From a074cc8e8dc578777233db8ca07bb60dfef123a6 Mon Sep 17 00:00:00 2001 From: Valdimir Belomestnykh Date: Mon, 14 Apr 2025 09:10:24 +0500 Subject: [PATCH 01/16] Added HTTPS support. Updated dockerfile --- Docker/docker-compose.yaml | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/Docker/docker-compose.yaml b/Docker/docker-compose.yaml index 150d7ee..45a9ff6 100644 --- a/Docker/docker-compose.yaml +++ b/Docker/docker-compose.yaml @@ -9,14 +9,16 @@ services: ENABLED_MODULES: headers-more environment: - 'WG_PORT_PROXY=${WG_PORT}' + - 'NGINX_DOMAIN=${DOMAIN}' image: nginx-hm:1.27-alpine ports: - '80:80' - # - '443:443' + - '443:443' - '${WG_PORT}:51819/udp' volumes: - '../nginx.conf:/etc/nginx/nginx.conf' - '../templates:/etc/nginx/templates/' + - '../certs:/etc/nginx/ssl/' networks: local-network: ipv4_address: 172.16.238.4 @@ -65,11 +67,3 @@ networks: volumes: etc_wireguard: - -# volumes: -# grafana-storage: -# name: "grafana-storage" -# external: true -# grafana-config: -# name: "grafana-config" -# external: true From b624cd45fde5ea34ce5666ad688e39a680284a99 Mon Sep 17 00:00:00 2001 From: Valdimir Belomestnykh Date: Mon, 14 Apr 2025 09:10:38 +0500 Subject: [PATCH 02/16] Added HTTPS to NginX --- nginx.conf | 51 ++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 46 insertions(+), 5 deletions(-) diff --git a/nginx.conf b/nginx.conf index 0a403de..2e9769e 100644 --- a/nginx.conf +++ b/nginx.conf @@ -10,26 +10,67 @@ events { } http { + server_tokens off; + proxy_buffers 48 16k; + proxy_buffer_size 16k; + proxy_busy_buffers_size 24k; + + proxy_cache_path /tmp/cache levels=1:2 keys_zone=cache:60m max_size=1G use_temp_path=off; + proxy_cache_methods GET HEAD; + + proxy_redirect off; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Host $host; + # proxy_set_header Connection ""; + server { access_log /var/log/nginx/access.log combined; - listen 80; - server_name %INSERT_YOUR_SERVER_NAME%; + listen 443 ssl; + http2 on; + server_name $NGINX_DOMAIN; - proxy_buffers 48 16k; - proxy_buffer_size 16k; + ssl_certificate /etc/nginx/ssl/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/privkey.pem; location / { root /usr/share/nginx/html; index index.html; + return 444; } - location /web/ { + location /wireguardweb/ { proxy_pass http://wg_easy:51821/; proxy_connect_timeout 3s; + proxy_http_version 1.1; + proxy_set_header X-NginX-Proxy true; + + proxy_cache cache; + proxy_cache_key $host$uri$is_args$args; + proxy_cache_valid 200 301 302 30m; + proxy_cache_valid 404 10m; # Uncomment the following line if needed; # allow %INSERT_YOU_IPS%; # deny all; } + + # include prometheus config + include /etc/nginx/conf.d/prom.conf; + + # redirect server error pages to the static page /50x.html + # + error_page 500 502 503 504 /50x.html; + } + + server { + access_log /var/log/nginx/access.log combined; + listen 80; + server_name $NGINX_DOMAIN; + + location / { + return 301 https://$NGINX_DOMAIN$request_uri; + } } server { From 93843997009215a53b4cf660392425de8e18a56e Mon Sep 17 00:00:00 2001 From: Valdimir Belomestnykh Date: Mon, 14 Apr 2025 09:27:50 +0500 Subject: [PATCH 03/16] Updated env --- Docker/.env | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/Docker/.env b/Docker/.env index 0ef3c76..67fc8f9 100644 --- a/Docker/.env +++ b/Docker/.env @@ -1,4 +1,5 @@ -PASSWORD="%SET_YOUR_PASSWORD%" +PASSWORD="" WEB_PORT=51821 WG_PORT=51820 -WG_HOST="%SET_YOUR_FQDN_OR_IP%" \ No newline at end of file +WG_HOST="" +NGINX_DOMAIN="" \ No newline at end of file From 5b0672072f3bbf3f88c1ffdc6bfffe11a9dd17a4 Mon Sep 17 00:00:00 2001 From: Valdimir Belomestnykh Date: Mon, 14 Apr 2025 09:29:55 +0500 Subject: [PATCH 04/16] Fix nginx config --- nginx.conf | 48 +--------------------------------- templates/domain.conf.template | 47 +++++++++++++++++++++++++++++++++ 2 files changed, 48 insertions(+), 47 deletions(-) create mode 100644 templates/domain.conf.template diff --git a/nginx.conf b/nginx.conf index 2e9769e..d1d1775 100644 --- a/nginx.conf +++ b/nginx.conf @@ -25,53 +25,7 @@ http { proxy_set_header Host $host; # proxy_set_header Connection ""; - server { - access_log /var/log/nginx/access.log combined; - listen 443 ssl; - http2 on; - server_name $NGINX_DOMAIN; - - ssl_certificate /etc/nginx/ssl/fullchain.pem; - ssl_certificate_key /etc/nginx/ssl/privkey.pem; - - location / { - root /usr/share/nginx/html; - index index.html; - return 444; - } - - location /wireguardweb/ { - proxy_pass http://wg_easy:51821/; - proxy_connect_timeout 3s; - proxy_http_version 1.1; - proxy_set_header X-NginX-Proxy true; - - proxy_cache cache; - proxy_cache_key $host$uri$is_args$args; - proxy_cache_valid 200 301 302 30m; - proxy_cache_valid 404 10m; - # Uncomment the following line if needed; - # allow %INSERT_YOU_IPS%; - # deny all; - } - - # include prometheus config - include /etc/nginx/conf.d/prom.conf; - - # redirect server error pages to the static page /50x.html - # - error_page 500 502 503 504 /50x.html; - } - - server { - access_log /var/log/nginx/access.log combined; - listen 80; - server_name $NGINX_DOMAIN; - - location / { - return 301 https://$NGINX_DOMAIN$request_uri; - } - } + include /etc/nginx/conf.d/domain.conf; server { listen 80 default_server; diff --git a/templates/domain.conf.template b/templates/domain.conf.template new file mode 100644 index 0000000..f78db2c --- /dev/null +++ b/templates/domain.conf.template @@ -0,0 +1,47 @@ + server { + access_log /var/log/nginx/access.log combined; + listen 443 ssl; + http2 on; + server_name $NGINX_DOMAIN; + + ssl_certificate /etc/nginx/ssl/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/privkey.pem; + + location / { + root /usr/share/nginx/html; + index index.html; + return 444; + } + + location /wireguardweb/ { + proxy_pass http://wg_easy:51821/; + proxy_connect_timeout 3s; + proxy_http_version 1.1; + proxy_set_header X-NginX-Proxy true; + + proxy_cache cache; + proxy_cache_key $host$uri$is_args$args; + proxy_cache_valid 200 301 302 30m; + proxy_cache_valid 404 10m; + # Uncomment the following line if needed; + # allow %INSERT_YOU_IPS%; + # deny all; + } + + # include prometheus config + include /etc/nginx/conf.d/prom.conf; + + # redirect server error pages to the static page /50x.html + # + error_page 500 502 503 504 /50x.html; + } + + server { + access_log /var/log/nginx/access.log combined; + listen 80; + server_name $NGINX_DOMAIN; + + location / { + return 301 https://$NGINX_DOMAIN$request_uri; + } + } \ No newline at end of file From fe708de43fa99f2d8d3cf6fceccfd57baf72e969 Mon Sep 17 00:00:00 2001 From: Valdimir Belomestnykh Date: Mon, 14 Apr 2025 10:33:24 +0500 Subject: [PATCH 05/16] Updated domain.conf.template --- templates/domain.conf.template | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/templates/domain.conf.template b/templates/domain.conf.template index f78db2c..40f537a 100644 --- a/templates/domain.conf.template +++ b/templates/domain.conf.template @@ -7,22 +7,26 @@ ssl_certificate /etc/nginx/ssl/fullchain.pem; ssl_certificate_key /etc/nginx/ssl/privkey.pem; - location / { + location = / { root /usr/share/nginx/html; index index.html; return 444; } - location /wireguardweb/ { + location /wgui/ { proxy_pass http://wg_easy:51821/; proxy_connect_timeout 3s; proxy_http_version 1.1; proxy_set_header X-NginX-Proxy true; - proxy_cache cache; - proxy_cache_key $host$uri$is_args$args; - proxy_cache_valid 200 301 302 30m; - proxy_cache_valid 404 10m; + proxy_request_buffering off; + proxy_buffering off; + + # proxy_cache cache; + # proxy_cache_key $host$uri$is_args$args; + # proxy_cache_valid 200 301 302 30m; + # proxy_cache_valid 404 10m; + # Uncomment the following line if needed; # allow %INSERT_YOU_IPS%; # deny all; From 0d3cfd2f047caa85362bc12aaede01b3f2739f2d Mon Sep 17 00:00:00 2001 From: Valdimir Belomestnykh Date: Tue, 15 Apr 2025 08:58:37 +0500 Subject: [PATCH 06/16] Updated Dockerfile. Alpine 3.19, Nginx 1.27.0. pkg-oss moved to github --- Docker/Dockerfile | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Docker/Dockerfile b/Docker/Dockerfile index feddd63..29d19af 100644 --- a/Docker/Dockerfile +++ b/Docker/Dockerfile @@ -1,5 +1,5 @@ -ARG NGINX_FROM_IMAGE=nginx:1.27-alpine -FROM ${NGINX_FROM_IMAGE} as builder +ARG NGINX_FROM_IMAGE=nginx:1.27-alpine@sha256:208b70eefac13ee9be00e486f79c695b15cef861c680527171a27d253d834be9 +FROM ${NGINX_FROM_IMAGE} AS builder ARG ENABLED_MODULES @@ -15,11 +15,11 @@ COPY ./ /modules/ RUN apk update \ && apk add linux-headers openssl-dev pcre2-dev zlib-dev openssl abuild \ musl-dev libxslt libxml2-utils make mercurial gcc unzip git \ - xz g++ coreutils \ + xz g++ coreutils curl \ # allow abuild as a root user \ && printf "#!/bin/sh\\nSETFATTR=true /usr/bin/abuild -F \"\$@\"\\n" > /usr/local/bin/abuild \ && chmod +x /usr/local/bin/abuild \ - && hg clone -r ${NGINX_VERSION}-${PKG_RELEASE} https://hg.nginx.org/pkg-oss/ \ + && git clone -b ${NGINX_VERSION}-${PKG_RELEASE} https://github.com/nginx/pkg-oss/ \ && cd pkg-oss \ && mkdir /tmp/packages \ && for module in $ENABLED_MODULES; do \ @@ -66,4 +66,4 @@ RUN --mount=type=bind,target=/tmp/packages/,source=/tmp/packages/,from=builder \ . /tmp/packages/modules.env \ && for module in $BUILT_MODULES; do \ apk add --no-cache --allow-untrusted /tmp/packages/nginx-module-${module}-${NGINX_VERSION}*.apk; \ - done + done \ No newline at end of file From 315297861533d8f527620763d3ccf109a6cc8ddb Mon Sep 17 00:00:00 2001 From: Valdimir Belomestnykh Date: Tue, 15 Apr 2025 09:05:01 +0500 Subject: [PATCH 07/16] Added 'prometheus' template --- templates/prom.conf.template | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 templates/prom.conf.template diff --git a/templates/prom.conf.template b/templates/prom.conf.template new file mode 100644 index 0000000..8f56f2a --- /dev/null +++ b/templates/prom.conf.template @@ -0,0 +1,3 @@ +location /prometheus/ { + return 444; +} \ No newline at end of file From 0312d9e88423ab62f818d22b5e2b3ede3c0c06b6 