181 lines
No EOL
5.2 KiB
Markdown
181 lines
No EOL
5.2 KiB
Markdown
---
|
|
title: Anleitung zur Erstellung eines Docker-Containers für wg-easy-extended und Pihole
|
|
description:
|
|
published: true
|
|
date: 2024-06-17T10:46:46.294Z
|
|
tags:
|
|
editor: markdown
|
|
dateCreated: 2024-06-17T10:37:08.232Z
|
|
---
|
|
|
|
# Anleitung zur Erstellung eines Docker-Containers für wg-easy-extended
|
|
|
|
## Schritt 1: Docker Compose-Datei erstellen
|
|
|
|
Erstellen Sie eine Datei mit dem Namen `docker-compose.yml` und fügen Sie den folgenden Inhalt ein:
|
|
|
|
```yaml
|
|
version: "3"
|
|
|
|
# More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/
|
|
services:
|
|
pihole:
|
|
container_name: pihole
|
|
#image: pihole/pihole:latest
|
|
image: cbcrowe/pihole-unbound:latest
|
|
# For DHCP it is recommended to remove these ports and instead add: network_mode: "host"
|
|
ports:
|
|
- "127.0.0.1:53:53/tcp"
|
|
- "127.0.0.1:53:53/udp"
|
|
#- "67:67/udp" # Only required if you are using Pi-hole as your DHCP server
|
|
#- "127.0.0.1:8084:80/tcp"
|
|
environment:
|
|
ServerIP: 10.8.1.3
|
|
TZ: 'Europe/Berlin'
|
|
WEBPASSWORD: '${PASSWORT}'
|
|
REV_SERVER: 'false'
|
|
DNS1: 127.0.0.1#5335 # Hardcoded to our Unbound server
|
|
DNS2: 127.0.0.1#5335 # Hardcoded to our Unbound server
|
|
DNSSEC: 'true' # Enable DNSSEC
|
|
VIRTUAL_HOST: pihole.${WEBSEITE}
|
|
VIRTUAL_PORT: 80
|
|
LETSENCRYPT_HOST: pihole.${WEBSEITE}
|
|
LETSENCRYPT_EMAIL: admin@${WEBSEITE}
|
|
|
|
# Volumes store your data between container upgrades
|
|
volumes:
|
|
- './etc-pihole:/etc/pihole'
|
|
- './etc-dnsmasq.d:/etc/dnsmasq.d'
|
|
# https://github.com/pi-hole/docker-pi-hole#note-on-capabilities
|
|
cap_add:
|
|
- NET_ADMIN # Required if you are using Pi-hole as your DHCP server, else not needed
|
|
restart: always
|
|
|
|
labels:
|
|
- "com.centurylinklabs.watchtower.enable=true"
|
|
- flame.type=application
|
|
- flame.name=Pi-hole
|
|
- flame.url=https://pihole.${WEBSEITE}/admin/
|
|
- flame.icon=dns
|
|
|
|
networks:
|
|
proxy:
|
|
edge-tier:
|
|
dns:
|
|
ipv4_address: 172.28.0.2
|
|
wg-easy:
|
|
ipv4_address: 10.8.1.3
|
|
|
|
wg-easy-extended:
|
|
container_name: wg-easy-extended
|
|
environment:
|
|
WG_HOST: brothertec.eu
|
|
PASSWORD: ${PASSWORT}
|
|
#- WG_DEFAULT_DNS=1.1.1.1
|
|
WG_DEFAULT_DNS: 10.8.1.3
|
|
WG_DEFAULT_ADDRESS: 10.8.0.x
|
|
# - WG_MTU=1420
|
|
WG_PERSISTENT_KEEPALIVE: 25
|
|
WG_ALLOWED_IPS: 10.8.0.0/24,10.8.1.3
|
|
WG_POST_UP: >
|
|
iptables-legacy -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE;
|
|
iptables-legacy -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth1 -j MASQUERADE;
|
|
iptables-legacy -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth2 -j MASQUERADE;
|
|
