digitallyrefined / docker-wireguard-tunnel Goto Github PK

Do you also have an working traefik example?

Hi,

With the changes to Fly's pricing I switched over to shared IP with a new v3 deployment with the following:

fly launch
fly ips allocate-v4 --shared -a PROJECTNAME

During the new launch phase I chose the following answers:

? Would you like to copy its configuration to the new app? Yes
? Do you want to tweak these settings before proceeding? No
? Would you like to allocate a dedicated ipv4 address now? No

Is there anything that needs to be changed in order to make it work with the new share IP setup?

My fly.toml file is:

app = "PROJECTNAME"
primary_region = "ams"

[build]
  image = "ghcr.io/digitallyrefined/docker-wireguard-tunnel:v3"

[env]
  DOMAIN = "PROJECTNAME.fly.dev"
  PEERS = "1"
  SERVICES = "peer1:traefik:80:80,peer1:traefik:443:443"

[[mounts]]
  source = "wireguard_data"
  destination = "/etc/wireguard"
  auto_extend_size_threshold = 0

[[services]]
  protocol = "udp"
  internal_port = 51820

  [[services.ports]]
    port = 51820

[[services]]
  protocol = "tcp"
  internal_port = 80

  [[services.ports]]
    port = 80

[[services]]
  protocol = "tcp"
  internal_port = 443

  [[services.ports]]
    port = 443

[[vm]]
  cpu_kind = "shared"
  cpus = 1
  memory_mb = 1024

Tried IPv6 since that is dedicated but Fly doesn't support UDP forwarding over IPv6 yet.

Quick note on the Traefik example..

You also need to create an empty /etc/traefik/certs/acme.json and chmod it to 600. Otherwise the production cert resolver fails to load.

Once I realized that, it works great.

Hi ! I have an issue with my client...

Here my config :

docker-compose.yml

---
version: "2.1"
services:
  wireguard-tunnel-peer:
    image: ghcr.io/digitallyrefined/docker-wireguard-tunnel:v3
    container_name: wireguard-tunnel-peer
    environment:
      # Note that DOMAIN & PEERS are not required for the peer
      # Services to expose format (comma-separated)
      # SERVICES=peer-id:peer-container-name:peer-container-port:expose-port-as
      - SERVICES=peer1:nginx:80:8080,peer1:nginx-demo:80:8081
    cap_add:
      - NET_ADMIN
    volumes:
      - /home/tom/wireguard:/etc/wireguard
    restart: unless-stopped
    links:
      - nginx:nginx
      - nginx-demo:nginx-demo

  nginx:
    image: nginx
    restart: unless-stopped

  nginx-demo:
    image: nginxdemos/hello
    restart: unless-stopped

wg0.conf

[Interface]
PrivateKey = [KEYYYYYY]
Address = 10.0.0.1/32
MTU = 1280
SaveConfig = false

[Peer]
PublicKey = [KEYYYYYY]
Endpoint = wireguard.DOMAIN.com:51820
AllowedIPs = 10.0.0.254/32
PersistentKeepalive = 25

and my logs :

Starting Internet redirection server
Starting Wireguard
Warning: `/etc/wireguard/wg0.conf' is world accessible
[#] ip link add wg0 type wireguard
Error: Unknown device type.
Unable to access interface: Protocol not supported
[#] ip link delete dev wg0
Cannot find device "wg0"

Can you help me please :3

Not necessarly an issue, just some of my thoughts on what would make Docker WireGuard Tunnel more ideal for my use personally, possible others.

I first started using Cloudflare Tunnel to punch a hole in my network, I really like the simplicity of Cloudflare Tunnel, as it's able to resolve peer hostnames without having to configure anything on either side, however I was yearning for a self hosted option as I wanted to traffic more than just HTTP.

I started with rathole, it's lightweight and forwards both TCP and UDP, however there's two things that don't make it a perfect fit for my use case, firstly it proxies UDP over TCP, which is less than ideal, secondly it doesn't resolve peer sided hostnames without a configuration file on both sides.

Docker WireGuard Tunnel has the potential to be my perfect solution, due to having the primary focus of linking Docker containers, however it has one of the same issues that rathole has, it doesn't resolve peer hostnames without configuring an environment variable on both the peer and server.

It leaves me wondering, I know Cloudflare Tunnel uses WireGuard under the hood, however does it do anything special with DNS to achieve peer sided hostname resolution via the server.

Would it be possible to add a single peer mode option to Docker WireGuard Tunnel, which would make it operate similarly to Cloudflare Tunnel, where the server is able to resolve peer sided hostnames without manually specify those hostnames server side?

Networking is far from my specialty, I have done some searching on the topic, and from what I gathered, it's possible to have a WireGuard peer resolve hostnames located on the server's network (https://www.reddit.com/r/WireGuard/comments/i8bkfr/comment/g1cz2dl), however is it possible the other way around, and if so, would that all play nice with Docker so that the server can resolve hostnames on the peer without the need for manual host to port configuration and rinetd (probably routing with iptabels instead)?