Robert Syrnicki
e240f071d5
Some checks failed
Build control-plane image / build-image (push) Has been cancelled
Restructure the deployment model: instead of bundling and owning its own Traefik + wg-easy, the control-plane now plugs into a Traefik and wg-easy the operator already runs (as sibling containers, or otherwise reachable). This avoids duplicating infra self-hosters commonly already have, and sidesteps having to run a second ACME/DNS setup entirely — the operator's own Traefik already has a working cert resolver. - New control_plane/wgeasy_v15.py: a wg-easy v15 REST client, verified live against a real running container (auth model, route shapes, and the new per-client PresharedKey all differ materially from v14's API). Threaded the preshared key through to the box side (furtka/wireguard.py in the furtka repo) so v15's handshake actually completes. - GATEWAY_CERT_RESOLVER is now a real env var instead of a GATEWAY_MODE- derived hardcoded "le", so it can mirror whatever resolver name (if any) the operator's own Traefik already has configured. - Root docker-compose.yaml/ops/deploy.sh: control-plane only now. deploy.sh asks how the operator's Traefik reaches it (same docker network, joined via `docker network connect`, or a separate host) instead of prompting for DNS-01 providers and port remaps single-parallel mode needed. - single-parallel mode is retired outright — nothing needs it once furtka-gateway doesn't own a second Traefik/wg-easy to remap ports for. - The old bundled stack (own Traefik+wg-easy, HTTP-01) moves to examples/starter-stack/ as the documented zero-infra on-ramp. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R3jVwAqESRjPdW9P9nvfem
71 lines
4 KiB
YAML
71 lines
4 KiB
YAML
services:
|
|
control-plane:
|
|
build: ./control_plane
|
|
# CI (.forgejo/workflows/build-image.yml) publishes this same build to
|
|
# the registry on every push to master, tagged `latest` plus the short
|
|
# commit sha. `docker compose up` builds fresh from `build:` above and
|
|
# tags the result as this name, ignoring this being a registry ref;
|
|
# `docker stack deploy` (Swarm ignores `build:` entirely, see the
|
|
# Swarm caveats in README.md) pulls it instead — no manual
|
|
# `docker build -t ... ./control_plane` step needed there anymore.
|
|
image: ${GATEWAY_CONTROL_PLANE_IMAGE:-forgejo.sourcegate.online/robert/furtka-gateway-control-plane:latest}
|
|
container_name: furtka-gateway-control-plane
|
|
environment:
|
|
- GATEWAY_MODE=${GATEWAY_MODE:-single}
|
|
- GATEWAY_STATE_DIR=/data
|
|
- GATEWAY_DYNAMIC_DIR=/dynamic
|
|
- GATEWAY_ADMIN_TOKEN=${GATEWAY_ADMIN_TOKEN}
|
|
- GATEWAY_BOX_TOKEN=${GATEWAY_BOX_TOKEN}
|
|
# Blank means no explicit resolver (`tls: {}`) — Traefik applies
|
|
# whatever default TLS is already configured on YOUR Traefik. Set
|
|
# this to your Traefik's certResolver name if it doesn't have one.
|
|
- GATEWAY_CERT_RESOLVER=${GATEWAY_CERT_RESOLVER:-}
|
|
# Your existing wg-easy's admin API — reachable at whatever
|
|
# host:port makes sense for your setup (a sibling container on the
|
|
# network this joins — see `networks:` below — or a real host:port
|
|
# if it's elsewhere). See the README's Prerequisites checklist for
|
|
# the network-reachability requirement this doesn't (can't)
|
|
# automate away.
|
|
- WG_EASY_URL=${WG_EASY_URL}
|
|
- WG_EASY_ADMIN_PASSWORD=${WG_EASY_ADMIN_PASSWORD}
|
|
# "14" (default) or "15" — these are different, incompatible APIs
|
|
# (see control_plane/wgeasy.py vs wgeasy_v15.py's module docstrings).
|
|
# Check which one your wg-easy image tag actually is.
|
|
- WG_EASY_API_VERSION=${WG_EASY_API_VERSION:-14}
|
|
# v15 only: the admin user's username (v14 has no username concept —
|
|
# see WG_EASY_ADMIN_PASSWORD above).
|
|
- WG_EASY_ADMIN_USERNAME=${WG_EASY_ADMIN_USERNAME:-}
|
|
# v15 only: restricts new clients' AllowedIPs to your wg-easy peer
|
|
# subnet (v15 defaults new clients to full-tunnel 0.0.0.0/0, ::/0
|
|
# otherwise — see wgeasy_v15.py's restrict_default_allowed_ips()).
|
|
- GATEWAY_WG_ALLOWED_IPS=${GATEWAY_WG_ALLOWED_IPS:-10.8.0.0/24}
|
|
volumes:
|
|
- control_plane_data:/data
|
|
# Bind-mount this at whatever host path YOUR Traefik's file provider
|
|
# already watches (or add a second `providers.file` directory to
|
|
# your Traefik's static config pointed at this same path — additive,
|
|
# doesn't touch your existing dynamic config). Default here is just
|
|
# a placeholder; ops/deploy.sh asks for the real path.
|
|
- ${GATEWAY_DYNAMIC_DIR_HOST:-./dynamic}:/dynamic
|
|
ports:
|
|
# Loopback-only by default. This is how a remote Furtka box reaches
|
|
# the registration API in the COMMON case (your own Traefik, on the
|
|
# network below, proxies to it — see
|
|
# traefik/dynamic/control-plane.yml.example) — a public bind here
|
|
# isn't needed. Only widen GATEWAY_CONTROL_PLANE_BIND if your
|
|
# Traefik genuinely can't join this container's docker network (a
|
|
# separate-host setup) — ops/deploy.sh flags the access-control
|
|
# implication of doing that when you choose it.
|
|
- "${GATEWAY_CONTROL_PLANE_BIND:-127.0.0.1:8090}:8090"
|
|
restart: unless-stopped
|
|
# No custom `networks:` here on purpose — this stays on the default
|
|
# bridge network compose creates unless you also run YOUR Traefik in
|
|
# this SAME compose project. To reach a Traefik running elsewhere (its
|
|
# own compose project, or your own homelab stack), ops/deploy.sh joins
|
|
# this container to your Traefik's existing docker network after
|
|
# `up` via `docker network connect` — no external-network dependency
|
|
# baked into this file, so it works whether or not that network
|
|
# exists yet at compose-up time.
|
|
|
|
volumes:
|
|
control_plane_data:
|