mirror of
https://github.com/10h30/wirehole-ui.git
synced 2026-06-05 15:09:48 +09:00
Update README
This commit is contained in:
stoXe
@@ -1,14 +1,6 @@
|
||||
## What is this?
|
||||
WireHole is a combination of WireGuard, PiHole, and Unbound in a docker-compose project with the intent of enabling users to quickly and easily create and deploy a personally managed full or split-tunnel WireGuard VPN with ad blocking capabilities (via Pihole), and DNS caching with additional privacy options (via Unbound).
|
||||
|
||||
## Prerequisites:
|
||||
|
||||
- ☁ If using a cloud provider:
|
||||
- You need to allow ingress to port `51820`
|
||||
|
||||
##### Optional Fully Automated Deployment on Oracle Cloud:
|
||||
- https://medium.com/@devinjaystokes/automating-the-deployment-of-your-forever-free-pihole-and-wireguard-server-dce581f71b7
|
||||
|
||||
## Author
|
||||
|
||||
👤 **Devin Stokes**
|
||||
@@ -28,6 +20,30 @@ Give a ⭐ if this project helped you!
|
||||
|
||||
---
|
||||
|
||||
|
||||
### Supported Architectures
|
||||
|
||||
The Wireguard image supports multiple architectures such as `x86-64`, `arm64` and `armhf`. Linuxserver - who makes the wireguard image we use - utilises the docker manifest for multi-platform awareness.
|
||||
|
||||
More information is available from docker [here](https://github.com/docker/distribution/blob/master/docs/spec/manifest-v2-2.md#manifest-list) and LinuxServer's announcement [here](https://blog.linuxserver.io/2019/02/21/the-lsio-pipeline-project/).
|
||||
|
||||
Simply pulling `linuxserver/wireguard` should retrieve the correct image for your arch, but you can also pull specific arch images via tags
|
||||
|
||||
> *This is the default configuration in this project*
|
||||
|
||||
**The architectures supported by this image are:**
|
||||
|
||||
| Architecture | Tag |
|
||||
| :----: | --- |
|
||||
| x86-64 | amd64-latest |
|
||||
| arm64 | arm64v8-latest |
|
||||
| armhf | arm32v7-latest |
|
||||
|
||||
|
||||
##### Optional - Fully Automated Deployment on Oracle Cloud:
|
||||
- https://medium.com/@devinjaystokes/automating-the-deployment-of-your-forever-free-pihole-and-wireguard-server-dce581f71b7
|
||||
|
||||
|
||||
### Quickstart
|
||||
To get started all you need to do is clone the repository and spin up the containers.
|
||||
|
||||
@@ -155,6 +171,72 @@ wireguard:
|
||||
# ...
|
||||
```
|
||||
|
||||
---
|
||||
## Configuring / Parameters
|
||||
|
||||
Container images are configured using parameters passed at runtime (such as those above). These parameters are separated by a colon and indicate `<external>:<internal>` respectively. For example, `-p 8080:80` would expose port `80` from inside the container to be accessible from the host's IP on port `8080` outside the container.
|
||||
|
||||
| Parameter | Function |
|
||||
| :----: | --- |
|
||||
| `-p 51820/udp` | wireguard port |
|
||||
| `-e PUID=1000` | for UserID - see below for explanation |
|
||||
| `-e PGID=1000` | for GroupID - see below for explanation |
|
||||
| `-e TZ=Europe/London` | Specify a timezone to use EG Europe/London |
|
||||
| `-e SERVERURL=wireguard.domain.com` | External IP or domain name for docker host. Used in server mode. If set to `auto`, the container will try to determine and set the external IP automatically |
|
||||
| `-e SERVERPORT=51820` | External port for docker host. Used in server mode. |
|
||||
| `-e PEERS=1` | Number of peers to create confs for. Required for server mode. Can be a list of names too: myPC,myPhone,myTablet... |
|
||||
| `-e PEERDNS=auto` | DNS server set in peer/client configs (can be set as `8.8.8.8`). Used in server mode. Defaults to `auto`, which uses wireguard docker host's DNS via included CoreDNS forward. |
|
||||
| `-e INTERNAL_SUBNET=10.13.13.0` | Internal subnet for the wireguard and server and peers (only change if it clashes). Used in server mode. |
|
||||
| `-e ALLOWEDIPS=0.0.0.0/0` | The IPs/Ranges that the peers will be able to reach using the VPN connection. If not specified the default value is: '0.0.0.0/0, ::0/0' This will cause ALL traffic to route through the VPN, if you want split tunneling, set this to only the IPs you would like to use the tunnel AND the ip of the server's WG ip, such as 10.13.13.1. |
|
||||
| `-v /config` | Contains all relevant configuration files. |
|
||||
| `-v /lib/modules` | Maps host's modules folder. |
|
||||
| `--sysctl=` | Required for client mode. |
|
||||
|
||||
### Environment variables from files (Docker secrets)
|
||||
|
||||
You can set any environment variable from a file by using a special prepend `FILE__`.
