version: "3.8"
services:
  wg-easy:
    image: ghcr.io/wg-easy/wg-easy:15
    container_name: wg-easy
    environment:
      # 在 v15 中，绝不能写 PASSWORD 和 WG_ 变量！仅保留以下两项基础运行设定：
      - INSECURE=true
      - DISABLE_IPV6=true
    volumes:
      - /opt/1panel/docker/compose/wg-easy/data:/etc/wireguard
      - /lib/modules:/lib/modules:ro
    ports:
      - "51820:51820/udp"
      - "51821:51821/tcp"
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
      # 底层彻底关闭 IPv6
      - net.ipv6.conf.all.disable_ipv6=1
    restart: unless-stopped

192.168.2.0/24

10.8.0.0/24

223.5.5.5

114.114.114.114

25

cat << 'EOF' > /opt/wg-route-auto.sh
#!/bin/bash
# 核心节点与路由参数
CONTAINER_NAME="wg-easy"
RELAY_IP="10.8.0.4/32"
TARGET_ROUTE="192.168.2.0/24"

inject_route() {
    # 等待几秒钟，确保 wg-easy 容器内部的网络接口已经完全初始化
    sleep 3
    PUBKEY=$(docker exec $CONTAINER_NAME wg show wg0 dump 2>/dev/null | awk -v ip="$RELAY_IP" '$4==ip {print $1}')
    if [ -n "$PUBKEY" ]; then
        # 注入局域网网段规则
        docker exec $CONTAINER_NAME wg set wg0 peer "$PUBKEY" allowed-ips "$RELAY_IP,$TARGET_ROUTE"
        # 写入底层 Linux 路由表
        docker exec $CONTAINER_NAME ip route add "$TARGET_ROUTE" dev wg0 2>/dev/null
        echo "$(date): Successfully injected routes for Star node"
    fi
}

# 脚本启动时先执行一次（应对服务器刚开机的情况）
inject_route

# 核心守护逻辑：利用 docker events 实时监听容器状态
# 只要监测到 wg-easy 发生了 start (启动/重启) 事件，就自动执行一次注入
docker events --filter "container=$CONTAINER_NAME" --filter 'event=start' --format '{{.Action}}' | while read event
do
    inject_route
done
EOF

chmod +x /opt/wg-route-auto.sh

cat << 'EOF' > /etc/systemd/system/wg-route-auto.service
[Unit]
Description=Auto Inject WireGuard Routes for wg-easy
After=docker.service
Requires=docker.service

[Service]
Type=simple
ExecStart=/bin/bash /opt/wg-route-auto.sh
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload

systemctl enable wg-route-auto.service

systemctl start wg-route-auto.service

docker exec wg-easy wg

docker exec wg-easy wg set wg0 peer IXxM5pkLUVU9c9rSzMimfu/TcwKNf35BH+a9nOItxjA= allowed-ips 10.8.0.4/32,192.168.2.0/24

docker exec wg-easy ip route add 192.168.2.0/24 dev wg0

[Interface]
PrivateKey = oKrMoX9aErj/MG4A4PR2tK5ZEAui2N2TtkgvXG8t+VE=
Address = 10.8.0.4/32
MTU = 1420
DNS = 223.5.5.5, 114.114.114.114

# --- 新增：流量伪装 (NAT)。让家里的设备能顺利把回包交还给 VPN 隧道 ---
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -j MASQUERADE

[Peer]
PublicKey = 5EOzqbZHUFna/uy2glMsb6bgrzmdoUbK8q70hvebO3E=
PresharedKey = Z1EKSCanblwI9FVDdChWDfR4vVl1tksHDqxn4lvP82s=
Endpoint = 140.245.127.223:51820

# --- 核心修改：为了防止家里服务器断网，这里必须把 192.168.2.0/24 删掉 ---
AllowedIPs = 10.8.0.0/24

# 全局已经有了，保持原样即可
PersistentKeepalive = 25

services:
  wireguard-client:
    image: lscr.io/linuxserver/wireguard:latest
    container_name: wg-client
    network_mode: host
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Asia/Shanghai
    volumes:
      - /opt/1panel/docker/compose/wg-client/config:/config
      - /lib/modules:/lib/modules:ro
    restart: unless-stopped