Wireguard+DockerでVPNサーバーを構築する

1
version: "3.9"
2

3
services:
4
  wireguard:
5
    image: linuxserver/wireguard:v1.0.20210914-ls6
6
    container_name: wireguard
7
    cap_add:
8
      - NET_ADMIN
9
    volumes:
10
      - ./config:/config
11
    restart:
12
      unless-stopped
13
    ports:
14
      # port for wireguard-ui. this must be set here as the `wireguard-ui` container joins the network of this container and hasn't its own network over which it could publish the ports
15
      - 5000:5000
16
      # port of the wireguard server
17
      - 51820:51820/udp
18
    environment:
19
      - PUID=1000
20
      - PGID=1000
21
      - PEERS=3
22
      - SERVERURL=$SERVERURL
23
      - SERVERPORT=$SERVERPORT
24
      - INTERNAL_SUBNET=$INTERNAL_SUBNET
25
      - ALLOWEDIPS=$ALLOWEDIPS
26
    healthcheck:
27
      test: ["CMD", "/config/healthcheck.sh"]
28
      interval: 5s
29
      timeout: 10s
30
      retries: 3
31

32
  wireguard-ui:
33
    image: ngoduykhanh/wireguard-ui:latest
34
    container_name: wireguard-ui
35
    depends_on:
36
      wireguard:
37
        condition: service_healthy
38
    cap_add:
39
      - NET_ADMIN
40
    # use the network of the 'wireguard' service. this enables to show active clients in the status page
41
    network_mode: service:wireguard
42
    environment:
43
      - SENDGRID_API_KEY
44
      - EMAIL_FROM_ADDRESS
45
      - EMAIL_FROM_NAME
46
      - SESSION_SECRET
47
      - WGUI_USERNAME=admin
48
      - WGUI_PASSWORD=$WGUI_PASSWORD
49
      - WG_CONF_TEMPLATE
50
      - WGUI_MANAGE_START=true
51
      - WGUI_MANAGE_RESTART=true
52
      - WGUI_SERVER_POST_UP_SCRIPT=iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
53
      - WGUI_SERVER_POST_DOWN_SCRIPT=iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
54
    logging:
55
      driver: json-file
56
      options:
57
        max-size: 50m
58
    volumes:
59
      - ./db:/app/db
60
      - ./config:/etc/wireguard
61

62
  cloudflare_tunnel:
63
    restart: always
64
    image: cloudflare/cloudflared
65
    command: tunnel run
66
    container_name: cloudflared_wireguard
67
    environment:
68
      TUNNEL_TOKEN: $TUNNEL_TOKEN
69
    depends_on:
70
      - wireguard-ui

1
#!/bin/bash
2

3
# Check if the WireGuard interface is up
4
if ip link show wg0 &> /dev/null ; then
5
    exit 0 # The interface is up, so the container is healthy
6
else
7
    exit 1 # The interface is down, so the container is unhealthy
8
fi