|
||||
|
||||
As an example:
|
||||
|
||||
```bash
|
||||
-e FILE__PASSWORD=/run/secrets/mysecretpassword
|
||||
```
|
||||
|
||||
Will set the environment variable `PASSWORD` based on the contents of the `/run/secrets/mysecretpassword` file.
|
||||
|
||||
### Umask for running applications
|
||||
|
||||
There is the ability to override the default umask settings for services started within the containers using the optional `-e UMASK=022` setting.
|
||||
Keep in mind umask is not chmod it subtracts from permissions based on it's value it does not add. Please read up [here](https://en.wikipedia.org/wiki/Umask) before asking for support.
|
||||
|
||||
### User / Group Identifiers
|
||||
|
||||
When using volumes (`-v` flags) permissions issues can arise between the host OS and the container, this is avoided by allowing you to specify the user `PUID` and group `PGID`.
|
||||
|
||||
Ensure any volume directories on the host are owned by the same user you specify and any permissions issues will vanish like magic.
|
||||
|
||||
In this instance `PUID=1000` and `PGID=1000`, to find yours use `id user` as below:
|
||||
|
||||
```bash
|
||||
$ id username
|
||||
uid=1000(dockeruser) gid=1000(dockergroup) groups=1000(dockergroup)
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Adding Clients
|
||||
If the environment variable `PEERS` is set to a number or a list of strings separated by comma, the container will run in server mode and the necessary server and peer/client confs will be generated. The peer/client config qr codes will be output in the docker log. They will also be saved in text and png format under `/config/peerX` in case `PEERS` is a variable and an integer or `/config/peer_X` in case a list of names was provided instead of an integer.
|
||||
|
||||
Variables `SERVERURL`, `SERVERPORT`, `INTERNAL_SUBNET` and `PEERDNS` are optional variables used for server mode. Any changes to these environment variables will trigger regeneration of server and peer confs. Peer/client confs will be recreated with existing private/public keys. Delete the peer folders for the keys to be recreated along with the confs.
|
||||
|
||||
To add more peers/clients later on, you increment the `PEERS` environment variable or add more elements to the list and recreate the container.
|
||||
|
||||
To display the QR codes of active peers again, you can use the following command and list the peer numbers as arguments: `docker exec -it wireguard /app/show-peer 1 4 5` or `docker exec -it wireguard /app/show-peer myPC myPhone myTablet` (Keep in mind that the QR codes are also stored as PNGs in the config folder).
|
||||
|
||||
The templates used for server and peer confs are saved under `/config/templates`. Advanced users can modify these templates and force conf generation by deleting `/config/wg0.conf` and restarting the container.
|
||||
|
||||
*(This portion of documentation has been adapted from [docker-wireguard](https://github.com/linuxserver/docker-wireguard/blob/master/README.md))*
|
||||
|
||||
---
|
||||
|
||||
## Modifying the upstream DNS provider for Unbound
|
||||
@@ -205,6 +287,50 @@ Providers they have the information for:
|
||||
Provided your DNS is properly configured on the device you're using, and you're connected to WireGuard, you can now navigate to http://pi.hole/admin and it should take you right to the pihole admin interface.
