From ea36d9e0759c96ce3ec168743208528920d7dc1a Mon Sep 17 00:00:00 2001
From: narawat <narawat@gmail.com>
Date: Tue, 22 Sep 2026 06:21:05 +0700
Subject: [PATCH] 1st commit

---
 .gitignore         |  1 +
 docker-compose.yml | 37 +++++++++++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+)
 create mode 100644 .gitignore
 create mode 100644 docker-compose.yml

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..96d1695
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+etc_wireguard/
\ No newline at end of file
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..f98bda0
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,37 @@
+
+services:
+  wg-easy:
+    image: ghcr.io/wg-easy/wg-easy
+    container_name: wg-easy
+    environment:
+      # Your DDNS domain or public home IP address
+      - WG_HOST=yiem.cc
+      
+      #       Using Docker + wgpw to generate password hash
+      # wg-password (wgpw) is a script that generates bcrypt password hashes. You can use it with docker:
+      # docker run ghcr.io/wg-easy/wg-easy:14 wgpw YOUR_PASSWORD
+      # You will see an output similar to this:
+      # PASSWORD_HASH='$2b$12$coPqCsPtcFO.Ab99xylBNOW4.Iu7OOA2/ZIboHN6/oyxca3MWo7fW'
+      # In this example, the $2b$12$coPqCsPtcFO.Ab99xylBNOW4.Iu7OOA2/ZIboHN6/oyxca3MWo7fW string is your hashed password. 
+      # For using it with docker-compose, you need to escape each $ characters by adding another $ before them, or 
+      # they will get interpreted as variables. The final password you can use in docker-compose will look like this:
+      # $$2b$$12$$coPqCsPtcFO.Ab99xylBNOW4.Iu7OOA2/ZIboHN6/oyxca3MWo7fW
+
+      # create hash password by $linux> docker run ghcr.io/wg-easy/wg-easy:14 wgpw ton@Wireguard_0.0
+      - PASSWORD_HASH=$$2a$$12$$IV3ANTxuu3rHfdrd2bL/.eeLCkI5XQ8veJBSmutXlnXmVt9/m1.zi
+      - WG_DEFAULT_DNS=1.1.1.1
+
+      - WG_DEVICE=wg0
+      # Allows both incoming (-i wg0) and outgoing (-o wg0) forwarding, plus NAT masquerade
+      - WG_POST_UP=iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
+      - WG_POST_DOWN=iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
+    volumes:
+      - ./etc_wireguard:/etc/wireguard
+    network_mode: host
+    ports:
+      - "1190:51820/udp" # WireGuard VPN port
+      - "1191:51821/tcp" # Web UI port
+    cap_add:
+      - NET_ADMIN
+      - SYS_MODULE
+    restart: unless-stopped
\ No newline at end of file