mirror of https://github.com/wg-easy/wg-easy
Bernd Storath
2 days ago
16 changed files with 433 additions and 71 deletions
@ -6,13 +6,51 @@ title: Auto Updates |
|||
|
|||
With Docker Compose `wg-easy` can be updated with a single command: |
|||
|
|||
Replace `$DIR` with the directory where your `docker-compose.yml` is located. |
|||
|
|||
```shell |
|||
cd $DIR |
|||
cd /etc/docker/containers/wg-easy |
|||
sudo docker compose up -d --pull always |
|||
``` |
|||
|
|||
### Watchtower |
|||
|
|||
If you want the updates to be fully automatic you can install Watchtower. This will check for updates every day at 4:00 AM and update the container if a new version is available. |
|||
|
|||
File: `/etc/docker/containers/watchtower/docker-compose.yml` |
|||
|
|||
```yaml |
|||
services: |
|||
watchtower: |
|||
image: containrrr/watchtower:latest |
|||
volumes: |
|||
- /var/run/docker.sock:/var/run/docker.sock |
|||
env_file: |
|||
- watchtower.env |
|||
restart: unless-stopped |
|||
``` |
|||
|
|||
File: `/etc/docker/containers/watchtower/watchtower.env` |
|||
|
|||
```env |
|||
WATCHTOWER_CLEANUP=true |
|||
WATCHTOWER_SCHEDULE=0 0 4 * * * |
|||
TZ=Europe/Berlin |
|||
|
|||
# Email |
|||
# WATCHTOWER_NOTIFICATIONS_LEVEL=info |
|||
# WATCHTOWER_NOTIFICATIONS=email |
|||
# [email protected] |
|||
# [email protected] |
|||
# WATCHTOWER_NOTIFICATION_EMAIL_SERVER=smtp.example.com |
|||
# [email protected] |
|||
# WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD="SuperSecurePassword" |
|||
# WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=587 |
|||
``` |
|||
|
|||
```shell |
|||
cd /etc/docker/containers/watchtower |
|||
sudo docker compose up -d |
|||
``` |
|||
|
|||
## Docker Run |
|||
|
|||
```shell |
|||
|
|||
@ -1,5 +0,0 @@ |
|||
--- |
|||
title: NGINX |
|||
--- |
|||
|
|||
TODO |
|||
@ -2,4 +2,183 @@ |
|||
title: Traefik |
|||
--- |
|||
|
|||
TODO |
|||
/// note | Opiniated |
|||
|
|||
This guide is opinionated. If you use other conventions or folder layouts, feel free to change the commands and paths. |
|||
/// |
|||
|
|||
## Create docker compose project |
|||
|
|||
```shell |
|||
sudo mkdir -p /etc/docker/containers/traefik |
|||
cd /etc/docker/containers/traefik |
|||
``` |
|||
|
|||
## Create docker compose file |
|||
|
|||
File: `/etc/docker/containers/traefik/docker-compose.yml` |
|||
|
|||
```yaml |
|||
services: |
|||
traefik: |
|||
image: traefik:3.3 |
|||
container_name: traefik |
|||
restart: unless-stopped |
|||
ports: |
|||
- "80:80" |
|||
- "443:443/tcp" |
|||
- "443:443/udp" |
|||
volumes: |
|||
- /var/run/docker.sock:/var/run/docker.sock |
|||
- /etc/docker/volumes/traefik/traefik.yml:/traefik.yml:ro |
|||
- /etc/docker/volumes/traefik/traefik_dynamic.yml:/traefik_dynamic.yml:ro |
|||
- /etc/docker/volumes/traefik/acme.json:/acme.json |
|||
networks: |
|||
- traefik |
|||
|
|||
networks: |
|||
traefik: |
|||
external: true |
|||
``` |
|||
|
|||
## Create traefik.yml |
|||
|
|||
File: `/etc/docker/volumes/traefik/traefik.yml` |
|||
|
|||
```yaml |
|||
log: |
|||
level: INFO |
|||
|
|||
entryPoints: |
|||
web: |
|||
address: ":80/tcp" |
|||
http: |
|||
redirections: |
|||
entryPoint: |
|||
to: websecure |
|||
scheme: https |
|||
websecure: |
|||
address: ":443/tcp" |
|||
http: |
|||
middlewares: |
|||
- compress@file |
|||
- hsts@file |
|||
tls: |
|||
certResolver: letsencrypt |
|||
http3: {} |
|||
|
|||
api: |
|||
dashboard: true |
|||
|
|||
certificatesResolvers: |
|||
letsencrypt: |
|||
acme: |
|||
