58 lines
1.7 KiB
YAML
58 lines
1.7 KiB
YAML
# RackNerd VPN hub — OpenVPN (road warriors) + Duo Auth Proxy + Unbound.
|
|
#
|
|
# All services use network_mode: host on purpose:
|
|
# * openvpn's tun0 must live in the host netns so the kernel can route
|
|
# tun0 <-> wg0 directly (wg0 is host-level wg-quick).
|
|
# * unbound/duo bind ONLY loopback + tunnel IPs (enforced in their own
|
|
# configs), so host networking exposes nothing on the public IP.
|
|
# Nothing here publishes ports; the host firewall (host/rules.v4.template)
|
|
# is the single source of truth for what is reachable from where.
|
|
|
|
name: racknerd-vpnhub
|
|
|
|
services:
|
|
unbound:
|
|
build: ./unbound
|
|
container_name: unbound
|
|
network_mode: host
|
|
env_file: .env
|
|
volumes:
|
|
- ./unbound/unbound.conf.template:/etc/unbound/unbound.conf.template:ro
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD", "dig", "@127.0.0.1", "+time=3", "+tries=1", "cloudflare.com"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
|
|
duo-authproxy:
|
|
build: ./duo-authproxy
|
|
container_name: duo-authproxy
|
|
network_mode: host # RADIUS listener bound to 127.0.0.1:1812 only
|
|
env_file: .env
|
|
volumes:
|
|
# AD LDAPS issuing-CA chain, exported from your CA (see certs/README.md)
|
|
- ./duo-authproxy/certs:/certs:ro
|
|
restart: unless-stopped
|
|
|
|
openvpn:
|
|
build: ./openvpn
|
|
container_name: openvpn
|
|
network_mode: host # creates tun0 in the host netns
|
|
cap_add:
|
|
- NET_ADMIN
|
|
devices:
|
|
- /dev/net/tun
|
|
env_file: .env
|
|
volumes:
|
|
- ./openvpn/server.conf:/etc/openvpn/server.conf:ro
|
|
- ./openvpn/pki:/etc/openvpn/pki:ro
|
|
- openvpn-state:/var/lib/openvpn
|
|
depends_on:
|
|
- duo-authproxy
|
|
- unbound
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
openvpn-state:
|