docker-compose.yml

name: "wireguard"

services:
  traefik:
    container_name: traefik
    image: traefik:latest
    restart: always
    ports:
      - "80:80"
      - "443:443"
      - ${SERVERPORT}:${SERVERPORT}/udp
    environment:
      DO_AUTH_TOKEN: ${DO_AUTH_TOKEN}
    labels:
      - "traefik.http.routers.traefik.rule=Host(`traefik.${HELIOS_DOMAIN}`)"
      - "traefik.http.routers.traefik.entrypoints=websecure"
      - "traefik.http.routers.traefik.tls.certresolver=myresolver"
      - "traefik.http.routers.traefik.service=api@internal"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./compose/traefik/traefik.yml:/etc/traefik/traefik.yml
      - ./compose/traefik/dynamic_conf.yml:/etc/traefik/dynamic_conf.yml

  wireguard:
    image: lscr.io/linuxserver/wireguard:latest
    container_name: wireguard
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/GMT+3
      - SERVERURL=${HELIOS_AGENT_DOMAIN}
      - SERVERPORT=${SERVERPORT}
      - PEERS=${PEERS}
      - PEERDNS=auto
      - INTERNAL_SUBNET=${INTERNAL_SUBNET}
      - ALLOWEDIPS=0.0.0.0/0
      - PERSISTENTKEEPALIVE_PEERS=20
      - LOG_CONFS=false
    volumes:
      - /lib/modules:/lib/modules
    ports:
      - ${SERVERPORT}:${SERVERPORT}/udp
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
    restart: always
    labels:
      - "traefik.udp.routers.wireguard.rule=HostSNI(`HELIOS_AGENT_DOMAIN`)"
      - "traefik.udp.routers.wireguard.entrypoints=udp"
      - "traefik.udp.routers.wireguard.tls.certresolver=myresolver"
      - "traefik.udp.services.wireguard.loadbalancer.server.port=${SERVERPORT}"