adding wg-easy and integrating network stack

wg-easy/compose.yml

@@ -0,0 +1,40 @@
+services:
+  wg-easy:
+    image: ghcr.io/wg-easy/wg-easy
+    container_name: wg-easy
+    restart: unless-stopped
+    volumes:
+      - ./etc_wireguard:/etc/wireguard
+    environment:
+      # Required settings
+      - WG_HOST=wg.riverrooks.dev
+      
+      # Optional settings
+      - WG_PORT=51820                 # WireGuard UDP port
+      - WG_DEFAULT_DNS=1.1.1.1
+      - WG_ALLOWED_IPS=10.8.0.0/24
+      
+    cap_add:
+      - NET_ADMIN
+      - SYS_MODULE
+    sysctls:
+      - net.ipv4.conf.all.src_valid_mark=1
+      - net.ipv4.ip_forward=1
+
+    # Ports: We map the VPN port (UDP) directly to the host.
+    # The Web UI (51821) is handled by Traefik labels instead.
+    ports:
+      - "51820:51820/udp"
+
+    networks:
+      - traefik
+
+    labels:
+        - "traefik.enable=true"
+        - "traefik.http.routers.wg-easy.rule=Host(`wg.riverrooks.dev`)"
+        - "traefik.http.routers.wg-easy.entrypoints=websecure"
+        - "traefik.http.routers.wg-easy.tls.certresolver=myresolver"
+        - "traefik.http.services.wg-easy.loadbalancer.server.port=51821"
+networks:
+  traefik:
+    external: true

wg-easy/docker-compose.yml

@@ -1,56 +0,0 @@
-volumes:
-  etc_wireguard:
-
-services:
-  wg-easy:
-    #environment:
-    #  Optional:
-    #  - PORT=51821
-    #  - HOST=0.0.0.0
-    #  - INSECURE=false
-
-    image: ghcr.io/wg-easy/wg-easy:15
-    container_name: wg-easy
-    networks:
-      wg:
-        ipv4_address: 10.42.42.42
-        ipv6_address: fdcc:ad94:bacf:61a3::2a
-    volumes:
-      - etc_wireguard:/etc/wireguard
-      - /lib/modules:/lib/modules:ro
-    ports:
-      - "51820:51820/udp"
-      - "51821:51821/tcp"
-    restart: unless-stopped
-    cap_add:
-      - NET_ADMIN
-      - SYS_MODULE
-      # - NET_RAW # ⚠️ Uncomment if using Podman
-    sysctls:
-      - net.ipv4.ip_forward=1
-      - net.ipv4.conf.all.src_valid_mark=1
-      - net.ipv6.conf.all.disable_ipv6=0
-      - net.ipv6.conf.all.forwarding=1
-      - net.ipv6.conf.default.forwarding=1
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.wg-easy.rule=Host(`wg.riverrooks.dev`)"
-      - "traefik.http.routers.wg-easy.entrypoints=websecure"
-      - "traefik.http.routers.wg-easy.service=wg-easy"
-      - "traefik.http.services.wg-easy.loadbalancer.server.port=51821"
-      - "traefik.docker.network=traefik"
-    networks:
-      traefik: {}
-
-networks:
-  wg:
-    driver: bridge
-    enable_ipv6: true
-    ipam:
-      driver: default
-      config:
-        - subnet: 10.42.42.0/24
-        - subnet: fdcc:ad94:bacf:61a3::/64
-
-  traefik:
-    external: true