Code rafactor.

.github/workflows/docker-build-test.yaml

@@ -8,7 +8,7 @@ on:
     branches:
       - master
     paths-ignore:
-      - CI/*.yaml
+      - user_data.yaml
 
 env:
   # github.repository as <account>/<repo>

Docker/.env

@@ -1,4 +1,16 @@
-PASSWORD="%SET_YOUR_PASSWORD%"
-WEB_PORT=51821
+# NGINX and WireGuard Configuration for wg-easy
+ALLOWED_NGINX_IPS="0.0.0.0/0"
+# NGINX_DOMAIN is the domain for the web interface
+NGINX_DOMAIN=""
+WEB_INTERFACE_PORT=51821
 WG_PORT=51820
-WG_HOST="%SET_YOUR_FQDN_OR_IP%"
+WG_ALLOWED_IPS="0.0.0.0/0, ::/0"
+WG_DEFAULT_SUBNET="10.16.0.x"
+WG_MTU=1420
+WG_UI_TRAFFIC_STATS="true"
+WG_LANGUAGE="en"
+WG_DEFAULT_DNS="8.8.8.8, 1.1.1.1"
+# WG_HOST is the domain or IP address of the WireGuard server
+WG_HOST=""
+# Run - docker run ghcr.io/wg-easy/wg-easy:14 wgpw YOUR_PASSWORD
+PASSWORD_HASH=""

Docker/Dockerfile

@@ -1,5 +1,5 @@
-ARG NGINX_FROM_IMAGE=nginx:1.27-alpine
-FROM ${NGINX_FROM_IMAGE} as builder
+ARG NGINX_FROM_IMAGE=nginx:1.27-alpine3.21
+FROM ${NGINX_FROM_IMAGE} AS builder
 
 ARG ENABLED_MODULES
 
@@ -15,11 +15,11 @@ COPY ./ /modules/
 RUN apk update \
     && apk add linux-headers openssl-dev pcre2-dev zlib-dev openssl abuild \
                musl-dev libxslt libxml2-utils make mercurial gcc unzip git \
-               xz g++ coreutils \
+               xz g++ coreutils curl \
     # allow abuild as a root user \
     && printf "#!/bin/sh\\nSETFATTR=true /usr/bin/abuild -F \"\$@\"\\n" > /usr/local/bin/abuild \
     && chmod +x /usr/local/bin/abuild \
-    && hg clone -r ${NGINX_VERSION}-${PKG_RELEASE} https://hg.nginx.org/pkg-oss/ \
+    && git clone -b ${NGINX_VERSION}-${PKG_RELEASE} https://github.com/nginx/pkg-oss/ \
     && cd pkg-oss \
     && mkdir /tmp/packages \
     && for module in $ENABLED_MODULES; do \
@@ -66,4 +66,4 @@ RUN --mount=type=bind,target=/tmp/packages/,source=/tmp/packages/,from=builder \
     . /tmp/packages/modules.env \
     && for module in $BUILT_MODULES; do \
            apk add --no-cache --allow-untrusted /tmp/packages/nginx-module-${module}-${NGINX_VERSION}*.apk; \
-       done
+       done

Docker/docker-compose.yaml → Docker/compose.yaml

@@ -8,15 +8,18 @@ services:
       args:
         ENABLED_MODULES: headers-more
     environment:
-      - 'WG_PORT_PROXY=${WG_PORT}'
+      - WG_PORT_PROXY=${WG_PORT}
+      - NGINX_DOMAIN=${NGINX_DOMAIN}
+      - ALLOWED_NGINX_IPS=${ALLOWED_NGINX_IPS}
     image: nginx-hm:1.27-alpine
     ports:
-      - '80:80'
-      # - '443:443'
+      - '80:80/tcp'
+      - '443:443/tcp'
       - '${WG_PORT}:51819/udp'
     volumes:
       - '../nginx.conf:/etc/nginx/nginx.conf'
       - '../templates:/etc/nginx/templates/'
+      - '../certs:/etc/nginx/ssl/'
     networks:
       local-network:
         ipv4_address: 172.16.238.4
@@ -26,27 +29,27 @@ services:
 
