jcoffey-dev
02e7993c87
WGX shares its name with several other WireGuard tools, so the project becomes ihasvpn, alongside ihasmail. - Module github.com/Coffey-Labs/ihasvpn, command cmd/ihasvpn, image ghcr.io/coffey-labs/ihasvpn. - Environment variables move from WGX_* to IHASVPN_*. The default database is ihasvpn.db, the nftables table is `ihasvpn`, metrics are ihasvpn_*, and the session cookie and theme key are renamed, so existing sessions end. - The mark is the ihasmail cat peeking over the edge of a shield, drawn as a vector. docs/brand/generate.py builds the mark, mono mark, wordmarks, social card, favicons and app icons from that one drawing. - The console takes ihasmail's palette: the ihasmail.org teal-navy for dark, its contrast-checked light tiers with the site's light accent, received traffic in the cat's orange and sent in teal. The wordmark weight and font stack follow ihasmail.org. - Detail values wrap at spaces before breaking inside an address, so an IPv6 tunnel address no longer splits mid-number. - The README history note about the earlier WGX installer is gone with the name it explained. Screenshots retaken.
56 lines
2.2 KiB
YAML
56 lines
2.2 KiB
YAML
# ihasvpn: a WireGuard server with a web admin UI, in one container.
|
|
#
|
|
# Start it, open http://<host>:51821, create the first administrator, add a
|
|
# peer, scan the QR code. The container needs NET_ADMIN to create the tunnel
|
|
# interface and its NAT rules, and the sysctls below to forward packets.
|
|
#
|
|
# For the highest throughput see docs/performance.md: it explains when to use
|
|
# docker-compose.host.yml (host networking) and which host sysctls matter.
|
|
services:
|
|
ihasvpn:
|
|
image: ghcr.io/coffey-labs/ihasvpn:latest
|
|
container_name: ihasvpn
|
|
restart: unless-stopped
|
|
cap_add:
|
|
- NET_ADMIN
|
|
# Only needed if the host has not loaded the wireguard module yet and
|
|
# you want the container to load it. Usually unnecessary on any kernel
|
|
# from 5.6 on: the module loads itself when the interface is created.
|
|
# - SYS_MODULE
|
|
sysctls:
|
|
- net.ipv4.ip_forward=1
|
|
- net.ipv4.conf.all.src_valid_mark=1
|
|
# Loose reverse-path filtering; strict drops replies arriving on the
|
|
# tunnel. ihasvpn would set this itself but /proc/sys is read-only in a
|
|
# container, so it has to come from here.
|
|
- net.ipv4.conf.all.rp_filter=2
|
|
- net.ipv4.conf.default.rp_filter=2
|
|
# Uncomment with IHASVPN_SUBNET6 for IPv6 inside the tunnel.
|
|
# - net.ipv6.conf.all.forwarding=1
|
|
# - net.ipv6.conf.all.disable_ipv6=0
|
|
environment:
|
|
# The public hostname or IP clients connect to. Asked for at setup too.
|
|
IHASVPN_ENDPOINT: vpn.example.com
|
|
# UDP port WireGuard listens on; must match the port mapping.
|
|
IHASVPN_PORT: "51820"
|
|
# Tunnel network. The server takes the first address.
|
|
IHASVPN_SUBNET: 10.8.0.0/24
|
|
# IHASVPN_SUBNET6: fd42:42:42::/64
|
|
# DNS handed to clients by default.
|
|
IHASVPN_DNS: 1.1.1.1, 1.0.0.1
|
|
# Admin UI. Put a TLS-terminating proxy in front of it, or enable the
|
|
# built-in self-signed certificate, before exposing it anywhere but
|
|
# localhost or your LAN.
|
|
IHASVPN_HTTP_LISTEN: ":51821"
|
|
# IHASVPN_TLS_SELF_SIGNED: "true"
|
|
# IHASVPN_TRUSTED_PROXIES: 172.16.0.0/12
|
|
# IHASVPN_METRICS_TOKEN: change-me
|
|
ports:
|
|
- "51820:51820/udp"
|
|
- "127.0.0.1:51821:51821/tcp"
|
|
volumes:
|
|
- ihasvpn-data:/data
|
|
|
|
volumes:
|
|
ihasvpn-data:
|