# Primary compose file, used to manage the traefik and other network related modules
# Other compose files to be run named and used my service
services:
  traefik: # This is the proxy for all other services. Using labels it dynamically secures reverse proxies to other containters
    image: traefik:v3.6
    container_name: traefik
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock" # running as root TODO need to make new user
      - "./letsencrypt:/letsencrypt"
      - "./traefik.yml:/etc/traefik/traefik.yml:ro" # sets the traefik.yml file as the options file for configuring proxy settings
    networks:
      traefik:
        ipv4_address: 172.21.0.10
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`traefik.riverrooks.dev`)"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.tls=true"
      - "traefik.http.routers.dashboard.tls.certresolver=basic"
      #  enable auth MIDDLEWARE
      - "traefik.http.routers.dashboard.middlewares=auth"
      #  define auth type and traffic
      - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$cnS8Mv7V$$djacpseKy6M4.XbgG4kgb1"

  wg-easy:
    image: ghcr.io/wg-easy/wg-easy
    container_name: wg-easy
    restart: unless-stopped
    volumes:
      - ./etc_wireguard:/etc/wireguard
    environment:
      - WG_HOST=wg.riverrooks.dev
      - PASSWORD_HASH=$2a$12$PzmNEYtQws9ylYYtr1yojuGJvWUOzmJTxzVSO0svSb9NvOeg1BUcC
      - WG_PORT=51820                 # WireGuard UDP port
      - WG_DEFAULT_DNS=1.1.1.1
      - WG_ALLOWED_IPS=10.8.0.0/24, 172.16.0.0/12
      
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv4.ip_forward=1

    # Ports: We map the VPN port (UDP) directly to the host.
    # The Web UI (51821) is handled by Traefik labels instead.
    ports:
      - "51820:51820/udp"
    networks:
      backend: {}
      frontend: {}

    labels:
        # since by default containers are disabled, we need to enable them
        - "traefik.enable=true"
        # Set a rule for which hostnames will connect
        - "traefik.http.routers.wg-easy.rule=Host(`wg.riverrooks.dev`)"
        # declare an antrypoint. Websecure is defined in the traefik.yml file
        - "traefik.http.routers.wg-easy.entrypoints=websecure"
        # declare the certificate resolver. Also defined in traefik.yml file
        - "traefik.http.routers.wg-easy.tls.certresolver=basic"
        # set the port which will be proxied to the address
        - "traefik.http.services.wg-easy.loadbalancer.server.port=51821"
  dns:
    image: dockurr/dnsmasq
    container_name: defenk-dns
    volumes:
    - ./dnsmasq.conf:/etc/dnsmasq.conf
    restart: always

networks:
  # Backend network for docker containers to talk to eachother
  backend:
    name: traefik
    external: true
  # VPN network for external devices to connect to the server
  frontend:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/24