services:
  wg2outline:
    build: .
    container_name: wg2outline
    privileged: true
    ports:
      - "51821:51820/udp"
    environment:
      OUTLINE_TRANSPORT: "${OUTLINE_TRANSPORT}"
      INTERNAL_SUBNET: "${INTERNAL_SUBNET}"
      PUID: 1000
      PGID: 1000
      TZ: Etc/UTC
      SERVERURL: ${SERVERURL}
      SERVERPORT: 51821
      PEERS: ${PEERS:-1}
      PEERDNS: 1.1.1.1
      PERSISTENTKEEPALIVE_PEERS: 25
      MTU: 1280
      LOG_CONFS: true
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN
      - SYS_MODULE
    devices:
      - /dev/net/tun:/dev/net/tun
    security_opt:
      - apparmor:unconfined
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv4.conf.all.rp_filter=0
      - net.ipv4.conf.default.rp_filter=0
      - net.ipv6.conf.all.forwarding=0
      - net.ipv6.conf.all.disable_ipv6=1
      - net.ipv6.conf.default.disable_ipv6=1
    volumes:
      - ./wireguard-config:/config
      - /lib/modules:/lib/modules:ro
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "5"