|
||||
|
||||
---
|
||||
## Support Info
|
||||
|
||||
* Shell access whilst the container is running: `docker exec -it wireguard /bin/bash`
|
||||
* To monitor the logs of the container in realtime: `docker logs -f wireguard`
|
||||
* container version number
|
||||
* `docker inspect -f '{{ index .Config.Labels "build_version" }}' wireguard`
|
||||
* image version number
|
||||
* `docker inspect -f '{{ index .Config.Labels "build_version" }}' ghcr.io/linuxserver/wireguard`
|
||||
|
||||
---
|
||||
|
||||
## Updating Info
|
||||
|
||||
LinuxServer images are generally static, versioned, and require an image update and container recreation to update the app inside.
|
||||
> **Note:** Updating apps inside the container is NOT supported.
|
||||
|
||||
Below are the instructions for updating **containers**:
|
||||
|
||||
### Via Docker Compose
|
||||
|
||||
* Update all images: `docker-compose pull`
|
||||
* or update a single image: `docker-compose pull wireguard`
|
||||
* Let compose update all containers as necessary: `docker-compose up -d`
|
||||
* or update a single container: `docker-compose up -d wireguard`
|
||||
* You can also remove the old dangling images: `docker image prune`
|
||||
|
||||
### Via Watchtower auto-updater (only use if you don't remember the original parameters)
|
||||
|
||||
* Pull the latest image at its tag and replace it with the same env variables in one run:
|
||||
|
||||
```bash
|
||||
docker run --rm \
|
||||
-v /var/run/docker.sock:/var/run/docker.sock \
|
||||
containrrr/watchtower \
|
||||
--run-once wireguard
|
||||
```
|
||||
|
||||
* You can also remove the old dangling images: `docker image prune`
|
||||
|
||||
> **Note:** Watchtower is not endorsed as a solution for automated updates of existing Docker containers. In fact generally automated updates are discouraged. However, this is a useful tool for one-time manual updates of containers where you have forgotten the original parameters. In the long term, LinuxServer.io highly recommends using Docker Compose.
|
||||
|
||||
|
||||
---
|
||||
|
||||
|
||||
## FAQ
|
||||
|
||||
@@ -219,6 +345,16 @@ To display the QR codes of active peers again, you can use the following command
|
||||
|
||||
The templates used for server and peer confs are saved under /config/templates. Advanced users can modify these templates and force conf generation by deleting /config/wg0.conf and restarting the container.
|
||||
|
||||
### Can I build ARM variants on x86_64?
|
||||
|
||||
The ARM variants can be built on x86_64 hardware using `multiarch/qemu-user-static`
|
||||
|
||||
```bash
|
||||
docker run --rm --privileged multiarch/qemu-user-static:register --reset
|
||||
```
|
||||
|
||||
Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64`.
|
||||
|
||||
### Where can I get additional block lists?
|
||||
* [The Big Blocklist Collection](https://firebog.net/)
|
||||
|
||||
@@ -230,3 +366,18 @@ The templates used for server and peer confs are saved under /config/templates.
|
||||
* [PiHole Official Site: What does this guide provide?](https://docs.pi-hole.net/guides/unbound/#what-does-this-guide-provide)
|
||||
|
||||
---
|
||||
|
||||
## Networking Considerations
|
||||
|
||||
If you plan to use Wireguard both remotely and locally, say on your mobile phone, you will need to consider routing. Most firewalls will not route ports forwarded on your WAN interface correctly to the LAN out of the box. This means that when you return home, even though you can see the Wireguard server, the return packets will probably get lost.
|
||||
|
||||
This is not a Wireguard specific issue and the two generally accepted solutions are NAT reflection (setting your edge router/firewall up in such a way as it translates internal packets correctly) or split horizon DNS (setting your internal DNS to return the private rather than public IP when connecting locally).
|
||||
|
||||
Both of these approaches have positives and negatives however their setup is out of scope for this document as everyone's network layout and equipment will be different.
|
||||
|
||||
|
||||
---
|
||||
|
||||
###### Shout out to LinuxServer.io for their documentation and maintenance of the incredible Wireguard image.
|
||||
|
||||
---
|
||||
Reference in New Issue
Block a user