migrate to one service

docker-compose.yml

@@ -1,19 +1,27 @@
 services:
-  outline-client:
+  wg2outline:
     build: .
-    container_name: outline-client
+    container_name: wg2outline
     privileged: true
-    # WireGuard UDP port is published from this service because
-    # the wireguard container shares this network namespace.
     ports:
       - "51821:51820/udp"
     environment:
-      # Replace with your Outline access key.
       OUTLINE_TRANSPORT: "${OUTLINE_TRANSPORT}"
       INTERNAL_SUBNET: "${INTERNAL_SUBNET}"
+      PUID: 1000
+      PGID: 1000
+      TZ: Etc/UTC
+      SERVERURL: ${SERVERURL}
+      SERVERPORT: 51821
+      PEERS: ${PEERS:-1}
+      PEERDNS: 1.1.1.1
+      PERSISTENTKEEPALIVE_PEERS: 25
+      MTU: 1280
+      LOG_CONFS: true
     cap_add:
       - NET_ADMIN
       - SYS_ADMIN
+      - SYS_MODULE
     devices:
       - /dev/net/tun:/dev/net/tun
     security_opt:
@@ -26,45 +34,9 @@ services:
       - net.ipv6.conf.all.forwarding=0
       - net.ipv6.conf.all.disable_ipv6=1
       - net.ipv6.conf.default.disable_ipv6=1
-    restart: unless-stopped
-    logging:
-      driver: json-file
-      options:
-        max-size: "50m"
-        max-file: "5"
-
-  wireguard:
-    image: lscr.io/linuxserver/wireguard:latest
-    container_name: wg2outline
-    depends_on:
-      - outline-client
-    # Important: share network stack with outline-client so all
-    # traffic from WG peers leaves through Outline routing/policy.
-    network_mode: "service:outline-client"
-    cap_add:
-      - NET_ADMIN
-      - SYS_MODULE
-    environment:
-      - PUID=1000
-      - PGID=1000
-      - TZ=Etc/UTC
-      # Public IP or domain of this server for peers.
-      - SERVERURL=${SERVERURL}
-      - SERVERPORT=51821
-      - PEERS=${PEERS:-1}
-      - PEERDNS=1.1.1.1
-      - INTERNAL_SUBNET=${INTERNAL_SUBNET}
-      # Keepalive helps on NAT/mobile networks.
-      - PERSISTENTKEEPALIVE_PEERS=25
-      # Optional for enterprise networks that block MTU/fragmentation.
-      - MTU=1280
-      # Firewall/NAT is handled by the host/namespace setup.
-      - LOG_CONFS=true
     volumes:
       - ./wireguard-config:/config
       - /lib/modules:/lib/modules:ro
-    sysctls:
-      - net.ipv4.conf.all.src_valid_mark=1
     restart: unless-stopped
     logging:
       driver: json-file