services:
  wireguard:
    image: "quay.io/linuxserver.io/wireguard:latest"
    container_name: "wireguard"
    cap_add:
      - "NET_ADMIN"
    environment:
      - "PUID=0"
      - "PGID=0"
      - "PEERS=1"
      - "TZ=Etc/Berlin"
      - "SERVERURL=my_url.example"
      - "SERVERPORT=51820"
      - "INTERNAL_SUBNET=10.13.13.0/24"
      - "ALLOWEDIPS=0.0.0.0/0"
      - "LOG_CONFS=true"
    volumes:
      - "wireguard:/config"
    networks:
      wireguard:
        ipv4_address: "10.13.13.1"
    ports:
      - "51820:51820/udp"
    sysctls:
      - "net.ipv4.conf.all.src_valid_mark=1"
    restart: "unless-stopped"
    labels:
      - "traefik.enable=false"


  wireguard-ui:
    image: "docker.io/ngoduykhanh/wireguard-ui:latest"
    container_name: "wireguard-ui"
    depends_on:
      - "wireguard"
    cap_add:
      - "NET_ADMIN"
    environment:
      - "EMAIL_FROM_ADDRESS=my_url.example"
      - "SESSION_SECRET_file=/run/secrets/wireguard-ui-session"
      - "BIND_ADDRESS=0.0.0.0:80"
      - "WGUI_USERNAME=admin"
      - "WGUI_PASSWORD_FILE=/run/secrets/wireguard-ui"
      - "WGUI_MANAGE_START=true"
      - "WGUI_MANAGE_RESTART=true"
      - "WGUI_ENPOINT_ADDRESS=my_url.example
      - "WGUI_DNS=9.9.9.9"
    restart: "unless-stopped"
    networks:
      - "traefik"
      - "wireguard"
    volumes:
      - "wgui:/app/db"
      - "wireguard:/etc/wireguard"
    secrets:
      - "wireguard-ui"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.wgui.entryPoints=web-secure"
      - "traefik.http.routers.wgui.rule=Host(`my_url.example)"
      - "traefik.http.routers.wgui.tls=true"
      - "traefik.http.routers.wgui.tls.certresolver=letsencrypt"
      - "traefik.http.services.wgui.loadbalancer.server.port=80"

networks:
  wireguard:
    name: "wireguard"
    ipam:
      config:
        - subnet: "10.13.13.0/24"
  traefik:
    external: true

volumes:
  wireguard:
    name: "wireguard"
  wgui:
    name: "wireguard-ui"

secrets:
  wireguard-ui:
    external: true
  wireguard-ui-session:
    external: true