networking for private vpn access working with wg-easy. Cleaned up clutter

compose.yml

@@ -41,10 +41,10 @@ services:
       - ./etc_wireguard:/etc/wireguard
     environment:
       - WG_HOST=wg.riverrooks.dev
-      - PASSWORD_HASH=$2a$12$PzmNEYtQws9ylYYtr1yojuGJvWUOzmJTxzVSO0svSb9NvOeg1BUcC
+      # - PASSWORD_HASH=$2a$12$PzmNEYtQws9ylYYtr1yojuGJvWUOzmJTxzVSO0svSb9NvOeg1BUcC
       - WG_PORT=51820                 # WireGuard UDP port
-      - WG_DEFAULT_DNS=1.1.1.1
-      - WG_ALLOWED_IPS=10.8.0.0/24, 172.16.0.0/12
+      - WG_DEFAULT_DNS=10.8.0.1
+      - WG_ALLOWED_IPS=10.8.0.0/24,172.21.0.10
       
     cap_add:
       - NET_ADMIN
@@ -59,34 +59,41 @@ services:
       - "51820:51820/udp"
     networks:
       traefik: {}
-      frontend: {}
 
     labels:
-        # since by default containers are disabled, we need to enable them
         - "traefik.enable=true"
-        # Set a rule for which hostnames will connect
+        - "traefik.http.services.wg-easy-svc.loadbalancer.server.port=51821"
+
         - "traefik.http.routers.wg-easy.rule=Host(`wg.riverrooks.dev`)"
-        # declare an antrypoint. Websecure is defined in the traefik.yml file
         - "traefik.http.routers.wg-easy.entrypoints=websecure"
-        # declare the certificate resolver. Also defined in traefik.yml file
         - "traefik.http.routers.wg-easy.tls.certresolver=basic"
-        # set the port which will be proxied to the address
-        - "traefik.http.services.wg-easy.loadbalancer.server.port=51821"
+        - "traefik.http.routers.wg-easy.middlewares=auth"
+        - "traefik.http.routers.wg-easy.service=wg-easy-svc"
+
+        - "traefik.http.routers.wg-easy-private.rule=Host(`wg.dfnk`)"
+        - "traefik.http.routers.wg-easy-private.entrypoints=websecure"
+        - "traefik.http.routers.wg-easy-private.tls=true"
+        - "traefik.http.routers.wg-easy-private.service=wg-easy-svc"
+
   dns:
     image: dockurr/dnsmasq
     container_name: defenk-dns
     volumes:
     - ./dnsmasq.conf:/etc/dnsmasq.conf
     restart: always
+    network_mode: "service:wg-easy"
+    depends_on:
+      - wg-easy
 
 networks:
   # Backend network for docker containers to talk to eachother
   traefik:
     name: traefik
+    driver: bridge
     external: true
+    ipam:
+      config:
+        - subnet: 172.21.0.0/24
   # VPN network for external devices to connect to the server
   frontend:
     driver: bridge
-    ipam:
-      config:
-        - subnet: 172.20.0.0/24

dnsmasq.conf

@@ -3,7 +3,7 @@ server=1.1.1.1
 server=8.8.8.8
 
 # Set custom addresses inside the container
-address=/watch.dfnk/10.8.0.3
-adrress=/sol.dfnk/10.8.0.1
-address=/who.dfnk/10.h.0.1
-address=/wg.dfnk/10.8.0.1
+address=/sol.dfnk/172.21.0.10
+address=/who.dfnk/172.21.0.10
+address=/wg.dfnk/172.21.0.10
+address=/traefik.dfnk/172.21.0.10

