WireGuard

• environment vars configured in portainer
• secrets held in 1Password

Compose

---
networks:
  default:
    external: true
    name: proxynet

services:
  wg-easy:
    container_name: wg-easy
    image: ghcr.io/wg-easy/wg-easy
    restart: unless-stopped
    volumes:
      - /mnt/store/containers/wg-easy:/etc/wireguard
    ports:
      - 51820:51820/udp
      - 51821:51821/tcp
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      net.ipv4.conf.all.src_valid_mark: 1
      net.ipv4.ip_forward: 1
    environment:
      LANG: en
      WG_HOST: ${WG_EASY_SERVER_IP}
      PASSWORD_HASH: ${WG_EASY_PASSWORD_HASH}
      PORT: 51821
      WG_PORT: 51820
      WG_ALLOWED_IPS: 10.0.0.0/8
      WG_DEFAULT_DNS: 10.100.0.1