adding wg-easy and integrating network stack

.gitignore

@@ -1,2 +1,3 @@
 gitea/data/*
 letsencrypt/acme.json
+etc_wireguard/*

compose.yml

@@ -2,7 +2,7 @@
 # Primary compose file, used to manage the traefik and other network related modules
 # Other compose files to be run named and used my service
 services:
-  traefik:
+  traefik: # This is the proxy for all other services. Using labels it dynamically secures reverse proxies to other containters
     image: traefik:v3.6
     container_name: traefik
     restart: unless-stopped
@@ -12,9 +12,50 @@ services:
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock"
       - "./letsencrypt:/letsencrypt"
-      - "./traefik.yml:/etc/traefik/traefik.yml:ro"
+      - "./traefik.yml:/etc/traefik/traefik.yml:ro" # sets the traefik.yml file as the options file for configuring proxy settings
     networks:
       - traefik
+  wg-easy:
+    image: ghcr.io/wg-easy/wg-easy
+    container_name: wg-easy
+    restart: unless-stopped
+    volumes:
+      - ./etc_wireguard:/etc/wireguard
+    environment:
+      # Required settings
+      - WG_HOST=wg.riverrooks.dev
+      
+      # Optional settings
+      - WG_PORT=51820                 # WireGuard UDP port
+      - WG_DEFAULT_DNS=1.1.1.1
+      - WG_ALLOWED_IPS=10.8.0.0/24
+      
+    cap_add:
+      - NET_ADMIN
+      - SYS_MODULE
+    sysctls:
+      - net.ipv4.conf.all.src_valid_mark=1
+      - net.ipv4.ip_forward=1
+
+    # Ports: We map the VPN port (UDP) directly to the host.
+    # The Web UI (51821) is handled by Traefik labels instead.
+    ports:
+      - "51820:51820/udp"
+
+    networks:
+      - traefik
+
+    labels:
+        # since by default containers are disabled, we need to enable them
+        - "traefik.enable=true"
+        # Set a rule for which hostnames will connect
+        - "traefik.http.routers.wg-easy.rule=Host(`wg.riverrooks.dev`)"
+        # declare an antrypoint. Websecure is defined in the traefik.yml file
+        - "traefik.http.routers.wg-easy.entrypoints=websecure"
+        # declare the certificate resolver. Also defined in traefik.yml file
+        - "traefik.http.routers.wg-easy.tls.certresolver=basic-letsencrypt"
+        # set the port which will be proxied to the address
+        - "traefik.http.services.wg-easy.loadbalancer.server.port=51821"
 
 networks:
   traefik:

traefik.yml

@@ -7,6 +7,8 @@ api:
 
 providers:
   docker:
+    watch: true
+    network: traefik
     # Do not expose every container automatically
     exposedByDefault: false
 

wg-easy/compose.yml

@@ -0,0 +1,40 @@
+services:
+  wg-easy:
+    image: ghcr.io/wg-easy/wg-easy
+    container_name: wg-easy
+    restart: unless-stopped
+    volumes:
+      - ./etc_wireguard:/etc/wireguard
+    environment:
+      # Required settings
+      - WG_HOST=wg.riverrooks.dev
+      
+      # Optional settings
+      - WG_PORT=51820                 # WireGuard UDP port
+      - WG_DEFAULT_DNS=1.1.1.1
+      - WG_ALLOWED_IPS=10.8.0.0/24
+      
+    cap_add:
+      - NET_ADMIN
+      - SYS_MODULE
+    sysctls:
+      - net.ipv4.conf.all.src_valid_mark=1
+      - net.ipv4.ip_forward=1
+
+    # Ports: We map the VPN port (UDP) directly to the host.
+    # The Web UI (51821) is handled by Traefik labels instead.
+    ports:
+      - "51820:51820/udp"
+
+    networks:
+      - traefik
+
+    labels:
+        - "traefik.enable=true"
+        - "traefik.http.routers.wg-easy.rule=Host(`wg.riverrooks.dev`)"
+        - "traefik.http.routers.wg-easy.entrypoints=websecure"
+        - "traefik.http.routers.wg-easy.tls.certresolver=myresolver"
+        - "traefik.http.services.wg-easy.loadbalancer.server.port=51821"
+networks:
+  traefik:
+    external: true

wg-easy/docker-compose.yml

@@ -1,56 +0,0 @@
-volumes:
-  etc_wireguard:
-
-services:
-  wg-easy:
-    #environment:
-    #  Optional:
-    #  - PORT=51821
-    #  - HOST=0.0.0.0
-    #  - INSECURE=false
-
-    image: ghcr.io/wg-easy/wg-easy:15
-    container_name: wg-easy
-    networks:
-      wg:
-        ipv4_address: 10.42.42.42
-        ipv6_address: fdcc:ad94:bacf:61a3::2a
-    volumes:
-      - etc_wireguard:/etc/wireguard
-      - /lib/modules:/lib/modules:ro
-    ports:
-      - "51820:51820/udp"
-      - "51821:51821/tcp"
-    restart: unless-stopped
-    cap_add:
-      - NET_ADMIN
-      - SYS_MODULE
-      # - NET_RAW # ⚠️ Uncomment if using Podman
-    sysctls:
-      - net.ipv4.ip_forward=1
-      - net.ipv4.conf.all.src_valid_mark=1
-      - net.ipv6.conf.all.disable_ipv6=0
-      - net.ipv6.conf.all.forwarding=1
-      - net.ipv6.conf.default.forwarding=1
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.wg-easy.rule=Host(`wg.riverrooks.dev`)"
-      - "traefik.http.routers.wg-easy.entrypoints=websecure"
-      - "traefik.http.routers.wg-easy.service=wg-easy"
-      - "traefik.http.services.wg-easy.loadbalancer.server.port=51821"
-      - "traefik.docker.network=traefik"
-    networks:
-      traefik: {}
-
-networks:
-  wg:
-    driver: bridge
-    enable_ipv6: true
-    ipam:
-      driver: default
-      config:
-        - subnet: 10.42.42.0/24
-        - subnet: fdcc:ad94:bacf:61a3::/64
-
-  traefik:
-    external: true

whoami.yml

@@ -5,13 +5,13 @@ services:
       restart: unless-stopped
       labels:
         - "traefik.enable=true"
-        - "traefik.http.routers.whoami.rule=Host(`whoami.riverrooks.dev`) || Host(`whoami.riverrooks.art`)"
+        - "traefik.http.routers.whoami.rule=Host(`whoami.riverrooks.dev`) || Host(`whoami.riverrooks.art`) || Host(`10.8.0.1`)"
         - "traefik.http.routers.whoami.entrypoints=websecure"
-        - "traefik.http.routers.whoami.tls.certresolver=myresolver"
+        - "traefik.http.routers.whoami.tls.certresolver=basic-letsencrypt"
       networks:
-        - proxy
+        - traefik
 
 networks:
-  proxy:
+  traefik:
     external: true