wireguard
diff --git a/apps/wireguard/README.md b/apps/wireguard/README.md
new file mode 100644
index 0000000..5dce3df
--- /dev/null
+++ b/apps/wireguard/README.md
@@ -0,0 +1,201 @@
+# wireguard-go docker
+
+## Setup
+
+First of all you need a key pair for the server. Use the following command to generate the public and private keys:
+
+```bash
+# Generate privatekey
+docker run --rm -i masipcat/wireguard-go wg genkey > privatekey
+
+# Generate publickey from privatekey
+docker run --rm -i masipcat/wireguard-go wg genkey < privatekey > publickey
+```
+
+## Run server
+
+### Docker
+
+`docker-compose.yaml`
+```yaml
+version: '3.3'
+services:
+ wireguard:
+ image: masipcat/wireguard-go:latest
+ cap_add:
+ - NET_ADMIN
+ sysctls:
+ - net.ipv4.ip_forward=1
+ volumes:
+ - /dev/net/tun:/dev/net/tun
+ # Folder with 'publickey', 'privatekey' and 'wg0.conf'
+ - ./wireguard:/etc/wireguard
+ environment:
+ - WG_COLOR_MODE=always
+ - LOG_LEVEL=info
+ ports:
+ - 51820:51820/udp
+ # Uncomment the following line when 'AllowedIPs' is '0.0.0.0/0'
+ # privileged: true
+ restart: always
+```
+
+```
+docker-compose up -d
+```
+
+### Kubernetes
+
+Steps to deploy Wireguard-go to a k8s cluster:
+
+1. Set the `privatekey` for the wireguard server in the `Secret` object
+2. Add at least one peer in `wg0.conf`
+3. Run `kubectl apply -f wireguard.yaml` to deploy wireguard
+
+`wireguard.yaml`
+```yaml
+kind: Secret
+apiVersion: v1
+metadata:
+ name: wg-secret
+type: Opaque
+data:
+ # Generate and encode the server private key: `wg genkey | base64`
+ privatekey: REPLACE_WITH_BASE64_PRIVKEY
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+ name: wg-configmap
+data:
+ wg0.conf: |
+ [Interface]
+ Address = 10.33.0.1/24
+ ListenPort = 51820
+ PostUp = wg set wg0 private-key /etc/wireguard/privatekey && iptables -t nat -A POSTROUTING -s 10.33.0.0/24 -o eth0 -j MASQUERADE
+ PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
+
+ # [Peer]
+ # PublicKey =
+ # AllowedIPs = 10.33.0.2/32
+---
+kind: Service
+apiVersion: v1
+metadata:
+ name: wireguard
+ labels:
+ app: wireguard
+spec:
+ type: LoadBalancer
+ ports:
+ - name: wg
+ protocol: UDP
+ port: 51820
+ targetPort: 51820
+ selector:
+ app: wireguard
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: wireguard
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: wireguard
+ template:
+ metadata:
+ labels:
+ app: wireguard
+ spec:
+ initContainers:
+ - name: sysctls
+ image: busybox
+ command:
+ - sh
+ - -c
+ - sysctl -w net.ipv4.ip_forward=1 && sysctl -w net.ipv4.conf.all.forwarding=1
+ securityContext:
+ capabilities:
+ add:
+ - NET_ADMIN
+ privileged: true
+ containers:
+ - name: wireguard
+ image: masipcat/wireguard-go:latest
+ command:
+ - sh
+ - -c
+ - echo "Public key '$(wg pubkey < /etc/wireguard/privatekey)'" && /entrypoint.sh
+ ports:
+ - containerPort: 51820
+ protocol: UDP
+ name: wireguard
+ env:
+ - name: LOG_LEVEL
+ value: info
+ securityContext:
+ capabilities:
+ add:
+ - NET_ADMIN
+ privileged: true
+ resources:
+ requests:
+ memory: 64Mi
+ cpu: "100m"
+ limits:
+ memory: 256Mi
+ volumeMounts:
+ - name: cfgmap
+ mountPath: /etc/wireguard/wg0.conf
+ subPath: wg0.conf
+ - name: secret
+ mountPath: /etc/wireguard/privatekey
+ subPath: privatekey
+ volumes:
+ - name: cfgmap
+ configMap:
+ name: wg-configmap
+ - name: secret
+ secret:
+ secretName: wg-secret
+```
+
+## Client config examples
+
+### Basic
+
+`/etc/wireguard/wg0.conf`
+```conf
+[Interface]
+# Assign you an IP (that's not in use) and add it to server configmap
+Address = 10.33.0.2/32
+# generate private key using `wg genkey`
+PrivateKey = <your private key>
+
+[Peer]
+# Wireguard server public key
+PublicKey = AbC...XyZ=
+# LoadBalancer IP (replace with your LoadBalancer ip)
+Endpoint = 1.2.3.4:51820
+AllowedIPs = 0.0.0.0/0
+PersistentKeepalive = 25
+```
+
+### Basic + kube-dns
+
+(This example only works with OS that use `openresolv`)
+
+`/etc/wireguard/wg0.conf`
+```conf
+[Interface]
+...
+# Configure kube-dns ip address as dns resolver in you local machine (resolves names like 'your-service.default.svc.cluster.local')
+PostUp = printf "nameserver 10.90.0.5\nsearch default.svc.cluster.local svc.cluster.local cluster.local" | resolvconf -a %i
+
+[Peer]
+...
+# Change AllowedIPs to 10.0.0.0/8 if you only want to connect to k8s pods/services
+AllowedIPs = 10.0.0.0/8
+```