Mon Sep 17 00:00:00 2001 From: Valdimir Belomestnykh Date: Tue, 12 Aug 2025 10:44:41 +0500 Subject: [PATCH 08/16] Remove dir CI. Move 'user_data' to root project. --- CI/user_data.yaml => user_data.yaml | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename CI/user_data.yaml => user_data.yaml (100%) diff --git a/CI/user_data.yaml b/user_data.yaml similarity index 100% rename from CI/user_data.yaml rename to user_data.yaml From 45812f36efbb05e9a8e31c76b590e03a14d54d7b Mon Sep 17 00:00:00 2001 From: Valdimir Belomestnykh Date: Tue, 12 Aug 2025 10:45:21 +0500 Subject: [PATCH 09/16] Updated nginx configs. Added config for http (Default). --- nginx.conf | 3 +- templates/domain_http.conf.template | 37 +++++++++++++++++++ ...nf.template => domain_https.conf.template} | 2 +- 3 files changed, 40 insertions(+), 2 deletions(-) create mode 100644 templates/domain_http.conf.template rename templates/{domain.conf.template => domain_https.conf.template} (99%) diff --git a/nginx.conf b/nginx.conf index d1d1775..295ab26 100644 --- a/nginx.conf +++ b/nginx.conf @@ -25,7 +25,8 @@ http { proxy_set_header Host $host; # proxy_set_header Connection ""; - include /etc/nginx/conf.d/domain.conf; + # include /etc/nginx/conf.d/domain_https.conf; + include /etc/nginx/conf.d/domain_http.conf; server { listen 80 default_server; diff --git a/templates/domain_http.conf.template b/templates/domain_http.conf.template new file mode 100644 index 0000000..5a66cd5 --- /dev/null +++ b/templates/domain_http.conf.template @@ -0,0 +1,37 @@ + server { + access_log /var/log/nginx/access.log combined; + listen 80; + server_name $NGINX_DOMAIN; + + location = / { + root /usr/share/nginx/html; + index index.html; + return 444; + } + + location /wgui/ { + proxy_pass http://wg_easy:51821/; + proxy_connect_timeout 3s; + proxy_http_version 1.1; + proxy_set_header X-NginX-Proxy true; + + proxy_request_buffering off; + proxy_buffering off; + + # proxy_cache cache; + # proxy_cache_key $host$uri$is_args$args; + # proxy_cache_valid 200 301 302 30m; + # proxy_cache_valid 404 10m; + + # Uncomment the following line if needed; + # allow %INSERT_YOU_IPS%; + # deny all; + } + + # include prometheus config + include /etc/nginx/conf.d/prom.conf; + + # redirect server error pages to the static page /50x.html + # + error_page 500 502 503 504 /50x.html; + } diff --git a/templates/domain.conf.template b/templates/domain_https.conf.template similarity index 99% rename from templates/domain.conf.template rename to templates/domain_https.conf.template index 40f537a..4911637 100644 --- a/templates/domain.conf.template +++ b/templates/domain_https.conf.template @@ -48,4 +48,4 @@ location / { return 301 https://$NGINX_DOMAIN$request_uri; } - } \ No newline at end of file + } From e455e563c360543f9f0da136a3663cc3a3b9fefd Mon Sep 17 00:00:00 2001 From: Valdimir Belomestnykh Date: Tue, 12 Aug 2025 10:45:32 +0500 Subject: [PATCH 10/16] Updated README.md --- README.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 98a831d..5991328 100644 --- a/README.md +++ b/README.md @@ -13,6 +13,18 @@ ---
-![Static Badge](https://img.shields.io/badge/version-1.0-lightgreen?style=flat) +![Static Badge](https://img.shields.io/badge/version-1.0.1-lightgreen?style=flat)
+ +--- +
+  +