gitea/docker-compose.yml

@@ -1,33 +0,0 @@
-networks:
-
-  gitea:
-    external: false
-  traefik:
-    external: true
-
-services:
-  server:
-    image: docker.gitea.com/gitea:1.24.7
-    container_name: gitea
-    environment:
-      - USER_UID=1010
-      - USER_GID=1010
-    restart: always
-    networks:
-      - gitea
-      - traefik
-    volumes:
-      - ./data/:/data
-      - /etc/timezone:/etc/timezone:ro
-      - /etc/localtime:/etc/localtime:ro
-    ports:
-      - "22:22"
-    labels:
-        - "traefik.enable=true"
-        - "traefik.http.routers.gitea.rule=Host(`git.riverrooks.dev`)"
-        - "traefik.http.routers.gitea.entrypoints=websecure"
-        - "traefik.http.routers.gitea.tls.certresolver=desecresolver"
-        # Explicitly tell Traefik to send the web traffic to internal port 3000
-        - "traefik.http.services.gitea.loadbalancer.server.port=3000"
-        # Tell Traefik to exclusively use the 'proxy' network to route traffic
-        - "traefik.docker.network=traefik"

matrix/compose.yml

@@ -1,77 +0,0 @@
-services:
-  synapse-db:
-    image: postgres:16-alpine
-    container_name: synapse-db
-    restart: unless-stopped
-    environment:
-      POSTGRES_USER: synapse_user
-      POSTGRES_PASSWORD: ${SYNAPSE_DB_PASSWORD}
-      POSTGRES_DB: synapse-db
-      POSTGRES_INITDB_ARGS: "--locale=C --encoding=UTF8"
-    volumes:
-      - ./postgres_data:/var/lib/postgresql/data
-    networks:
-      - matrix-net
-
-  synapse:
-    image: matrixdotorg/synapse:latest
-    container_name: matrix-synapse
-    restart: unless-stopped
-    depends_on:
-      - synapse-db
-    volumes:
-      - ./synapse_data:/data
-      - ./data:/raw-data
-    environment:
-      - SYNAPSE_CONFIG_PATH=/data/homeserver.yaml
-    # Expose internally or to a reverse proxy. 
-    # If using Traefik, omit ports and use labels instead.
-    labels:
-      - "traefik.enable=true"
-
-      - "traefik.http.routers.matrix.entrypoints=websecure"
-      - "traefik.http.routers.matrix.rule=Host(`matrix.riverrooks.dev`)"
-
-      - "traefik.http.routers.matrix.service=matrix-service"
-      - "traefik.http.services.matrix-service.loadbalancer.server.port=8008"
-
-      - "traefik.http.routers.matrix.tls=true"
-      - "traefik.http.routers.matrix.tls.certresolver=basic"
-
-    networks:
-      - matrix-net
-      - traefik
-  matrix-delegation:
-    image: nginx:alpine
-    container_name: matrix-delegation
-    restart: unless-stopped
-    # 1. Using "|" keeps literal newlines so the script executes perfectly
-    command: >
-      /bin/sh -c "mkdir -p /usr/share/nginx/html/.well-known/matrix && echo '{\"m.server\": \"matrix.riverrooks.dev:443\"}' > /usr/share/nginx/html/.well-known/matrix/server && nginx -g 'daemon off;'"
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.matrix-delegation.rule=Host(`riverrooks.dev`) && PathPrefix(`/.well-known/matrix/server`)"
-      - "traefik.http.routers.matrix-delegation.entrypoints=websecure"
-      - "traefik.http.routers.matrix-delegation.tls.certresolver=desecresolver"
-    # 2. Added the traefik network so Traefik can actually reach this container
-    networks:
-      - matrix-net
-      - traefik
-  mautrix-gmessages:
-    image: dock.mau.fi/mautrix/gmessages:latest
-    container_name: mautrix-gmessages
-    restart: unless-stopped
-    volumes:
-      - ./data:/data
-    networks:
-      - matrix-net
-    depends_on:
-      - synapse-db
-      - synapse
-
-
-networks:
-  matrix-net:
-    driver: bridge
-  traefik:
-    external: true

traefik.yml

@@ -11,6 +11,9 @@ providers:
     network: traefik
     # Do not expose every container automatically
     exposedByDefault: false
+  file:
+    filename: /etc/traefik/traefik.yml
+    watch: true
 
 entryPoints:
   web:
@@ -28,6 +31,8 @@ entryPoints:
         allowEncodedSlash: true
         allowEncodedHash: true  # This is crucial for Matrix room aliases!
 
+        # Declaring the user list
+
 certificatesResolvers:
   basic:
     acme: