Root README now lets you choose between the two paths, with requirements,
the three ways to route Traefik to WireGuard peers (including the
bridge-network recipe verified on a live Traefik v3.7 + wg-easy v15),
box connection, troubleshooting and security notes. The starter-stack
README lists server, firewall and DNS requirements.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
wg-easy and Traefik now share one network namespace owned by a tiny
gateway-net container, so Traefik reaches box tunnel addresses directly.
This drops host networking, the host sysctl and firewall scripts, and
keeps wg-easy's admin UI on loopback. wg-easy v15 is set up unattended
via INIT_* variables, and deploy.sh needs only domain, hostnames and an
ACME email; secrets are generated.
Verified locally with a simulated box: register, tunnel, publish, and
restarts of wg-easy, Traefik and gateway-net.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Always build from the checkout (`up --build`, `pull_policy: build`)
instead of reusing a stale local image or pulling an old registry one.
- --render-only writes to rendered/ and no longer touches the live
Traefik dynamic directory; the route is installed after health check.
- Join the Traefik network via a generated docker-compose.override.yaml
rather than `docker network connect` after startup, which raced the
control-plane's startup call to wg-easy and was lost on recreate.
- Add --non-interactive, check the public HTTPS endpoint, and point the
closing instructions at Settings -> Gateway (the suggested
`furtka gateway connect` command doesn't exist).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
