version: "3"
services:
  gluetun:
    image: qmcgaw/gluetun:latest
    container_name: gluetun
    # line above must be uncommented to allow external containers to connect. See https://github.com/qdm12/gluetun/wiki/Connect-a-container-to-gluetun#external-container-to-gluetun
    cap_add:
      - NET_ADMIN
    network_mode: bridge
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - 46721:51820/udp
      - 46722:51821/tcp
    environment:
      # See https://github.com/qdm12/gluetun/wiki
      - VPN_SERVICE_PROVIDER=custom
      - VPN_TYPE=wireguard
      - VPN_ENDPOINT_IP=[redacted]
      - VPN_ENDPOINT_PORT=[redacted]
      # Wireguard:
      - WIREGUARD_PUBLIC_KEY=[redacted]
      - WIREGUARD_PRIVATE_KEY=[redacted]
      - WIREGUARD_PRESHARED_KEY=[redacted]
      - WIREGUARD_ADDRESSES=[redacted]
      - DNS_ADDRESS=[redacted]
      # Timezone for accurate log times
      - TZ=America/Denver
    restart: always

  wg-easy:
    container_name: wg-easy
    image: weejewel/wg-easy:latest
    network_mode: "service:gluetun"
    environment:
      - WG_HOST=[redacted]
      - WG_PORT=[redacted]
      - WG_DEFAULT_ADDRESS=192.168.54.x
      - WG_DEFAULT_DNS=[redacted]
      - PASSWORD=[redacted]
    volumes:
      - '/path/to/wireguard:/etc/wireguard'
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
    depends_on:
      - gluetun
    restart: unless-stopped