vh
398b58a161
wgtunnel deployed + accepted end-to-end (tunnel-dev): erebe/wstunnel v10.6.2 behind traefik on ana-docker, Host boring.phasefinal.com (Mode A anaprod cert), --restrict-to ana-wg:31337 (not an open relay). Mirror per fleet convention; full project in vh/wgtunnel.
39 lines
1.4 KiB
YAML
39 lines
1.4 KiB
YAML
version: "3.8"
|
|
|
|
services:
|
|
wstunnel:
|
|
image: ghcr.io/erebe/wstunnel:${WGTUNNEL_IMAGE_TAG}
|
|
restart: unless-stopped
|
|
# The image ENTRYPOINT is dumb-init; we override the command with the full
|
|
# binary path so dumb-init execs it. `--restrict-to` is not in the image's
|
|
# default CMD, so a full override is required.
|
|
command:
|
|
- /home/app/wstunnel
|
|
- server
|
|
- --restrict-to
|
|
- ${WG_TARGET}
|
|
- ws://0.0.0.0:${WSTUNNEL_PORT}
|
|
networks:
|
|
- traefik-net
|
|
healthcheck:
|
|
# The image is dash + grep/sed/cat only — no nc/wget/curl and dash has no
|
|
# /dev/tcp (contract R5.4 "no usable probe binary" case). Verify the listener
|
|
# via /proc/net/tcp instead: port 8080 = 0x1F90 (update if WSTUNNEL_PORT changes).
|
|
test: ["CMD-SHELL", "grep -qi ':1F90 ' /proc/net/tcp /proc/net/tcp6 2>/dev/null || exit 1"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 10s
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.docker.network=traefik-net
|
|
- "traefik.http.routers.wgtunnel.rule=Host(`${TUNNEL_HOST}`)"
|
|
- traefik.http.routers.wgtunnel.entrypoints=websecure
|
|
- traefik.http.routers.wgtunnel.tls=true
|
|
- traefik.http.routers.wgtunnel.tls.certresolver=anaprod
|
|
- traefik.http.services.wgtunnel.loadbalancer.server.port=${WSTUNNEL_PORT}
|
|
|
|
networks:
|
|
traefik-net:
|
|
external: true
|