+ +## How it works + +1. Clone this repository +2. Set your values for variables in the **.env** file. +3. Run - **docker-compose up -d** +4. Run - **docker ps** (for check status) From 305d50d71585e70bdd12d83ffa97f407389a4ed5 Mon Sep 17 00:00:00 2001 From: Valdimir Belomestnykh Date: Tue, 12 Aug 2025 10:46:23 +0500 Subject: [PATCH 11/16] Updated nginx to 1.27.5 and alpine from 3.19 to 3.21 --- Docker/.env | 15 ++++++++++++--- Docker/Dockerfile | 2 +- Docker/docker-compose.yaml | 30 +++++++++++++++--------------- 3 files changed, 28 insertions(+), 19 deletions(-) diff --git a/Docker/.env b/Docker/.env index 67fc8f9..ac9e7cf 100644 --- a/Docker/.env +++ b/Docker/.env @@ -1,5 +1,14 @@ -PASSWORD="" -WEB_PORT=51821 +WEB_INTERFACE_PORT=51821 +WG_ALLOWED_IPS="0.0.0/0, ::/0" +WG_DEFAULT_SUBNET="10.16.0.x" +WG_MTU=1420 +WG_UI_TRAFFIC_STATS="true" +WG_LANGUAGE="env" +WG_DEFAULT_DNS="8.8.8.8, 1.1.1.1" WG_PORT=51820 +# WG_HOST is the domain or IP address of the WireGuard server WG_HOST="" -NGINX_DOMAIN="" \ No newline at end of file +# NGINX_DOMAIN is the domain for the web interface +NGINX_DOMAIN="" +# Run - docker run ghcr.io/wg-easy/wg-easy:14 wgpw YOUR_PASSWORD +PASSWORD_HASH="" diff --git a/Docker/Dockerfile b/Docker/Dockerfile index 29d19af..e760cd5 100644 --- a/Docker/Dockerfile +++ b/Docker/Dockerfile @@ -1,4 +1,4 @@ -ARG NGINX_FROM_IMAGE=nginx:1.27-alpine@sha256:208b70eefac13ee9be00e486f79c695b15cef861c680527171a27d253d834be9 +ARG NGINX_FROM_IMAGE=nginx:1.27-alpine3.21 FROM ${NGINX_FROM_IMAGE} AS builder ARG ENABLED_MODULES diff --git a/Docker/docker-compose.yaml b/Docker/docker-compose.yaml index 45a9ff6..eb2e4aa 100644 --- a/Docker/docker-compose.yaml +++ b/Docker/docker-compose.yaml @@ -9,11 +9,11 @@ services: ENABLED_MODULES: headers-more environment: - 'WG_PORT_PROXY=${WG_PORT}' - - 'NGINX_DOMAIN=${DOMAIN}' + - 'NGINX_DOMAIN=${NGINX_DOMAIN}' image: nginx-hm:1.27-alpine ports: - - '80:80' - - '443:443' + - '80:80/tcp' + - '443:443/tcp' - '${WG_PORT}:51819/udp' volumes: - '../nginx.conf:/etc/nginx/nginx.conf' @@ -28,19 +28,19 @@ services: wg_easy: environment: - - LANG=en - - 'WG_HOST=${WG_HOST}' - - PASSWORD=${PASSWORD} - - 'PORT=${WEB_PORT}' - - 'WG_PORT=${WG_PORT}' - - WG_DEFAULT_ADDRESS=10.16.0.x - - WG_DEFAULT_DNS=1.1.1.1 - - WG_MTU=1420 + - LANG=${WG_LANGUAGE} + - WG_HOST=${WG_HOST} + - PASSWORD_HASH=${PASSWORD_HASH} + - PORT=${WEB_INTERFACE_PORT} + - WG_PORT=${WG_PORT} + - WG_DEFAULT_ADDRESS=${WG_DEFAULT_SUBNET} + - WG_DEFAULT_DNS=${WG_DEFAULT_DNS} + - WG_MTU=${WG_MTU} - WG_PERSISTENT_KEEPALIVE=25 - # - WG_ALLOWED_IPS=10.16.0.0/24 - - UI_TRAFFIC_STATS=true + - WG_ALLOWED_IPS=${WG_ALLOWED_IPS} + - UI_TRAFFIC_STATS=${WG_UI_TRAFFIC_STATS} - UI_CHART_TYPE=3 - image: 'ghcr.io/wg-easy/wg-easy:13@sha256:24eddefd4e5ae2cff930d4f9254f018d5f4cdd48daf559e7a73a14da6a9fbbb4' + image: 'ghcr.io/wg-easy/wg-easy:14' container_name: wg-easy volumes: - '/etc/wireguard:/etc/wireguard' @@ -48,7 +48,7 @@ services: local-network: ipv4_address: 172.16.238.5 ports: - - '172.16.238.1:${WEB_PORT}:${WEB_PORT}/tcp' + - '172.16.238.1:${WEB_INTERFACE_PORT}:${WEB_INTERFACE_PORT}/tcp' restart: unless-stopped cap_add: - NET_ADMIN From d5c19dfdfa74fa348d796e2d99aef219d510dfe4 Mon Sep 17 00:00:00 2001 From: Valdimir Belomestnykh Date: Tue, 12 Aug 2025 10:46:38 +0500 Subject: [PATCH 12/16] Updated github actions (tests) --- .github/workflows/docker-build-test.