jcoffey-dev
065a0905da
ghcr.io went dark with the GitHub account, so every `docker pull` and template that named it has been failing. The images are republished, multi-arch as before, at registry.coffeylabs.org under the same names, and pull anonymously -- nothing needs a login. Where a link pointed at an issue list, it now goes to /-/work_items: in GitLab 19 that is the public list, and /-/issues returns 404 to anyone not signed in. Issues themselves did not come across from GitHub, so a link to a specific old issue is replaced with a note saying where it was.
56 lines
2.3 KiB
YAML
56 lines
2.3 KiB
YAML
# ihasvpn: a WireGuard server with a web admin UI, in one container.
|
|
#
|
|
# Start it, open http://<host>:51821, create the first administrator, add a
|
|
# peer, scan the QR code. The container needs NET_ADMIN to create the tunnel
|
|
# interface and its NAT rules, and the sysctls below to forward packets.
|
|
#
|
|
# For the highest throughput see docs/performance.md: it explains when to use
|
|
# docker-compose.host.yml (host networking) and which host sysctls matter.
|
|
services:
|
|
ihasvpn:
|
|
image: registry.coffeylabs.org/coffey-labs/ihasvpn:latest
|
|
container_name: ihasvpn
|
|
restart: unless-stopped
|
|
cap_add:
|
|
- NET_ADMIN
|
|
# Only needed if the host has not loaded the wireguard module yet and
|
|
# you want the container to load it. Usually unnecessary on any kernel
|
|
# from 5.6 on: the module loads itself when the interface is created.
|
|
# - SYS_MODULE
|
|
sysctls:
|
|
- net.ipv4.ip_forward=1
|
|
- net.ipv4.conf.all.src_valid_mark=1
|
|
# Loose reverse-path filtering; strict drops replies arriving on the
|
|
# tunnel. ihasvpn would set this itself but /proc/sys is read-only in a
|
|
# container, so it has to come from here.
|
|
- net.ipv4.conf.all.rp_filter=2
|
|
- net.ipv4.conf.default.rp_filter=2
|
|
# Uncomment with IHASVPN_SUBNET6 for IPv6 inside the tunnel.
|
|
# - net.ipv6.conf.all.forwarding=1
|
|
# - net.ipv6.conf.all.disable_ipv6=0
|
|
environment:
|
|
# The public hostname or IP clients connect to. Asked for at setup too.
|
|
IHASVPN_ENDPOINT: vpn.example.com
|
|
# UDP port WireGuard listens on; must match the port mapping.
|
|
IHASVPN_PORT: "51820"
|
|
# Tunnel network. The server takes the first address.
|
|
IHASVPN_SUBNET: 10.8.0.0/24
|
|
# IHASVPN_SUBNET6: fd42:42:42::/64
|
|
# DNS handed to clients by default.
|
|
IHASVPN_DNS: 1.1.1.1, 1.0.0.1
|
|
# Admin UI. Put a TLS-terminating proxy in front of it, or enable the
|
|
# built-in self-signed certificate, before exposing it anywhere but
|
|
# localhost or your LAN.
|
|
IHASVPN_HTTP_LISTEN: ":51821"
|
|
# IHASVPN_TLS_SELF_SIGNED: "true"
|
|
# IHASVPN_TRUSTED_PROXIES: 172.16.0.0/12
|
|
# IHASVPN_METRICS_TOKEN: change-me
|
|
ports:
|
|
- "51820:51820/udp"
|
|
- "127.0.0.1:51821:51821/tcp"
|
|
volumes:
|
|
- ihasvpn-data:/data
|
|
|
|
volumes:
|
|
ihasvpn-data:
|