Claude
2210dd4bed
Utilities (8 modules): - mealie: recipe manager, port 9925 - actualbudget: personal finance, port 5006 - traccar: GPS tracking, ports 8082 + 5000-5150 device protocols - fmd: Android FindMyDevice server, random admin password, port 8084 - ddclient: dynamic DNS, config template, default start=n - wg-easy: WireGuard VPN+UI, auto-detects public IP, random password - meshcentral: remote device management, hostname prompt, ports 4430+4433 - magicmirror: smart mirror, 1-3 instances, MMM-* module auto-clone Cameras (2 modules): - frigate: AI NVR, auto-enables /dev/dri, starter config.yml, default start=n - frigate-notify: Frigate push alerts, auto-detects local Frigate+ntfy, no web UI https://claude.ai/code/session_01Y4dMKtkqkpvmgDKoRdzhTG
117 lines
3.7 KiB
Bash
117 lines
3.7 KiB
Bash
#!/bin/bash
|
|
# services/wg-easy.sh — WireGuard VPN with a web management UI (wg-easy).
|
|
# Part of the modular post-install system (sourced by setup.sh).
|
|
#
|
|
# Ported from ubuntu-post-install-24.04-crowdsec.sh (# ---- WG-EASY ----).
|
|
# Own ~/docker/wg-easy/ with a standalone docker-compose.yml + .env.
|
|
# Requires cap_add: NET_ADMIN + SYS_MODULE and ip_forward sysctl.
|
|
# Forward UDP 51820 on your router to this server for external VPN access.
|
|
|
|
register_service wg-easy utilities "WireGuard VPN with web management UI (wg-easy)" 51821
|
|
|
|
install_wg-easy() {
|
|
require_docker || return 1
|
|
|
|
local WGEASY_DIR="$DOCKER_DIR/wg-easy"
|
|
|
|
if [ "$DRY_RUN" = true ]; then
|
|
echo "[DRY-RUN] wg-easy would:"
|
|
echo " - Create $WGEASY_DIR with docker-compose.yml + .env (config/)"
|
|
echo " - Auto-detect public IP for WG_HOST"
|
|
echo " - Generate a random web UI password"
|
|
echo " - Expose port 51821 (web UI) + 51820/udp (VPN)"
|
|
echo " - Require router port-forward: UDP 51820 → this server"
|
|
echo " - Offer a Caddy reverse proxy and to start the container"
|
|
return 0
|
|
fi
|
|
|
|
mkdir -p "$WGEASY_DIR"
|
|
ensure_docker_dir_ownership "$WGEASY_DIR"
|
|
cd "$WGEASY_DIR" || return 1
|
|
|
|
# Auto-detect public IP as default for WG_HOST
|
|
local PUBLIC_IP WG_HOST WG_PASSWORD
|
|
PUBLIC_IP=$(curl -s --connect-timeout 5 ifconfig.me 2>/dev/null || echo "your-public-ip")
|
|
WG_PASSWORD=$(openssl rand -base64 16 | tr -dc 'a-zA-Z0-9' | head -c 16)
|
|
|
|
prompt_text "Public IP or hostname for VPN [$PUBLIC_IP]:" "$PUBLIC_IP" WG_HOST
|
|
|
|
cat > docker-compose.yml << 'WGEASY_COMPOSE'
|
|
name: wg-easy
|
|
|
|
services:
|
|
wg-easy:
|
|
image: ghcr.io/wg-easy/wg-easy:latest
|
|
container_name: wg-easy
|
|
hostname: wg-easy
|
|
restart: unless-stopped
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- SYS_MODULE
|
|
sysctls:
|
|
- net.ipv4.ip_forward=1
|
|
- net.ipv4.conf.all.src_valid_mark=1
|
|
environment:
|
|
- WG_HOST=${WG_HOST}
|
|
- PASSWORD=${WG_PASSWORD}
|
|
- WG_DEFAULT_DNS=1.1.1.1
|
|
volumes:
|
|
- ./config:/etc/wireguard
|
|
ports:
|
|
- "51820:51820/udp"
|
|
- "51821:51821/tcp"
|
|
WGEASY_COMPOSE
|
|
|
|
cat > .env << WGEASY_ENV
|
|
WG_HOST=$WG_HOST
|
|
WG_PASSWORD=$WG_PASSWORD
|
|
WGEASY_ENV
|
|
|
|
mkdir -p config
|
|
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$WGEASY_DIR"
|
|
log_success "wg-easy configured at $WGEASY_DIR"
|
|
|
|
configure_caddy_for_service "wg-easy" "51821" "vpn"
|
|
|
|
write_readme "$WGEASY_DIR" << MD
|
|
# wg-easy
|
|
|
|
WireGuard VPN with a web UI for managing clients, generating QR codes,
|
|
and monitoring connections.
|
|
|
|
- Web UI: http://localhost:51821
|
|
- VPN: UDP port 51820 (forward this on your router)
|
|
- Password: stored in \`.env\` (\`WG_PASSWORD\`)
|
|
- VPN host: \`$WG_HOST\` (update \`WG_HOST\` in .env if your IP changes)
|
|
- Config: \`config/\`
|
|
|
|
## Manage
|
|
\`\`\`bash
|
|
cd $WGEASY_DIR
|
|
docker compose up -d # start
|
|
docker compose down # stop
|
|
docker compose logs -f # logs
|
|
docker compose pull && docker compose up -d # update
|
|
\`\`\`
|
|
|
|
## Router setup
|
|
Forward **UDP port 51820** to this server's LAN IP for external VPN access.
|
|
|
|
## Adding clients
|
|
Open http://localhost:51821, log in with your password, click "+ New Client",
|
|
download or scan the QR code with the WireGuard app.
|
|
MD
|
|
|
|
local START_WGEASY=""
|
|
prompt_yn "Start wg-easy now? (y/n):" "y" START_WGEASY
|
|
if [ "$START_WGEASY" = "y" ] || [ "$START_WGEASY" = "Y" ]; then
|
|
docker compose up -d && log_success "wg-easy started" || log_warning "Failed to start — check: docker compose logs"
|
|
fi
|
|
|
|
echo ""
|
|
echo " Web UI: http://localhost:51821"
|
|
echo " Password: $WG_PASSWORD (saved in .env)"
|
|
echo " Router: forward UDP 51820 → this server for external VPN access"
|
|
echo ""
|
|
}
|