# /opt/stacks/wg-easy/docker-compose.yml

services:
  wg-easy:
    container_name: wg-easy
    image: ghcr.io/wg-easy/wg-easy:latest
    restart: unless-stopped
    environment:
      WG_HOST: '${WG_HOST}'                        # Domini o IP pública — via .env
      PASSWORD_HASH: '${WG_PASSWORD_HASH}'         # Hash bcrypt — via .env
      WG_PORT: 51820
      WG_DEFAULT_ADDRESS: '10.0.0.1'              # Adreça del servidor VPN (no .x)
      WG_DEFAULT_DNS: '${WG_DNS}'                  # AdGuard/Pi-hole — via .env
      WG_ALLOWED_IPS: '0.0.0.0/0'
      UI_TRAFFIC_STATS: true
      UI_CHART_TYPE: 1
      TZ: Europe/Madrid
    ports:
      - "51820:51820/udp"           # WireGuard VPN — públic (necessari per a clients)
      - "51821:51821"     # Interfície web (només local → via Nginx)
    volumes:
      - wg_easy_data:/etc/wireguard  # Volum named — configuració persistent
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
    networks:
      - shared_net

volumes:
  wg_easy_data:

networks:
  shared_net:
    external: true
    name: shared_net