   wg_easy:
     environment:
-      - LANG=en
-      - 'WG_HOST=${WG_HOST}'
-      - PASSWORD=${PASSWORD}
-      - 'PORT=${WEB_PORT}'
-      - 'WG_PORT=${WG_PORT}'
-      - WG_DEFAULT_ADDRESS=10.16.0.x
-      - WG_DEFAULT_DNS=1.1.1.1
-      - WG_MTU=1420
+      - LANG=${WG_LANGUAGE}
+      - WG_HOST=${WG_HOST}
+      - PASSWORD_HASH=${PASSWORD_HASH}
+      - PORT=${WEB_INTERFACE_PORT}
+      - WG_PORT=${WG_PORT}
+      - WG_DEFAULT_ADDRESS=${WG_DEFAULT_SUBNET}
+      - WG_DEFAULT_DNS=${WG_DEFAULT_DNS}
+      - WG_MTU=${WG_MTU}
       - WG_PERSISTENT_KEEPALIVE=25
-      # - WG_ALLOWED_IPS=10.16.0.0/24
-      - UI_TRAFFIC_STATS=true
+      - WG_ALLOWED_IPS=${WG_ALLOWED_IPS}
+      - UI_TRAFFIC_STATS=${WG_UI_TRAFFIC_STATS}
       - UI_CHART_TYPE=3
-    image: 'ghcr.io/wg-easy/wg-easy:13@sha256:24eddefd4e5ae2cff930d4f9254f018d5f4cdd48daf559e7a73a14da6a9fbbb4'
+    image: 'ghcr.io/wg-easy/wg-easy:14@sha256:5f26407fd2ede54df76d63304ef184576a6c1bb73f934a58a11abdd852fab549'
     container_name: wg-easy
     volumes:
       - '/etc/wireguard:/etc/wireguard'
     networks:
       local-network:
         ipv4_address: 172.16.238.5
     ports:
-      - '172.16.238.1:${WEB_PORT}:${WEB_PORT}/tcp'
+      - '172.16.238.1:${WEB_INTERFACE_PORT}:${WEB_INTERFACE_PORT}/tcp'
     restart: unless-stopped
     cap_add:
       - NET_ADMIN
@@ -65,11 +68,3 @@ networks:
 
 volumes:
   etc_wireguard:
-
-# volumes:
-#   grafana-storage:
-#     name: "grafana-storage"
-#     external: true
-#   grafana-config:
-#     name: "grafana-config"
-#     external: true

README.md

@@ -13,6 +13,42 @@
 ---
 <div align="center">
 
-![Static Badge](https://img.shields.io/badge/version-1.0-lightgreen?style=flat)
+![Static Badge](https://img.shields.io/badge/version-1.0.1-lightgreen?style=flat)
 
