docker-compose.yaml

services:
  wg-easy:
    environment:
      - INSECURE=true
      - WG_PORT=51820
      - PORT=51821
    image: ghcr.io/wg-easy/wg-easy:15
    container_name: wg-easy
    network_mode: host
    volumes:
      - etc_wireguard:/etc/wireguard
      - /lib/modules:/lib/modules:ro
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    depends_on:
      - unbound
      - pihole

  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    network_mode: host
    environment:
      # Set the appropriate timezone for your location from
      # https://en.wikipedia.org/wiki/List_of_tz_database_time_zones, e.g:
      TZ: 'America/Chicago'
      # Set a password to access the web interface. Not setting one will result in a random password being assigned
      FTLCONF_webserver_api_password: 'password123'
      FTLCONF_dns_upstreams: '127.0.0.1#5335'
      FTLCONF_webserver_port: '8080'
    volumes:
      # For persisting Pi-hole's databases and common configuration file
      - etc_pihole:/etc/pihole
      # Uncomment the below if you have custom dnsmasq config files that you want to persist. Not needed for most starting fresh with Pi-hole v6. If you're upgrading from v5 you and have used this directory before, you should keep it enabled for the first v6 container start to allow for a complete migration. It can be removed afterwards. Needs environment variable FTLCONF_misc_etc_dnsmasq_d: 'true'
      - etc_dnsmasq.d:/etc/dnsmasq.d
    cap_add:
      # See https://github.com/pi-hole/docker-pi-hole#note-on-capabilities
      # Required if you are using Pi-hole as your DHCP server, else not needed
      #- NET_ADMIN
      # Required if you are using Pi-hole as your NTP client to be able to set the host's system time
      - SYS_TIME
      # Optional, if Pi-hole should get some more processing time
      - SYS_NICE
    depends_on:
      - unbound
    restart: unless-stopped

  unbound:
    image: klutchell/unbound
    network_mode: host
    healthcheck:
      # Use the drill wrapper binary to reduce the exit codes to 0 or 1 for healthchecks
      test: ['CMD', 'drill-hc', '@127.0.0.1', 'dnssec.works']
      interval: 30s
      timeout: 30s
      retries: 3
      start_period: 30s
    volumes:
      - etc_unbound:/etc/unbound
    restart: unless-stopped

volumes:
  etc_wireguard:
  etc_pihole:
  etc_dnsmasq.d:
  etc_unbound: