feat: Changed openvpn for wireguard

services/vpn/vpn-docker-compose.yml

@@ -1,19 +1,25 @@
 services:
-  dockovpn:
-    image: alekslitvinenk/openvpn
+  wg-easy:
+    image: ghcr.io/wg-easy/wg-easy:15
     cap_add:
       - NET_ADMIN
+      - SYS_MODULE # lets the container modprobe wireguard if the host kernel doesn't already have it loaded
+    sysctls:
+      - net.ipv4.ip_forward=1
+      - net.ipv4.conf.all.src_valid_mark=1
+      - net.ipv6.conf.all.disable_ipv6=0
+      - net.ipv6.conf.all.forwarding=1
+      - net.ipv6.conf.default.forwarding=1
     ports:
-      - 1194:1194/udp # Expose tcp if you defined HOST_TUN_PROTOCOL=tcp
+      - 51820:51820/udp # WireGuard tunnel - the web UI (51821) only needs to be reachable via Traefik below, not published directly
     networks:
       - proxy
-    environment:
-      HOST_ADDR: vpn.luke-else.co.uk # Your VPN server address 
     volumes:
-      - openvpn_data:/opt/Dockovpn_data
+      - /lib/modules:/lib/modules:ro
+      - wg_easy_data:/etc/wireguard
     labels:
-      ## Expose vpn Through Trefik ##
-      - "traefik.enable=true" # <== Enable traefik to proxy this container
+      ## Expose the wg-easy web UI through Traefik ##
+      - "traefik.enable=true"
 
       # Stopped for the duration of each backup run - see backup-docker-compose.yml.
       - "docker-volume-backup.stop-during-backup=true"
@@ -26,12 +32,13 @@ services:
       - "traefik.http.routers.vpn.rule=Host(`vpn.luke-else.co.uk`)"
       - "traefik.http.routers.vpn.entrypoints=websecure"
       - "traefik.http.routers.vpn.tls.certresolver=myresolver"
-    restart: always
+      - "traefik.http.services.vpn.loadbalancer.server.port=51821"
+    restart: unless-stopped
 
 networks:
   proxy:
     external: true
 
 volumes:
-  openvpn_data:
-    name: openvpn_data
+  wg_easy_data:
+    name: wg_easy_data