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker-build-test.yaml b/.github/workflows/docker-build-test.yaml index c3d6bac..641a586 100644 --- a/.github/workflows/docker-build-test.yaml +++ b/.github/workflows/docker-build-test.yaml @@ -8,7 +8,7 @@ on: branches: - master paths-ignore: - - CI/*.yaml + - *.yaml env: # github.repository as / From 4c637b9b1ed2e006056570d2d96f2f4041460994 Mon Sep 17 00:00:00 2001 From: Valdimir Belomestnykh Date: Tue, 12 Aug 2025 11:12:02 +0500 Subject: [PATCH 13/16] Update user_data and github actions --- .github/workflows/docker-build-test.yaml | 2 +- user_data.yaml | 13 +++++++------ 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/.github/workflows/docker-build-test.yaml b/.github/workflows/docker-build-test.yaml index 641a586..a4909e6 100644 --- a/.github/workflows/docker-build-test.yaml +++ b/.github/workflows/docker-build-test.yaml @@ -8,7 +8,7 @@ on: branches: - master paths-ignore: - - *.yaml + - user_data.yaml env: # github.repository as / diff --git a/user_data.yaml b/user_data.yaml index 2a7ab9e..903e881 100644 --- a/user_data.yaml +++ b/user_data.yaml @@ -22,11 +22,11 @@ groups: system_info: distro: ubuntu default_user: - name: ubuntu + name: oricorio gecos: Default (ubuntu user) - # passwd: $6$w/HjOZlmeVGZ9GbC$cYqBM9POpFhxlg4n.eKUpidxkgf5RQ1XNS/hNdXt3GSKhNZNuLA6UYBph2k6Eo4OgQffSI5CitQS.2c3r2G0y/ + # mkpasswd --method=SHA-512 --rounds=4096 + passwd: $6$rounds=4096$BJsgS8j5q3UcqoOI$wcwUucZeeitef..i5EKwXKK/haawgdTgpZKiczxvw1JPNED5otLShw2NeUHtslDdRIb88t5B8I3I1ESC3Z5Lx1 # plain_text_passwd: changepass - plain_text_passwd: changepass sudo: ALL=(ALL) NOPASSWD:ALL groups: [users, docker] shell: /bin/bash @@ -111,6 +111,7 @@ apt: package_update: true packages: + - whois - wget - tree - apt-transport-https @@ -143,8 +144,8 @@ runcmd: - apt-get update - apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose docker-compose-plugin docker-buildx-plugin - update-grub - - mkdir /home/ubuntu/app - - git clone https://github.com/Operator2024/wireguard-vpn.git /home/ubuntu/app - - chown -R ubuntu:ubuntu /home/ubuntu/app + - mkdir /home/oricorio/app + - git clone https://github.com/Operator2024/wireguard-vpn.git /home/oricorio/app + - chown -R oricorio:oricorio /home/oricorio/app final_message: "The system is finally up, after $UPTIME seconds" From b53ee67a4cf52d039536a18d2548195f8ca66d06 Mon Sep 17 00:00:00 2001 From: Valdimir Belomestnykh Date: Tue, 12 Aug 2025 11:12:38 +0500 Subject: [PATCH 14/16] Fix linter warn. --- Docker/.env | 1 + Docker/docker-compose.yaml | 7 ++++--- templates/domain_http.conf.template | 4 ++-- templates/domain_https.conf.template | 4 ++-- 4 files changed, 9 insertions(+), 7 deletions(-) diff --git a/Docker/.env b/Docker/.env index ac9e7cf..e515020 100644 --- a/Docker/.env +++ b/Docker/.env @@ -1,3 +1,4 @@ +ALLOWED_NGINX_IPS="0.0.0.0/0" WEB_INTERFACE_PORT=51821 WG_ALLOWED_IPS="0.0.0/0, ::/0" WG_DEFAULT_SUBNET="10.16.0.x" diff --git a/Docker/docker-compose.yaml b/Docker/docker-compose.yaml index eb2e4aa..0cb5ffc 100644 --- a/Docker/docker-compose.yaml +++ b/Docker/docker-compose.yaml @@ -8,8 +8,9 @@ services: args: ENABLED_MODULES: headers-more environment: - - 'WG_PORT_PROXY=${WG_PORT}' - - 