wireguard
diff --git a/apps/wireguard/install.yaml b/apps/wireguard/install.yaml
new file mode 100644
index 0000000..5864424
--- /dev/null
+++ b/apps/wireguard/install.yaml
@@ -0,0 +1,115 @@
+kind: Secret
+apiVersion: v1
+metadata:
+ name: wg-secret
+ namespace: wireguard
+type: Opaque
+data:
+ # Generate and encode the server private key: `wg genkey | base64`
+ privatekey: Z0hnaVdNdDJjbzhKQ2JyT05HWnlLTEFpYnVKaUJRdFlUZzJ0RlJkS1NrST0K
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+ name: wg-configmap
+ namespace: wireguard
+data:
+ wg0.conf: |
+ [Interface]
+ Address = 10.0.0.1/24
+ ListenPort = 51820
+ PostUp = wg set wg0 private-key /etc/wireguard/privatekey; iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
+ PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
+ # PostUp = wg set wg0 private-key /etc/wireguard/privatekey && iptables -t nat -A POSTROUTING -s 0.0.0.0/0 -o eth0 -j MASQUERADE
+ # PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
+ # PostUp = wg set wg0 private-key /etc/wireguard/privatekey && iptables -A FORWARD -i %i -j ACCEPT && iptables -A FORWARD -o %i -j ACCEPT && iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE
+ # PostDown = iptables -D FORWARD -i %i -j ACCEPT && iptables -D FORWARD -o %i -j ACCEPT && iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
+ DNS = 8.8.8.8
+
+ [Peer]
+ PublicKey = ES2NAzBw/ZVWu14blA2/UiQBVfeuxZpstbZbkEAuzUo=
+ AllowedIPs = 10.0.0.2/24
+---
+kind: Service
+apiVersion: v1
+metadata:
+ name: wireguard
+ namespace: wireguard
+ labels:
+ app: wireguard
+spec:
+ type: LoadBalancer
+ ports:
+ - name: wg
+ protocol: UDP
+ port: 51820
+ targetPort: 51820
+ selector:
+ app: wireguard
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: wireguard
+ namespace: wireguard
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: wireguard
+ template:
+ metadata:
+ labels:
+ app: wireguard
+ spec:
+ initContainers:
+ - name: sysctls
+ image: busybox
+ command:
+ - sh
+ - -c
+ - sysctl -w net.ipv4.ip_forward=1 && sysctl -w net.ipv4.conf.all.forwarding=1
+ securityContext:
+ capabilities:
+ add:
+ - NET_ADMIN
+ privileged: true
+ containers:
+ - name: wireguard
+ image: giolekva/wireguard:latest
+ command:
+ - sh
+ - -c
+ - echo "Public key '$(wg pubkey < /etc/wireguard/privatekey)'" && sysctl -w net.ipv4.ip_forward=1 && sysctl -w net.ipv4.conf.all.forwarding=1 && /entrypoint.sh
+ ports:
+ - containerPort: 51820
+ protocol: UDP
+ name: wireguard
+ env:
+ - name: LOG_LEVEL
+ value: debug
+ securityContext:
+ capabilities:
+ add:
+ - NET_ADMIN
+ privileged: true
+ resources:
+ requests:
+ memory: 64Mi
+ cpu: "100m"
+ limits:
+ memory: 256Mi
+ volumeMounts:
+ - name: cfgmap
+ mountPath: /etc/wireguard/wg0.conf
+ subPath: wg0.conf
+ - name: secret
+ mountPath: /etc/wireguard/privatekey
+ subPath: privatekey
+ volumes:
+ - name: cfgmap
+ configMap:
+ name: wg-configmap
+ - name: secret
+ secret:
+ secretName: wg-secret
\ No newline at end of file