37 lines
1.8 KiB
YAML
37 lines
1.8 KiB
YAML
|
|
services:
|
|
wg-easy:
|
|
image: ghcr.io/wg-easy/wg-easy
|
|
container_name: wg-easy
|
|
environment:
|
|
# Your DDNS domain or public home IP address
|
|
- WG_HOST=yiem.cc
|
|
|
|
# Using Docker + wgpw to generate password hash
|
|
# wg-password (wgpw) is a script that generates bcrypt password hashes. You can use it with docker:
|
|
# docker run ghcr.io/wg-easy/wg-easy:14 wgpw YOUR_PASSWORD
|
|
# You will see an output similar to this:
|
|
# PASSWORD_HASH='$2b$12$coPqCsPtcFO.Ab99xylBNOW4.Iu7OOA2/ZIboHN6/oyxca3MWo7fW'
|
|
# In this example, the $2b$12$coPqCsPtcFO.Ab99xylBNOW4.Iu7OOA2/ZIboHN6/oyxca3MWo7fW string is your hashed password.
|
|
# For using it with docker-compose, you need to escape each $ characters by adding another $ before them, or
|
|
# they will get interpreted as variables. The final password you can use in docker-compose will look like this:
|
|
# $$2b$$12$$coPqCsPtcFO.Ab99xylBNOW4.Iu7OOA2/ZIboHN6/oyxca3MWo7fW
|
|
|
|
# create hash password by $linux> docker run ghcr.io/wg-easy/wg-easy:14 wgpw ton@Wireguard_0.0
|
|
- PASSWORD_HASH=$$2a$$12$$IV3ANTxuu3rHfdrd2bL/.eeLCkI5XQ8veJBSmutXlnXmVt9/m1.zi
|
|
- WG_DEFAULT_DNS=1.1.1.1
|
|
|
|
- WG_DEVICE=wg0
|
|
# Allows both incoming (-i wg0) and outgoing (-o wg0) forwarding, plus NAT masquerade
|
|
- WG_POST_UP=iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
|
|
- WG_POST_DOWN=iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
|
|
volumes:
|
|
- ./etc_wireguard:/etc/wireguard
|
|
network_mode: host
|
|
ports:
|
|
- "1190:51820/udp" # WireGuard VPN port
|
|
- "1191:51821/tcp" # Web UI port
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- SYS_MODULE
|
|
restart: unless-stopped |