 </div>
+
+---
+<div>
+&nbsp
+</div>
+
+## How It Works
+
+1. Clone this repository
+2. Set your values for variables in the **.env** file.
+3. Run - **docker-compose up -d**
+4. Run - **docker ps** (to check the status)
+
+### Environment Variables Configuration
+
+1. **ALLOWED_NGINX_IPS** - The IPv4 address or subnet from which access will be allowed. Provide a single IPv4 address or a CIDR range, such as `192.168.1.1` or `192.168.1.0/24`.
+2. **WEB_INTERFACE_PORT** - Port for access to the web interface wg-easy or endpoint - /wgui (Only for wg-easy). The default value is `51821`.
+3. **WG_ALLOWED_IPS** - Specifies the IP ranges (in CIDR notation) that are allowed to communicate through the VPN. For example, use `0.0.0.0/0` to allow all traffic or a specific range like `192.168.1.0/24` for a local network. **Note:** Using `0.0.0.0/0` allows all traffic, which can pose security risks. It is recommended to restrict this to specific ranges whenever possible.
+4. **WG_DEFAULT_SUBNET** - Specifies the subnet to use for the VPN. The format is `ip_address/prefix_length`. For example, `10.16.0.0/24` will create a subnet with a netmask of `255.255.255.0`.
+5. **WG_MTU** - Specifies the Maximum Transmission Unit (MTU) for the VPN. The MTU is the maximum size of a packet that can be transmitted over the network. The default value is `1420`, which is suitable for most use cases. Adjust this value only if you experience connectivity issues or need to optimize for specific network conditions.
+6. **WG_UI_TRAFFIC_STATS** - Specifies whether to display traffic statistics in the web interface. Set to `true` to enable, or `false` to disable. Defaults to `false` if not specified.
+7. **WG_LANGUAGE** - Specifies the language for the web interface. The available options are `en` (English) and `es` (Spanish).
+8. **WG_DEFAULT_DNS** - Specifies the DNS servers to use for the VPN. Separate multiple DNS servers with commas. For example, `8.8.8.8, 1.1.1.1`.
+9. **WG_PORT** - Specifies the port to use for the VPN. The default value is `51820`, but it can be changed freely to suit your network configuration.
+10. **NGINX_DOMAIN** - The domain for the web interface. For example, `example.com`.
+
+    > This is the domain for the web interface. It is used to configure the server block in NGINX.
+11. **PASSWORD_HASH** - The hashed password for the web interface. Default is empty.
+
+    > This is the hashed password for the web interface. It is used to secure the access to the web interface. The password can be hashed using the `wgpw` command-line tool provided by the `wg-easy` package. For example, to hash a password, you can run `wgpw mypassword`.
+
+    > **Note:** Make sure to store the hashed password securely and do not commit it to version control.
+
+
+🚨 File [**user_data.yaml**](user_data.yaml) contains data for cloud-init. It has default user - oricorio, defualt hashed password - changepass
+🚨 If you use [**user_data.yaml**](user_data.yaml) for deploy your server than change password and/or disable password login is set **lock_passwd: false**

nginx.conf

@@ -10,27 +10,23 @@ events {
 }
 
 http {
-    server {
-        access_log /var/log/nginx/access.log combined;
-        listen       80;
-        server_name  %INSERT_YOUR_SERVER_NAME%;
-
-        proxy_buffers 48 16k;
-        proxy_buffer_size 16k;
-
-        location / {
-            root /usr/share/nginx/html;
-            index index.html;
-        }
-
-        location /web/ {
-            proxy_pass http://wg_easy:51821/;
-            proxy_connect_timeout 3s;
-            # Uncomment the following line if needed;
-            # allow %INSERT_YOU_IPS%;
-            # deny all;
-        }
-    }
+    server_tokens off;
+    proxy_buffers 48 16k;
+    proxy_buffer_size 16k;
+    proxy_busy_buffers_size 24k;
+
+    proxy_cache_path /tmp/cache levels=1:2 keys_zone=cache:60m max_size=1G use_temp_path=off;
+    proxy_cache_methods GET HEAD;
+
+    proxy_redirect     off;
+    proxy_set_header   X-Real-IP $remote_addr;
+    proxy_set_header   X-Forwarded-For $remote_addr;
+    proxy_set_header   X-Forwarded-Proto $scheme;
+    proxy_set_header   Host $host;
+    # proxy_set_header   Connection "";
+
+    # include /etc/nginx/conf.d/domain_https.conf;
+    include /etc/nginx/conf.d/domain_http.conf;
 
     server {
         listen 80 default_server;

templates/domain_http.conf.template

@@ -0,0 +1,37 @@
+    server {
+        access_log /var/log/nginx/access.log combined;
+        listen       80;
+        server_name $NGINX_DOMAIN;
+
+        location = / {
+            root /usr/share/nginx/html;
+            index index.html;
+            return 444;
+        }
+
+        location /wgui/ {
+            proxy_pass http://wg_easy:51821/;
+            proxy_connect_timeout 3s;
+            proxy_http_version 1.1;
+            proxy_set_header   X-NginX-Proxy true;
+
+            proxy_request_buffering off;
+            proxy_buffering off;
+
+            # proxy_cache          cache;
+            # proxy_cache_key      $host$uri$is_args$args;
+            # proxy_cache_valid    200 301 302 30m;
+            # proxy_cache_valid    404         10m;
+
+            # Uncomment the following line if needed;
+            allow $ALLOWED_NGINX_IPS;
+            deny all;
+        }
+
+        # include prometheus config
+        include /etc/nginx/conf.d/prom.conf;
+
+        # redirect server error pages to the static page /50x.html
+        #
+        error_page   500 502 503 504  /50x.html;
+    }

