services:
  wireguard-admin:
    build: .
    container_name: wireguard-admin
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - "51820:51820/udp"
      - "127.0.0.1:8000:8000/tcp"
    environment:
      WG_INTERFACE: wg0
      WG_HOST: ${WG_HOST:?set WG_HOST to your public IP or domain}
      WG_PORT: "51820"
      WG_SUBNET: 10.8.0.0/24
      WG_DNS: 1.1.1.1
      ADMIN_USERNAME: ${ADMIN_USERNAME:-admin}
      ADMIN_PASSWORD: ${ADMIN_PASSWORD:?set ADMIN_PASSWORD}
      SECRET_KEY: ${SECRET_KEY:?set SECRET_KEY to a long random string}
    volumes:
      - wg-admin-data:/opt/wireguard-admin/data
      - wg-config:/etc/wireguard

volumes:
  wg-admin-data:
  wg-config: