Run Wireguard, wg-easy and Nginx in a single docker compose file, using Traefik and configure SSL using letsencrypt. This post aims to improve on this wiki post by allowing you to run a website on port 443 rather than wg-easy.

Replace your-domain.com and yourpassword10000 and [email protected] with your domain, password and email, optionally also change the port for your wg-easy configuration using WG_HOST . You can access the wg-easy admin panel at https://your-domain.com:4748 .

If you would like to use the Traefik admin UI, uncomment the port 8080 and api. entries.

Save as docker-compose.yml and then run the command docker network create traefik_network followed by docker compose up -d . This will make the nginx folder to place your website files in as required.

services:
wg-easy:
labels:
# traefik
- "traefik.enable=true"
- "traefik.http.services.WireGuardService.loadbalancer.server.port=51821"
# http to https
- "traefik.http.routers.WireGuardRoute.service=WireGuardService"
# https
- "traefik.http.routers.WireGuardRouteSSL.service=WireGuardService"
- "traefik.http.routers.WireGuardRouteSSL.rule=Host(`your-domain.com`)"
- "traefik.http.routers.WireGuardRouteSSL.entrypoints=wireguardWGEasyPanel"
- "traefik.http.routers.WireGuardRouteSSL.tls.certresolver=MainCertResolver"
environment:
- WG_HOST=your-domain.com
- PASSWORD=yourpassword10000
- UI_TRAFFIC_STATS=true
- WG_HOST=4748
container_name: wg-easy
image: ghcr.io/wg-easy/wg-easy
networks:
- traefik_network
volumes:
- .:/etc/wireguard
ports:
- "51820:51820/udp"
restart: unless-stopped
cap_add:
- NET_ADMIN
- SYS_MODULE
sysctls:
- net.ipv4.ip_forward=1
- net.ipv4.conf.all.src_valid_mark=1
nginx:
image: nginx:latest
restart: unless-stopped
labels:
# traefik
- traefik.enable=true
- traefik.http.routers.nginx.rule=Host(`your-domain.com`)
- traefik.http.routers.nginx.entrypoints=websecure
- traefik.http.routers.nginx.tls=true
- traefik.http.routers.nginx.tls.certresolver=MainCertResolver
networks:
- traefik_network
volumes:
- ./nginx:/usr/share/nginx/html/:ro
traefik:
image: traefik:latest
restart: unless-stopped
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- traefik_letsencrypt_data:/letsencrypt
networks:
- traefik_network
ports:
- "80:80"
- "443:443"
- "4748:4748"
# - "8080:8080"
command:
- "--providers.docker"
- "--providers.docker=true"
# - "--api.dashboard=true"
# - "--api.insecure=true"
- "--providers.docker.exposedbydefault=false"
- "--providers.docker.network=traefik_network"
- "--entrypoints.web.address=:80"
- "--entrypoints.web.http.redirections.entryPoint.to=websecure"
- "--entrypoints.web.http.redirections.entryPoint.scheme=https"
- "--entrypoints.web.http.redirections.entrypoint.permanent=true"
- "--entrypoints.wireguardWGEasyPanel.address=:4748"
- "--entrypoints.websecure.address=:443"
- "--certificatesresolvers.MainCertResolver.acme.tlschallenge=true"
- "--certificatesresolvers.MainCertResolver.acme.email=youremail@example.com"
- "--certificatesresolvers.MainCertResolver.acme.storage=/letsencrypt/acme.json"
# - "--log.level=DEBUG"
networks:
traefik_network:
external: true
volumes:
traefik_letsencrypt_data:

You may also want to limit the administration portal to just IP whitelisted addresses, you can do this by adding the following to the wg-easy labels, replacing 1.2.3.4 with your IP address and adding any other required addresses using a comma to separate. You could also whitelist clients inside your container by adding the network range.

      - "traefik.http.middlewares.my-ipwhitelist.ipallowlist.sourcerange=1.2.3.4"
- "traefik.http.routers.WireGuardRouteSSL.middlewares=my-ipwhitelist@docker"

Please feel free to use this post under the terms of the original licence which you can access here.