basic.yaml

# Server + single IPv4 client - minimal configuration.
# Generate keys: docker run --rm ivenos/compwire:latest genkey  (once per node)
# .env: WG_SERVER_PRIV, WG_SERVER_PUB, WG_CLIENT_PRIV, WG_CLIENT_PUB, WG_SERVER_HOST
#       COMPWIRE_IMAGE overrides the image, e.g. for a locally built one.
# Usage: docker compose --env-file .env -f examples/basic.yaml up
#        (without --env-file, Compose looks for .env next to this file)
#        Both on one host demonstrates the handshake, not the tunnel.

name: compwire-basic

services:
  server:
    image: ${COMPWIRE_IMAGE:-ivenos/compwire:latest}
    network_mode: host
    cap_drop: [ALL]
    cap_add: [NET_ADMIN]
    environment:
      WG_ROLE: server
      WG_PRIVATE_KEY: ${WG_SERVER_PRIV}
      WG_ADDRESS: 10.77.0.1/24
      WG_PEER_CLIENT_PUBKEY: ${WG_CLIENT_PUB}
      WG_PEER_CLIENT_ALLOWED_IPS: 10.77.0.2/32
    restart: unless-stopped

  client:
    image: ${COMPWIRE_IMAGE:-ivenos/compwire:latest}
    network_mode: host
    cap_drop: [ALL]
    cap_add: [NET_ADMIN]
    depends_on:
      server:
        condition: service_healthy
    environment:
      WG_ROLE: client
      WG_IFACE: wg1
      WG_PRIVATE_KEY: ${WG_CLIENT_PRIV}
      # Must match the server's WG_PEER_CLIENT_ALLOWED_IPS.
      WG_ADDRESS: 10.77.0.2/32
      WG_SERVER_PUBKEY: ${WG_SERVER_PUB}
      WG_SERVER_ENDPOINT: ${WG_SERVER_HOST:-127.0.0.1}:51820
    restart: unless-stopped