'NGINX_DOMAIN=${NGINX_DOMAIN}' + - WG_PORT_PROXY=${WG_PORT} + - NGINX_DOMAIN=${NGINX_DOMAIN} + - ALLOWED_NGINX_IPS=${ALLOWED_NGINX_IPS} image: nginx-hm:1.27-alpine ports: - '80:80/tcp' @@ -40,7 +41,7 @@ services: - WG_ALLOWED_IPS=${WG_ALLOWED_IPS} - UI_TRAFFIC_STATS=${WG_UI_TRAFFIC_STATS} - UI_CHART_TYPE=3 - image: 'ghcr.io/wg-easy/wg-easy:14' + image: 'ghcr.io/wg-easy/wg-easy:14@sha256:5f26407fd2ede54df76d63304ef184576a6c1bb73f934a58a11abdd852fab549' container_name: wg-easy volumes: - '/etc/wireguard:/etc/wireguard' diff --git a/templates/domain_http.conf.template b/templates/domain_http.conf.template index 5a66cd5..b5f6956 100644 --- a/templates/domain_http.conf.template +++ b/templates/domain_http.conf.template @@ -24,8 +24,8 @@ # proxy_cache_valid 404 10m; # Uncomment the following line if needed; - # allow %INSERT_YOU_IPS%; - # deny all; + allow $ALLOWED_NGINX_IPS; + deny all; } # include prometheus config diff --git a/templates/domain_https.conf.template b/templates/domain_https.conf.template index 4911637..60ac7d4 100644 --- a/templates/domain_https.conf.template +++ b/templates/domain_https.conf.template @@ -28,8 +28,8 @@ # proxy_cache_valid 404 10m; # Uncomment the following line if needed; - # allow %INSERT_YOU_IPS%; - # deny all; + allow $ALLOWED_NGINX_IPS; + deny all; } # include prometheus config From 60482a981dcf8db44bb97fc54ba79ecb4d6c0452 Mon Sep 17 00:00:00 2001 From: Valdimir Belomestnykh Date: Fri, 15 Aug 2025 23:39:46 +0500 Subject: [PATCH 15/16] Updated README.md Renamed file docker-compose to compose.yaml Updated .env --- Docker/.env | 11 ++++---- Docker/{docker-compose.yaml => compose.yaml} | 0 README.md | 28 ++++++++++++++++++-- 3 files changed, 32 insertions(+), 7 deletions(-) rename Docker/{docker-compose.yaml => compose.yaml} (100%) diff --git a/Docker/.env b/Docker/.env index e515020..f8c09ed 100644 --- a/Docker/.env +++ b/Docker/.env @@ -1,15 +1,16 @@ +# NGINX and WireGuard Configuration for wg-easy ALLOWED_NGINX_IPS="0.0.0.0/0" +# NGINX_DOMAIN is the domain for the web interface +NGINX_DOMAIN="" WEB_INTERFACE_PORT=51821 -WG_ALLOWED_IPS="0.0.0/0, ::/0" +WG_PORT=51820 +WG_ALLOWED_IPS="0.0.0.0/0, ::/0" WG_DEFAULT_SUBNET="10.16.0.x" WG_MTU=1420 WG_UI_TRAFFIC_STATS="true" -WG_LANGUAGE="env" +WG_LANGUAGE="en" WG_DEFAULT_DNS="8.8.8.8, 1.1.1.1" -WG_PORT=51820 # WG_HOST is the domain or IP address of the WireGuard server WG_HOST="" -# NGINX_DOMAIN is the domain for the web interface -NGINX_DOMAIN="" # Run - docker run ghcr.io/wg-easy/wg-easy:14 wgpw YOUR_PASSWORD PASSWORD_HASH="" diff --git a/Docker/docker-compose.yaml b/Docker/compose.yaml similarity index 100% rename from Docker/docker-compose.yaml rename to Docker/compose.yaml diff --git a/README.md b/README.md index 5991328..d703d00 100644 --- a/README.md +++ b/README.md @@ -22,9 +22,33 @@   -## How it works +## How It Works 1. Clone this repository 2. Set your values for variables in the **.env** file. 3. Run - **docker-compose up -d** -4. Run - **docker ps** (for check status) +4. Run - **docker ps** (to check the status) + +### Environment Variables Configuration + +1. **ALLOWED_NGINX_IPS** - The IPv4 address or subnet from which access will be allowed. Provide a single IPv4 address or a CIDR range, such as `192.168.1.1` or `192.168.1.0/24`. +2. **WEB_INTERFACE_PORT** - Port for access to the web interface wg-easy or endpoint - /wgui (Only for wg-easy). The default value is `51821`. +3. **WG_ALLOWED_IPS** - Specifies the IP ranges (in CIDR notation) that are allowed to communicate through the VPN. For example, use `0.0.0.0/0` to allow all traffic or a specific range like `192.168.1.0/24` for a local network. **Note:** Using `0.0.0.0/0` allows all traffic, which can pose security risks. It is recommended to restrict this to specific ranges whenever possible. +4. **WG_DEFAULT_SUBNET** - Specifies the subnet to use for the VPN. The format is `ip_address/prefix_length`. For example, `10.16.0.0/24` will create a subnet with a netmask of `255.255.255.0`. +5. **WG_MTU** - Specifies the Maximum Transmission Unit (MTU) for the VPN. The MTU is the maximum size of a packet that can be transmitted over the network. The default value is `1420`, which is suitable for most use cases. Adjust this value only if you experience connectivity issues or need to optimize for specific network conditions. +6. **WG_UI_TRAFFIC_STATS** - Specifies whether to display traffic statistics in the web interface. Set to `true` to enable, or `false` to disable. Defaults to `false` if not specified. +7. **WG_LANGUAGE** - Specifies the language for the web interface. The available options are `en` (English) and `es` (Spanish). +8. **WG_DEFAULT_DNS** - Specifies the DNS servers to use for the VPN. Separate multiple DNS servers with commas. For example, `8.8.8.8, 1.1.1.1`. +9. **WG_PORT** - Specifies the port to use for the VPN. The default value is `51820`, but it can be changed freely to suit your network configuration. +10. **NGINX_DOMAIN** - The domain for the web interface. For example, `example.com`. + + > This is the domain for the web interface. It is used to configure the server block in NGINX. +11. **PASSWORD_HASH** - The hashed password for the web interface. Default is empty. + + > This is the hashed password for the web interface. It is used to secure the access to the web interface. The password can be hashed using the `wgpw` command-line tool provided by the `wg-easy` package. For example, to hash a password, you can run `wgpw mypassword`. + + > **Note:** Make sure to store the hashed password securely and do not commit it to version control. + + +🚨 File [**user_data.yaml**](user_data.yaml) contains data for cloud-init. It has default user - oricorio, defualt hashed password - changepass +🚨 If you use [**user_data.yaml**](user_data.yaml) for deploy your server than change password and/or disable password login is set **lock_passwd: false** From 93eaf94fc6b85cff98f9fef4416952c3be601185 Mon Sep 17 00:00:00 2001 From: Valdimir Belomestnykh Date: Sat, 16 Aug 2025 12:22:25 +0500 Subject: [PATCH 16/16] Added bash-completion and manage hosts --- user_data.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/user_data.yaml b/user_data.yaml index 903e881..2862546 100644 --- a/user_data.yaml +++ b/user_data.yaml @@ -10,6 +10,11 @@ cloud_config_modules: # cloud_final_modules: # - apt-configure +# uncomment if you need to set fqdn +manage_etc_hosts: true +# fqdn: netes-master1.example.org +# hostname: netes-master1 + output: {all: "| tee -a /var/log/cloud-init.log"} ssh_pwauth: true @@ -135,6 +140,7 @@ packages: - curl - gnupg - lsb-release + - bash-completion runcmd: - sudo systemctl restart systemd-resolved.service