Robert Syrnicki
3a9d18fcd5
wg-easy + Traefik docker-compose stack (Phase 1) plus a stdlib-only control-plane API for box registration, WireGuard peer provisioning via wg-easy, and per-box route publish/unpublish backed by Traefik's file provider (Phase 2, single-tenant mode). SQLite holds accounts/boxes/routes so a later multi-tenant shared instance is the same schema with more rows, not a reshape. wg-easy's actual REST API was verified against its source rather than assumed: it has no bearer-token auth (session-cookie login via POST /api/auth/password) and no way to accept an externally-generated public key (it always mints the keypair itself, private key included) — both corrected from the original plan during implementation.
36 lines
1.6 KiB
Text
36 lines
1.6 KiB
Text
# Which cert/tenancy strategy to run: "single" or "shared".
|
|
# See traefik/static/traefik.single.yml vs traefik.shared.yml.
|
|
GATEWAY_MODE=single
|
|
|
|
# The hostname (or IP, for a first local smoke test) wg-easy advertises to
|
|
# peers as the WireGuard endpoint. Must be reachable on udp/51820.
|
|
GATEWAY_PUBLIC_HOST=vpn.example.com
|
|
|
|
# bcrypt hash of the wg-easy admin UI password. Generate with:
|
|
# docker run --rm ghcr.io/wg-easy/wg-easy:14 node -e \
|
|
# "console.log(require('bcryptjs').hashSync(process.argv[1], 10))" 'your-password'
|
|
WG_EASY_PASSWORD_HASH=
|
|
|
|
# Credentials the control-plane uses to log into wg-easy's own admin API
|
|
# (POST /api/auth/password -> session cookie; wg-easy has no separate
|
|
# bearer-token auth). WG_EASY_ADMIN_PASSWORD is the PLAINTEXT password
|
|
# corresponding to WG_EASY_PASSWORD_HASH above — wg-easy only ever sees the
|
|
# hash, but the control-plane needs the plaintext to log in the same way a
|
|
# human would through the UI.
|
|
WG_EASY_ADMIN_USERNAME=admin
|
|
WG_EASY_ADMIN_PASSWORD=
|
|
|
|
# GATEWAY_MODE=single only: the one box token a single-tenant deployment
|
|
# accepts at /v1/boxes/register, skipping full account/registration-token
|
|
# issuance. Generate with: openssl rand -hex 32
|
|
GATEWAY_BOX_TOKEN=
|
|
|
|
# Bearer token required to create accounts via POST /v1/accounts.
|
|
# Only meaningful once account endpoints exist (Phase 2+); harmless to set
|
|
# now. Generate with: openssl rand -hex 32
|
|
GATEWAY_ADMIN_TOKEN=
|
|
|
|
# GATEWAY_MODE=shared only: base domain subdomains are issued under, and the
|
|
# DNS provider Traefik's DNS-01 challenge should use for the wildcard cert.
|
|
# See traefik/static/traefik.shared.yml.
|
|
GATEWAY_BASE_DOMAIN=boxes.example.com
|