claude generated first pass

docker-compose.yml

@@ -0,0 +1,57 @@
+# RackNerd VPN hub — OpenVPN (road warriors) + Duo Auth Proxy + Unbound.
+#
+# All services use network_mode: host on purpose:
+#   * openvpn's tun0 must live in the host netns so the kernel can route
+#     tun0 <-> wg0 directly (wg0 is host-level wg-quick).
+#   * unbound/duo bind ONLY loopback + tunnel IPs (enforced in their own
+#     configs), so host networking exposes nothing on the public IP.
+# Nothing here publishes ports; the host firewall (host/rules.v4.template)
+# is the single source of truth for what is reachable from where.
+
+name: racknerd-vpnhub
+
+services:
+  unbound:
+    build: ./unbound
+    container_name: unbound
+    network_mode: host
+    env_file: .env
+    volumes:
+      - ./unbound/unbound.conf.template:/etc/unbound/unbound.conf.template:ro
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "dig", "@127.0.0.1", "+time=3", "+tries=1", "cloudflare.com"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+
+  duo-authproxy:
+    build: ./duo-authproxy
+    container_name: duo-authproxy
+    network_mode: host          # RADIUS listener bound to 127.0.0.1:1812 only
+    env_file: .env
+    volumes:
+      # AD LDAPS issuing-CA chain, exported from your CA (see certs/README.md)
+      - ./duo-authproxy/certs:/certs:ro
+    restart: unless-stopped
+
+  openvpn:
+    build: ./openvpn
+    container_name: openvpn
+    network_mode: host          # creates tun0 in the host netns
+    cap_add:
+      - NET_ADMIN
+    devices:
+      - /dev/net/tun
+    env_file: .env
+    volumes:
+      - ./openvpn/server.conf:/etc/openvpn/server.conf:ro
+      - ./openvpn/pki:/etc/openvpn/pki:ro
+      - openvpn-state:/var/lib/openvpn
+    depends_on:
+      - duo-authproxy
+      - unbound
+    restart: unless-stopped
+
+volumes:
+  openvpn-state: