# Primary compose file, used to manage the traefik and other network related modules
# Other compose files to be run named and used my service
services:
  traefik: # This is the proxy for all other services. Using labels it dynamically secures reverse proxies to other containters
    image: traefik:v3.6
    container_name: traefik
    restart: unless-stopped
    dns:
      - 1.1.1.1
      - 8.8.8.8
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock" # running as root TODO need to make new user
      - "./letsencrypt:/letsencrypt"
      - "./traefik.yml:/etc/traefik/traefik.yml:ro" # sets the traefik.yml file as the options file for configuring proxy settings
    environment:
      - DESEC_TOKEN=RnKb69i8npX4HyvLr25NnQ1p25Kr
      - LEGO_DISABLE_CNAME_SUPPORT=true
    networks:
      traefik:
        ipv4_address: 172.21.0.10
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`traefik.riverrooks.dev`)"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.tls=true"
      - "traefik.http.routers.dashboard.tls.certresolver=basic"
      #  enable auth MIDDLEWARE
      - "traefik.http.routers.dashboard.middlewares=auth"
      #  define auth type and traffic
      - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$cnS8Mv7V$$djacpseKy6M4.XbgG4kgb1"

  wg-easy:
    image: ghcr.io/wg-easy/wg-easy
    container_name: wg-easy
    restart: unless-stopped
    volumes:
      - ./etc_wireguard:/etc/wireguard
    environment:
      - WG_HOST=wg.riverrooks.dev
      # - PASSWORD_HASH=$2a$12$PzmNEYtQws9ylYYtr1yojuGJvWUOzmJTxzVSO0svSb9NvOeg1BUcC
      - WG_PORT=51820                 # WireGuard UDP port
      - WG_DEFAULT_DNS=10.8.0.1
      - WG_ALLOWED_IPS=10.8.0.0/24,172.21.0.10
      
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv4.ip_forward=1

    # Ports: We map the VPN port (UDP) directly to the host.
    # The Web UI (51821) is handled by Traefik labels instead.
    ports:
      - "51820:51820/udp"
    networks:
      traefik: {}

    labels:
        - "traefik.enable=true"
        - "traefik.http.services.wg-easy-svc.loadbalancer.server.port=51821"

        # Configuration for public access with auth middleware
        - "traefik.http.routers.wg-easy.rule=Host(`wg.riverrooks.dev`)"
        - "traefik.http.routers.wg-easy.entrypoints=websecure"
        - "traefik.http.routers.wg-easy.tls.certresolver=basic"
        - "traefik.http.routers.wg-easy.middlewares=auth"
        - "traefik.http.routers.wg-easy.service=wg-easy-svc"

        # configured for private access with no auth
        - "traefik.http.routers.wg-easy-private.rule=Host(`wg.dfnk`)"
        - "traefik.http.routers.wg-easy-private.entrypoints=websecure"
        # No certresolver here, will mess with browsers
        - "traefik.http.routers.wg-easy-private.tls=true"
        - "traefik.http.routers.wg-easy-private.service=wg-easy-svc"

  dns:
    image: dockurr/dnsmasq
    container_name: defenk-dns
    volumes:
    - ./dnsmasq.conf:/etc/dnsmasq.conf
    restart: always
    network_mode: "service:wg-easy"
    depends_on:
      - wg-easy

networks:
  # Backend network for docker containers to talk to eachother
  traefik:
    name: traefik
    driver: bridge
    external: true
    ipam:
      config:
        - subnet: 172.21.0.0/24
  # VPN network for external devices to connect to the server
  frontend:
    driver: bridge