version: "3"

services:
  vpn-gluetun:
    image: qmcgaw/gluetun:latest
    container_name: vpn-gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    volumes:
      - ./glutun:/gluetun
    environment:
      - VPN_SERVICE_PROVIDER=nordvpn
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=REDACTED
      - WIREGUARD_ADDRESSES=10.5.0.2/32
      - TZ=Europe/London
      - FIREWALL=on
      - LOCAL_NETWORK=172.23.0.0/16
      - FIREWALL_OUTBOUND_SUBNETS=172.23.0.0/16
      - SERVER_COUNTRIES=Netherlands
    restart: always
    networks:
      - tailscale-net

  tailscale:
    image: tailscale/tailscale:stable
    container_name: tailscale
    privileged: true
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv6.conf.all.forwarding=1
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    devices:
      - /dev/net/tun:/dev/net/tun
    environment:
      - TS_AUTHKEY=REDACTED
      - TS_EXTRA_ARGS=--hostname=DockerTailscale --accept-routes --advertise-exit-node --advertise-routes=192.168.1.0/24,10.0.0.0/8
    volumes:
      - ./tailscale/state:/var/lib/tailscale
    depends_on:
      - vpn-gluetun
    network_mode: "service:vpn-gluetun" # Use vpn-gluetun's network

networks:
  tailscale-net:
    name: tailscale-net
    driver: bridge
    ipam:
      config:
        - subnet: 172.23.0.0/16