services:
  wg-easy:
    image: ghcr.io/wg-easy/wg-easy:15
    cap_add:
      - NET_ADMIN
      - SYS_MODULE # lets the container modprobe wireguard if the host kernel doesn't already have it loaded
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv6.conf.all.disable_ipv6=0
      - net.ipv6.conf.all.forwarding=1
      - net.ipv6.conf.default.forwarding=1
    ports:
      - 51820:51820/udp # WireGuard tunnel - the web UI (51821) only needs to be reachable via Traefik below, not published directly
    networks:
      - proxy
    volumes:
      - /lib/modules:/lib/modules:ro
      - wg_easy_data:/etc/wireguard
    labels:
      ## Expose the wg-easy web UI through Traefik ##
      - "traefik.enable=true"

      # Stopped for the duration of each backup run - see backup-docker-compose.yml.
      - "docker-volume-backup.stop-during-backup=true"

      - "traefik.http.middlewares.redirect-web-secure.redirectscheme.scheme=https"
      - "traefik.http.routers.vpn-insecure.middlewares=redirect-web-secure"
      - "traefik.http.routers.vpn-insecure.rule=Host(`vpn.luke-else.co.uk`)"
      - "traefik.http.routers.vpn-insecure.entrypoints=web"

      - "traefik.http.routers.vpn.rule=Host(`vpn.luke-else.co.uk`)"
      - "traefik.http.routers.vpn.entrypoints=websecure"
      - "traefik.http.routers.vpn.tls.certresolver=myresolver"
      - "traefik.http.services.vpn.loadbalancer.server.port=51821"
    restart: unless-stopped

networks:
  proxy:
    external: true

volumes:
  wg_easy_data:
    name: wg_easy_data