mirror of
https://github.com/calibrain/shelfmark.git
synced 2026-07-30 14:26:18 -04:00
40d6a179b7
Add an opt-in WireGuard egress path alongside the existing Tor mode --------- Co-authored-by: CaliBrain <calibrain@l4n.xyz>
44 lines
2.1 KiB
YAML
44 lines
2.1 KiB
YAML
# Routes all traffic through a WireGuard tunnel - requires root startup.
|
|
#
|
|
# Mount your wg-quick config at /config/wg0.conf (read-only is fine). All
|
|
# non-LAN egress is forced through the tunnel by an iptables kill-switch, so if
|
|
# the tunnel drops, external traffic fails closed. LAN ranges (WebUI + internal
|
|
# download clients like Prowlarr / qBittorrent) stay reachable off-tunnel.
|
|
services:
|
|
shelfmark-wireguard:
|
|
image: ghcr.io/calibrain/shelfmark:latest
|
|
environment:
|
|
FLASK_PORT: 8084
|
|
# Quoted so it is passed as the literal string "true": entrypoint.sh compares
|
|
# $USING_WIREGUARD against "true", and some Compose implementations stringify
|
|
# a bare YAML boolean as "True", which would silently NOT enable WireGuard.
|
|
USING_WIREGUARD: "true"
|
|
# Path to the mounted wg-quick config (default shown).
|
|
WIREGUARD_CONFIG: /config/wg0.conf
|
|
# CIDRs kept OFF the tunnel so the WebUI and internal clients stay reachable.
|
|
LAN_NETWORK: 127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
|
|
PUID: 1000
|
|
PGID: 1000
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- NET_RAW
|
|
# WireGuard needs the module/kernel routing; NET_ADMIN covers wg-quick.
|
|
sysctls:
|
|
- net.ipv4.conf.all.src_valid_mark=1
|
|
# Disable IPv6 in the container so the kill-switch can guarantee no IPv6
|
|
# leak path on kernels/containers without a usable ip6tables. wireguard.sh
|
|
# fails closed if IPv6 is neither kill-switched nor disabled. If your host
|
|
# DOES have a working ip6tables you may omit these (an ip6tables kill-switch
|
|
# is installed instead); or set WIREGUARD_ALLOW_IPV6_LEAK=true only if the
|
|
# container genuinely has no IPv6 connectivity.
|
|
- net.ipv6.conf.all.disable_ipv6=1
|
|
- net.ipv6.conf.default.disable_ipv6=1
|
|
ports:
|
|
- 8084:8084
|
|
restart: unless-stopped
|
|
volumes:
|
|
- /path/to/books:/books # Default destination for book downloads
|
|
- /path/to/config:/config # App configuration (put wg0.conf here)
|
|
# Required for torrent / usenet - path must match your download client's volume exactly
|
|
# - /path/to/downloads:/path/to/downloads
|