cannot be initialized due to permission issues. This can happen if you are not running the command with sufficient privileges. |
||||
|
|
||||
|
To resolve this issue, you can try the following steps: |
||||
|
|
||||
|
1. **Load the `filter` kernel module**: If the `filter` kernel module is not loaded, you can load it manually by running: |
||||
|
|
||||
|
```bash |
||||
|
sudo modprobe ip6table_filter |
||||
|
``` |
||||
|
|
||||
|
2. **Load the `filter` kernel module on boot**: If you want to ensure that the `filter` kernel module is loaded automatically on boot, you can add it to the `/etc/modules` file: |
||||
|
|
||||
|
```bash |
||||
|
echo "ip6table_filter" | sudo tee -a /etc/modules |
||||
|
``` |
||||
@ -1,5 +1,5 @@ |
|||||
--- |
--- |
||||
title: NGINX |
title: 2FA |
||||
--- |
--- |
||||
|
|
||||
TODO |
TODO |
||||
@ -0,0 +1,5 @@ |
|||||
|
--- |
||||
|
title: Edit Account |
||||
|
--- |
||||
|
|
||||
|
TODO |
||||
@ -0,0 +1,5 @@ |
|||||
|
--- |
||||
|
title: Admin Panel |
||||
|
--- |
||||
|
|
||||
|
TODO |
||||
@ -0,0 +1,5 @@ |
|||||
|
--- |
||||
|
title: Edit Client |
||||
|
--- |
||||
|
|
||||
|
TODO |
||||
@ -0,0 +1,5 @@ |
|||||
|
--- |
||||
|
title: Login |
||||
|
--- |
||||
|
|
||||
|
TODO |
||||
@ -0,0 +1,5 @@ |
|||||
|
--- |
||||
|
title: Setup |
||||
|
--- |
||||
|
|
||||
|
TODO |
||||
Loading…
Reference in new issue