email: [email protected]$ |
|||
storage: acme.json |
|||
httpChallenge: |
|||
entryPoint: web |
|||
|
|||
providers: |
|||
docker: |
|||
watch: true |
|||
network: traefik |
|||
exposedByDefault: false |
|||
file: |
|||
filename: traefik_dynamic.yml |
|||
|
|||
serversTransport: |
|||
insecureSkipVerify: true |
|||
``` |
|||
|
|||
## Create traefik_dynamic.yml |
|||
|
|||
File: `/etc/docker/volumes/traefik/traefik_dynamic.yml` |
|||
|
|||
```yaml |
|||
http: |
|||
middlewares: |
|||
services: |
|||
basicAuth: |
|||
users: |
|||
- "$username$:$password$" |
|||
compress: |
|||
compress: {} |
|||
hsts: |
|||
headers: |
|||
stsSeconds: 2592000 |
|||
routers: |
|||
api: |
|||
rule: Host(`traefik.$example.com$`) |
|||
entrypoints: |
|||
- websecure |
|||
middlewares: |
|||
- services |
|||
service: api@internal |
|||
|
|||
tls: |
|||
options: |
|||
default: |
|||
cipherSuites: |
|||
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 |
|||
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 |
|||
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 |
|||
sniStrict: true |
|||
``` |
|||
|
|||
## Create acme.json |
|||
|
|||
```shell |
|||
sudo touch /etc/docker/volumes/traefik/acme.json |
|||
sudo chmod 600 /etc/docker/volumes/traefik/acme.json |
|||
``` |
|||
|
|||
## Create network |
|||
|
|||
```shell |
|||
sudo docker network create traefik |
|||
``` |
|||
|
|||
## Start traefik |
|||
|
|||
```shell |
|||
sudo docker-compose up -d |
|||
``` |
|||
|
|||
You can no access the Traefik dashboard at `https://traefik.$example.com$` with the credentials you set in `traefik_dynamic.yml`. |
|||
|
|||
## Add Labels to wg-easy |
|||
|
|||
To add labels to your `wg-easy` service, you can add the following to your `docker-compose.yml` file: |
|||
|
|||
File: `/etc/docker/containers/wg-easy/docker-compose.yml` |
|||
|
|||
```yaml |
|||
services: |
|||
wg-easy: |
|||
... |
|||
container_name: wg-easy |
|||
networks: |
|||
... |
|||
traefik: {} |
|||
labels: |
|||
- "traefik.enable=true" |
|||
- "traefik.http.routers.wg-easy.rule=Host(`wg-easy.$example.com$`)" |
|||
- "traefik.http.routers.wg-easy.entrypoints=websecure" |
|||
- "traefik.http.routers.wg-easy.service=wg-easy" |
|||
- "traefik.http.services.wg-easy.loadbalancer.server.port=51821" |
|||
... |
|||
|
|||
networks: |
|||
... |
|||
traefik: |
|||
external: true |
|||
``` |
|||
|
|||
## Restart wg-easy |
|||
|
|||
```shell |
|||
cd /etc/docker/containers/wg-easy |
|||
sudo docker-compose up -d |
|||
``` |
|||
|
|||
You can now access `wg-easy` at `https://wg-easy.$example.com$` and start the setup. |
|||
|
|||
@ -0,0 +1,97 @@ |
|||
--- |
|||
title: FAQ |
|||
hide: |
|||
- navigation |
|||
--- |
|||
|
|||
Here are some frequently asked questions or errors about `wg-easy`. If you have a question that is not answered here, please feel free to open a discussion on GitHub. |
|||
|
|||
## Error: WireGuard exited with the error: Cannot find device "wg0" |
|||
|
|||
This error indicates that the WireGuard interface `wg0` does not exist. This can happen if the WireGuard kernel module is not loaded or if the interface was not created properly. |
|||
|
|||
To resolve this issue, you can try the following steps: |
|||
|
|||
1. **Load the WireGuard kernel module**: If the WireGuard kernel module is not loaded, you can load it manually by running: |
|||
|
|||
```bash |
|||
sudo modprobe wireguard |
|||
``` |
|||
|
|||
2. **Load the WireGuard kernel module on boot**: If you want to ensure that the WireGuard kernel module is loaded automatically on boot, you can add it to the `/etc/modules` file: |