templates/domain_https.conf.template

@@ -0,0 +1,51 @@
+    server {
+        access_log /var/log/nginx/access.log combined;
+        listen       443 ssl;
+        http2        on;
+        server_name $NGINX_DOMAIN;
+
+        ssl_certificate /etc/nginx/ssl/fullchain.pem;
+        ssl_certificate_key /etc/nginx/ssl/privkey.pem;
+
+        location = / {
+            root /usr/share/nginx/html;
+            index index.html;
+            return 444;
+        }
+
+        location /wgui/ {
+            proxy_pass http://wg_easy:51821/;
+            proxy_connect_timeout 3s;
+            proxy_http_version 1.1;
+            proxy_set_header   X-NginX-Proxy true;
+
+            proxy_request_buffering off;
+            proxy_buffering off;
+
+            # proxy_cache          cache;
+            # proxy_cache_key      $host$uri$is_args$args;
+            # proxy_cache_valid    200 301 302 30m;
+            # proxy_cache_valid    404         10m;
+
+            # Uncomment the following line if needed;
+            allow $ALLOWED_NGINX_IPS;
+            deny all;
+        }
+
+        # include prometheus config
+        include /etc/nginx/conf.d/prom.conf;
+
+        # redirect server error pages to the static page /50x.html
+        #
+        error_page   500 502 503 504  /50x.html;
+    }
+
+    server {
+        access_log /var/log/nginx/access.log combined;
+        listen       80;
+        server_name  $NGINX_DOMAIN;
+
+        location / {
+            return 301 https://$NGINX_DOMAIN$request_uri;
+        }
+    }

templates/prom.conf.template

@@ -0,0 +1,3 @@
+location /prometheus/ {
+    return 444;
+}

CI/user_data.yaml → user_data.yaml

@@ -10,6 +10,11 @@ cloud_config_modules:
 # cloud_final_modules:
 #   - apt-configure
 
+# uncomment if you need to set fqdn
+manage_etc_hosts: true
+# fqdn: netes-master1.example.org
+# hostname: netes-master1
+
 output: {all: "| tee -a /var/log/cloud-init.log"}
 
 ssh_pwauth: true
@@ -22,11 +27,11 @@ groups:
 system_info:
   distro: ubuntu
   default_user:
-    name: ubuntu
+    name: oricorio
     gecos: Default (ubuntu user)
-    # passwd: $6$w/HjOZlmeVGZ9GbC$cYqBM9POpFhxlg4n.eKUpidxkgf5RQ1XNS/hNdXt3GSKhNZNuLA6UYBph2k6Eo4OgQffSI5CitQS.2c3r2G0y/
+    # mkpasswd --method=SHA-512 --rounds=4096
+    passwd: $6$rounds=4096$BJsgS8j5q3UcqoOI$wcwUucZeeitef..i5EKwXKK/haawgdTgpZKiczxvw1JPNED5otLShw2NeUHtslDdRIb88t5B8I3I1ESC3Z5Lx1
     # plain_text_passwd: changepass
-    plain_text_passwd: changepass
     sudo: ALL=(ALL) NOPASSWD:ALL
     groups: [users, docker]
     shell: /bin/bash
@@ -111,6 +116,7 @@ apt:
 
 package_update: true
 packages:
+  - whois
   - wget
   - tree
   - apt-transport-https
@@ -134,6 +140,7 @@ packages:
   - curl
   - gnupg
   - lsb-release
+  - bash-completion
 
 runcmd:
   - sudo systemctl restart systemd-resolved.service
@@ -143,8 +150,8 @@ runcmd:
   - apt-get update
   - apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose docker-compose-plugin docker-buildx-plugin
   - update-grub
-  - mkdir /home/ubuntu/app
-  - git clone https://github.com/Operator2024/wireguard-vpn.git /home/ubuntu/app
-  - chown -R ubuntu:ubuntu /home/ubuntu/app
+  - mkdir /home/oricorio/app
+  - git clone https://github.com/Operator2024/wireguard-vpn.git /home/oricorio/app
+  - chown -R oricorio:oricorio /home/oricorio/app
 
 final_message: "The system is finally up, after $UPTIME seconds"