docker-compose.yaml

services:
  dnscrypt-proxy:
    image: klutchell/dnscrypt-proxy:latest
    container_name: dnscrypt-proxy
    hostname: dnscrypt-proxy
    restart: unless-stopped
    environment:
      TZ: "America/Toronto"
    volumes:
      - ./dnscrypt-proxy/config:/config:rw
      - ./dnscrypt-proxy/log:/log:rw
    expose:
      - "5350"
    networks:
      wirehole:
        ipv4_address: 10.2.0.200

  pihole:
    image: pihole/pihole:latest
    container_name: pihole
    hostname: pihole
    restart: unless-stopped
    depends_on:
      - dnscrypt-proxy
    environment:
      TZ: "America/Toronto"
      FTLCONF_webserver_api_password: "${PIHOLE_WEB_PASSWORD}"
      FTLCONF_dns_listeningMode: "all"
      FTLCONF_dns_upstreams: "10.2.0.200#5350; 10.2.0.200#5350"
      ServerIP: 10.2.0.100
    volumes:
      - ./pihole/etc-pihole:/etc/pihole
      - ./pihole/etc-dnsmasq.d:/etc/dnsmasq.d
      - ./pihole/var-log:/var/log/pihole
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "80:80"
      - "443:443"
    networks:
      wirehole:
        ipv4_address: 10.2.0.100
    cap_add:
      # Required if you are using Pi-hole as your NTP client to be able to set the host's system time
      - SYS_TIME
      # Optional, if Pi-hole should get some more processing time
      - SYS_NICE
      # Optional, if you are using Pi-Hole as your DHCP server
      #- NET_ADMIN

  wg-easy:
    image: ghcr.io/wg-easy/wg-easy:15
    container_name: wg-easy
    restart: unless-stopped
    depends_on:
      - dnscrypt-proxy
      - pihole
    environment:
      #WG_HOST: "${WG_HOST}"
      #PASSWORD: "${WG_PASSWORD}"
      #WG_PORT: 51820
      #WG_DEFAULT_ADDRESS: 10.6.0.x
      #WG_DEFAULT_DNS: 10.2.0.100
      #WG_ALLOWED_IPS: 10.2.0.0/24,192.168.68.0/22
      INSECURE: true
    volumes:
      - ./wireguard/etc_wireguard:/etc/wireguard
      - /lib/modules:/lib/modules:ro
    ports:
      - "51820:51820/udp"
      - "51821:51821/tcp"
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
    dns:
      - 10.2.0.100
    networks:
      wirehole:
        ipv4_address: 10.2.0.3

  watchtower:
    image: containrrr/watchtower:latest
    container_name: watchtower
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    command: --cleanup --interval 3600

  dockerproxy:
    image: ghcr.io/tecnativa/docker-socket-proxy:latest
    container_name: dockerproxy
    restart: unless-stopped
    ports:
      - 2375:2375
    environment:
      CONTAINERS: 1 # Allow access to viewing containers
      SERVICES: 1 # Allow access to viewing services (necessary when using Docker Swarm)
      TASKS: 1 # Allow access to viewing tasks (necessary when using Docker Swarm)
      POST: 0 # Disallow any POST operations (effectively read-only)
      INFO: 1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro # Mounted as read-only

networks:
  wirehole:
    name: wirehole
    ipam:
      config:
        - subnet: 10.2.0.0/24