iptables-legacy -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth3 -j MASQUERADE;
|
|
iptables-legacy -A INPUT -p udp -m udp --dport 51820 -j ACCEPT;
|
|
iptables-legacy -A FORWARD -i wg0 -j ACCEPT;
|
|
iptables-legacy -A FORWARD -o wg0 -j ACCEPT;
|
|
# - WG_PRE_UP=echo "Pre Up" > /etc/wireguard/pre-up.txt
|
|
# - WG_POST_UP=echo "Post Up" > /etc/wireguard/post-up.txt
|
|
# - WG_PRE_DOWN=echo "Pre Down" > /etc/wireguard/pre-down.txt
|
|
# - WG_POST_DOWN=echo "Post Down" > /etc/wireguard/post-down.txt
|
|
|
|
VIRTUAL_HOST: vpn.${WEBSEITE}
|
|
VIRTUAL_PORT: 51821
|
|
LETSENCRYPT_HOST: vpn.${WEBSEITE}
|
|
LETSENCRYPT_EMAIL: admin@${WEBSEITE}
|
|
volumes:
|
|
- ./wg-easy:/etc/wireguard
|
|
ports:
|
|
- 51820:51820/udp
|
|
#- 51821:51821/tcp
|
|
#- 9586:9586/tcp
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- SYS_MODULE
|
|
sysctls:
|
|
- net.ipv4.conf.all.src_valid_mark=1
|
|
- net.ipv4.ip_forward=1
|
|
restart: unless-stopped
|
|
image: ghcr.io/tolkonepiu/wg-easy-extended
|
|
|
|
networks:
|
|
proxy:
|
|
edge-tier:
|
|
dns:
|
|
ipv4_address: 172.28.0.3
|
|
wg-easy:
|
|
ipv4_address: 10.8.1.2
|
|
|
|
labels:
|
|
- "com.centurylinklabs.watchtower.enable=true"
|
|
- flame.type=application
|
|
- flame.name=Wireguard
|
|
- flame.url=https://vpn.${WEBSEITE}
|
|
- flame.icon=vpn
|
|
|
|
networks:
|
|
proxy:
|
|
name: nginx-proxy
|
|
external: true
|
|
edge-tier:
|
|
name: edge
|
|
external: true
|
|
dns:
|
|
name: dns
|
|
external: true
|
|
wg-easy:
|
|
ipam:
|
|
config:
|
|
- subnet: 10.8.1.0/24
|
|
|
|
|
|
```
|
|
|
|
## Schritt 2: Erstellen des DNS Netzwerkes
|
|
|
|
~~~
|
|
docker network create --driver=bridge --subnet=172.28.0.0/16 dns
|
|
~~~
|
|
|
|
## Schritt 3: Docker-Container starten
|
|
|
|
Navigieren Sie im Terminal zum Verzeichnis, in dem sich die `docker-compose.yml`-Datei befindet, und führen Sie den folgenden Befehl aus, um den Docker-Container zu starten:
|
|
|
|
```bash
|
|
docker-compose up -d
|
|
```
|
|
|
|
Der Parameter `-d` startet den Container im Hintergrund.
|
|
|
|
Nachdem der Container gestartet wurde, ist Ihr wg-easy-extended-Dienst einsatzbereit.
|
|
|
|
## Quellen
|
|
|
|
https://github.com/pi-hole/docker-pi-hole
|
|
|
|
https://goneuland.de/pi-hole-mit-docker-compose-und-traefik-installieren/
|
|
|
|
https://github.com/wg-easy/wg-easy/wiki/Using-WireGuard-Easy-with-Pi-Hole
|
|
|
|
https://github.com/wg-easy/wg-easy/issues/291
|
|
|
|
https://github.com/tolkonepiu/wg-easy-extended
|
|
|
|
https://hub.docker.com/r/cbcrowe/pihole-unbound
|
|
|
|
https://docs.pi-hole.net/guides/dns/unbound/
|
|
|
|
https://www.cloudflare.com/de-de/learning/dns/dns-server-types/
|
|
|
|
https://www.kuketz-blog.de/pi-hole-einrichtung-und-konfiguration-mit-unbound-adblocker-teil2/ |