mirror of https://github.com/wg-easy/wg-easy
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
78 lines
2.6 KiB
78 lines
2.6 KiB
#---
|
|
# wg-easy-ip-tls - docker-compose.yml
|
|
# TLS certificate modes:
|
|
# AUTO: Set LEGO_EMAIL + LEGO_IP to have lego obtain certs
|
|
# automatically inside the container.
|
|
# MANUAL: Pre-provision certs on the host and mount them.
|
|
# Add a lego_data volume for cert persistence (AUTO).
|
|
# See README.md for full usage instructions.
|
|
#---
|
|
volumes:
|
|
etc_wireguard:
|
|
lego_data: # Persists lego account + cert data across restarts
|
|
|
|
services:
|
|
wg-easy:
|
|
image: ghcr.io/platon47/wg-easy-ip-tls:latest
|
|
# build: . # uncomment to build locally instead
|
|
# image: ghcr.io/platon47/wg-easy-ip-tls:stable # use stable tag as rollback
|
|
container_name: wg-easy
|
|
environment:
|
|
# -- Core settings ---
|
|
- PORT=51821
|
|
- HOST=0.0.0.0
|
|
- INSECURE=false
|
|
- LEGO_ENABLED=true # enables TLS
|
|
|
|
# -- AUTO cert mode (lego obtains cert inside container) ---
|
|
# Uncomment and fill in to enable automatic cert issuance:
|
|
# - [email protected]
|
|
# - LEGO_IP=YOUR_SERVER_PUBLIC_IP
|
|
# - LEGO_CHALLENGE=http # or: tls-alpn (needs port 443)
|
|
# - LEGO_DATA_DIR=/root/lego-data # default
|
|
# - LEGO_RENEW_INTERVAL=432000 # renewal check in seconds (5 days)
|
|
|
|
# -- MANUAL cert mode (mount certs from host) ---
|
|
# Pre-provision certs: chmod 600 /root/cert/ip/privkey.pem
|
|
# Then mount: /root/cert/ip:/root/cert/ip:ro (see volumes below)
|
|
|
|
# -- Optional: WireGuard settings ---
|
|
# - WG_HOST=111.22.3.4 # set via Web UI (v15+)
|
|
# - PASSWORD_HASH= # set via Web UI (v15+)
|
|
# - WG_DEFAULT_DNS=1.1.1.1
|
|
# - WG_DEFAULT_ADDRESS=10.8.0.x
|
|
# - WG_MTU=1420
|
|
networks:
|
|
wg:
|
|
ipv4_address: 10.42.42.42
|
|
ipv6_address: fdcc:ad94:bacf:61a3::2a
|
|
volumes:
|
|
- etc_wireguard:/etc/wireguard
|
|
- /lib/modules:/lib/modules:ro
|
|
# MANUAL mode: mount pre-provisioned cert (read-only)
|
|
# - /root/cert/ip:/root/cert/ip:ro
|
|
# AUTO mode: persist lego account and cert data
|
|
- lego_data:/root/lego-data
|
|
ports:
|
|
- "51820:51820/udp" # WireGuard VPN
|
|
- "51821:51821/tcp" # wg-easy admin UI (HTTPS)
|
|
- "80:80/tcp" # Required for LEGO http-01 challenge (AUTO mode)
|
|
restart: unless-stopped
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- SYS_MODULE
|
|
sysctls:
|
|
- net.ipv4.ip_forward=1
|
|
- net.ipv4.conf.all.src_valid_mark=1
|
|
- net.ipv6.conf.all.disable_ipv6=0
|
|
- net.ipv6.conf.all.forwarding=1
|
|
- net.ipv6.conf.default.forwarding=1
|
|
|
|
networks:
|
|
wg:
|
|
enable_ipv6: true
|
|
driver: bridge
|
|
ipam:
|
|
config:
|
|
- subnet: 10.42.42.0/24
|
|
- subnet: fdcc:ad94:bacf:61a3::/64
|
|
|