jcoffey-dev
02e7993c87
WGX shares its name with several other WireGuard tools, so the project becomes ihasvpn, alongside ihasmail. - Module github.com/Coffey-Labs/ihasvpn, command cmd/ihasvpn, image ghcr.io/coffey-labs/ihasvpn. - Environment variables move from WGX_* to IHASVPN_*. The default database is ihasvpn.db, the nftables table is `ihasvpn`, metrics are ihasvpn_*, and the session cookie and theme key are renamed, so existing sessions end. - The mark is the ihasmail cat peeking over the edge of a shield, drawn as a vector. docs/brand/generate.py builds the mark, mono mark, wordmarks, social card, favicons and app icons from that one drawing. - The console takes ihasmail's palette: the ihasmail.org teal-navy for dark, its contrast-checked light tiers with the site's light accent, received traffic in the cat's orange and sent in teal. The wordmark weight and font stack follow ihasmail.org. - Detail values wrap at spaces before breaking inside an address, so an IPv6 tunnel address no longer splits mid-number. - The README history note about the earlier WGX installer is gone with the name it explained. Screenshots retaken.
38 lines
1.5 KiB
YAML
38 lines
1.5 KiB
YAML
# ihasvpn on the host network: the fastest way to run it.
|
|
#
|
|
# With `network_mode: host` the WireGuard socket sits directly on the host's
|
|
# interfaces. There is no port mapping, no conntrack entry per client packet
|
|
# and no second NAT hop, which is worth a few percent of throughput and a
|
|
# little latency on a busy server. The trade-offs: wg0 is created in the
|
|
# host's namespace (you will see it in `ip link` and it is removed on
|
|
# shutdown), the NAT rules land in the host's nftables as a table named
|
|
# `ihasvpn`, and the admin UI listens on the host directly -- so it is bound to
|
|
# localhost below. Put a reverse proxy in front of it or set
|
|
# IHASVPN_TLS_SELF_SIGNED to reach it from elsewhere.
|
|
services:
|
|
ihasvpn:
|
|
image: ghcr.io/coffey-labs/ihasvpn:latest
|
|
container_name: ihasvpn
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
cap_add:
|
|
- NET_ADMIN
|
|
environment:
|
|
IHASVPN_ENDPOINT: vpn.example.com
|
|
IHASVPN_PORT: "51820"
|
|
IHASVPN_SUBNET: 10.8.0.0/24
|
|
IHASVPN_DNS: 1.1.1.1, 1.0.0.1
|
|
IHASVPN_HTTP_LISTEN: "127.0.0.1:51821"
|
|
# In host mode the forwarding sysctls are the host's own; ihasvpn sets
|
|
# them itself since it has NET_ADMIN, but if you prefer to own them
|
|
# add `net.ipv4.ip_forward = 1` to /etc/sysctl.d/ and turn this off.
|
|
# IHASVPN_MANAGE_SYSCTL: "false"
|
|
# Pick the interface to masquerade on if auto-detection picks the
|
|
# wrong one (it uses the default route).
|
|
# IHASVPN_EGRESS_INTERFACE: eth0
|
|
volumes:
|
|
- ihasvpn-data:/data
|
|
|
|
volumes:
|
|
ihasvpn-data:
|