services:
  # WG-EASY - WireGuard Easy
  wg-easy:
    image: ghcr.io/wg-easy/wg-easy
    container_name: wg-easy
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    profiles: ["core", "all"]
    networks:
      - default
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
    ports:
      - "51820:51820/udp"
      - "$WGEASY_PORT:51821/tcp" # WebUI
    volumes:
      - $DOCKERDIR/appdata/wireguard:/etc/wireguard
    environment:
      - WG_HOST=SUBDOMAIN-PLACEHOLDER.$DOMAINNAME_1
      - PASSWORD_HASH=WG-EASY-PASSWORD-HASH-PLACEHOLDER
      - WG_DEFAULT_ADDRESS=$WGEASY_DEFAULT_ADDRESS
      - WG_DEFAULT_DNS=$WGEASY_DEFAULT_DNS
      - WG_ALLOWED_IPS=$WGEASY_ALLOWED_IPS
      - UI_TRAFFIC_STATS=true
      - UI_CHART_TYPE=3
      # - WG_PRE_UP=echo "Pre Up" > /etc/wireguard/pre-up.txt
      # - WG_POST_UP=echo "Post Up" > /etc/wireguard/post-up.txt
      # - WG_PRE_DOWN=echo "Pre Down" > /etc/wireguard/pre-down.txt
      # - WG_POST_DOWN=echo "Post Down" > /etc/wireguard/post-down.txt
    # DOCKER-LABELS-PLACEHOLDER