|||
|
|||
```bash |
|||
echo "wireguard" | sudo tee -a /etc/modules |
|||
``` |
|||
|
|||
## can't initialize iptables table `nat': Table does not exist (do you need to insmod?) |
|||
|
|||
This error indicates that the `nat` table in `iptables` does not exist. This can happen if the `iptables` kernel module is not loaded or if the `nat` table is not supported by your kernel. |
|||
|
|||
To resolve this issue, you can try the following steps: |
|||
|
|||
1. **Load the `nat` kernel module**: If the `nat` kernel module is not loaded, you can load it manually by running: |
|||
|
|||
```bash |
|||
sudo modprobe iptable_nat |
|||
``` |
|||
|
|||
2. **Load the `nat` kernel module on boot**: If you want to ensure that the `nat` kernel module is loaded automatically on boot, you can add it to the `/etc/modules` file: |
|||
|
|||
```bash |
|||
echo "iptable_nat" | sudo tee -a /etc/modules |
|||
``` |
|||
|
|||
## can't initialize ip6tables table `nat': Table does not exist (do you need to insmod?) |
|||
|
|||
This error indicates that the `nat` table in `ip6tables` does not exist. This can happen if the `ip6tables` kernel module is not loaded or if the `nat` table is not supported by your kernel. |
|||
|
|||
To resolve this issue, you can try the following steps: |
|||
|
|||
1. **Load the `nat` kernel module**: If the `nat` kernel module is not loaded, you can load it manually by running: |
|||
|
|||
```bash |
|||
sudo modprobe ip6table_nat |
|||
``` |
|||
|
|||
2. **Load the `nat` kernel module on boot**: If you want to ensure that the `nat` kernel module is loaded automatically on boot, you can add it to the `/etc/modules` file: |
|||
|
|||
```bash |
|||
echo "ip6table_nat" | sudo tee -a /etc/modules |
|||
``` |
|||
|
|||
## can't initialize iptables table `filter': Permission denied |
|||
|
|||
This error indicates that the `filter` table in `iptables` cannot be initialized due to permission issues. This can happen if you are not running the command with sufficient privileges. |
|||
|
|||
To resolve this issue, you can try the following steps: |
|||
|
|||
1. **Load the `filter` kernel module**: If the `filter` kernel module is not loaded, you can load it manually by running: |
|||
|
|||
```bash |
|||
sudo modprobe iptable_filter |
|||
``` |
|||
|
|||
2. **Load the `filter` kernel module on boot**: If you want to ensure that the `filter` kernel module is loaded automatically on boot, you can add it to the `/etc/modules` file: |
|||
|
|||
```bash |
|||
echo "iptable_filter" | sudo tee -a /etc/modules |
|||
``` |
|||
|
|||
## can't initialize ip6tables table `filter': Permission denied |
|||
|
|||
This error indicates that the `filter` table in `ip6tables` cannot be initialized due to permission issues. This can happen if you are not running the command with sufficient privileges. |
|||
|
|||
To resolve this issue, you can try the following steps: |
|||
|
|||
1. **Load the `filter` kernel module**: If the `filter` kernel module is not loaded, you can load it manually by running: |
|||
|
|||
```bash |
|||
sudo modprobe ip6table_filter |
|||
``` |
|||
|
|||
2. **Load the `filter` kernel module on boot**: If you want to ensure that the `filter` kernel module is loaded automatically on boot, you can add it to the `/etc/modules` file: |
|||
|
|||
```bash |
|||
echo "ip6table_filter" | sudo tee -a /etc/modules |
|||
``` |
|||
Loading…
Reference in new issue