more yml-like environment format

.gitignore

@@ -0,0 +1,12 @@
+# Editor & OS
+.idea
+
+# Env file
+.env
+scripts/.env.vars
+
+wireguard/
+unbound/*
+etc-pihole/
+etc-dnsmasq.d/
+!unbound/unbound.conf

README.md

@@ -1,74 +1,36 @@
+## Fork difference
 
-## Prerequisites:
+Simple setup for personal usage
 
-- 💻 **Installed**: **docker** and **docker-compose**
-- ☁ If using a cloud provider:
-    - You need to allow ingress to port `51820`
+Requirements:
+* docker & docker compose [must be installed](https://www.digitalocean.com/community/tutorials/how-to-install-and-use-docker-compose-on-ubuntu-22-04)
 
-To get started all you need to do is clone the repository and spin up the containers.
+Fork peculiarities:
+* env vars usage
+* auto-generated .env for docker-compose
+* support user-defined vars via .env.vars file 
+* removed deprecations
+
+### Quickstart
 
 ```bash
-git clone https://github.com/IAmStoxe/wirehole.git
+git clone https://github.com/kamartem/wirehole.git
 cd wirehole
-docker-compose up
+cp ./scripts/.env.vars.example ./scripts/.env.vars
 ```
 
-Within the output of the terminal will be QR codes you can (if you choose) to setup it WireGuard on your phone.
+Edit .env.vars file due to your requirements, then
 
 ```bash
-wireguard    | **** Internal subnet is set to 10.6.0.0 ****
-wireguard    | **** Peer DNS servers will be set to 10.1.0.100 ****
-wireguard    | **** No found wg0.conf found (maybe an initial install), generating 1 server and 1 peer/client confs ****
-wireguard    | PEER 1 QR code:
-wireguard    | █████████████████████████████████████████████████████████████████
-wireguard    | █████████████████████████████████████████████████████████████████
-wireguard    | ████ ▄▄▄▄▄ █▀▀▀▄ ▀▀▀▀▄█ ██   ▄▀ ██ ██▄▀█    █▄▄█▀ ▄ ██ ▄▄▄▄▄ ████
-wireguard    | ████ █   █ █▀▄█▀█▄█▄██▀▄   ▀▀██▀▄█ ▀▄█  ▀ █▀▄█▄ ▄▄▄ ██ █   █ ████
-wireguard    | ████ █▄▄▄█ █▀█   ▀▀▄                               ▄██ █▄▄▄█ ████
-wireguard    | ████▄▄▄▄▄▄▄█   ▀ ▀   █                         █▄█▄▀ █▄▄▄▄▄▄▄████
-wireguard    | ████ ▄▄  █▄▄▄  ▄▀█▀▀▄    ▀█ ▀█  ▄  █▀▀▄▄██▄▄▀▀█▄ ██▀▀ █ █▄█ ▀████
-wireguard    | █████  ▄█ ▄  ▀▀█▄▄  █▀ ▀ ▀ ▄  ▄ ▀▄▀▀█ ██ ▀██▀   ▀ ▀▀   ▀  ▀▄ ████
-wireguard    | ████▀▀██  ▄▄▄ ██▀▄▄██▀ ██▀▄  ▀▀ █▄█   ▄ ▄█▄██   ▀▄▄█  █▀▀█ ▄▀████
-wireguard    | ████ ▄█▀█▀▄▄   ▄███ ▄█ ▀▀▀▀█ ▄█ ▀▀▀▀▀▄ █   █ ███▄ █ ▄▄▄▄▀▀▀ █████
-wireguard    | ████▀▄ ▀▀ ▄▄ ▄▄  █▀██    ▀▀▀▀▀  ▄  █▀▀██  ██▀   ▀█▄█▄█  ▄▄▀ ▀████
-wireguard    | ████   ▀█ ▄▄                                          █  ▀▀██████
-wireguard    | ███████  ▄▄█ █                                        ▄█▀█▀▀▄████
-wireguard    | ████ ▄  █▄▄▀  ▄   ▀▄ █ ▄██▀▀█▀   █▄▄█▀▄█▀█▄ █ ▀▄█ ▄█ ▀   █  █████
-wireguard    | ████▄██▀█▄▄ ▀ ▄▀                       ▀▄  ▄█ ▀▄  █▀ ▀██▀▄███████
-wireguard    | ████ ▀█  ▄▄▄ ██▀███▄█▄█ █▄█▀ ▀ ▄▄▄ ▀▀  ▀▄ ▀▀█   █ █  ▄▄▄   ▄▀████
-wireguard    | ████▄██  █▄█  █                                          ▀▀ ▀████
-wireguard    | █████▀█▄▄▄▄▄ █▄ ▀▄ ██  ██▀ ▄ █▄ ▄▄▄▀ ▀▄▀█  █▀ █▄ ▄ ▄▄▄  ▄ ▀▄█████
-wireguard    | █████▀▄▀  ▄▄█▄▀ ██▄▄▄    █▀  ██    ██ █▄   ██▄ ▄▀█▄██▀▄█   █▀████
-wireguard    | ████▄   ▀ ▄ ▀ ▀▀▀▀▀▀█▀██▀ █  █▀█▀███ ▀▄█  █▄ █     ▀▀█▀██▀ ▄█████
-wireguard    | ████ ▀ ▄   ██▄ ▀▀▀▄▀█  ▀▀▄ ▄ ▄  █▀▀▄█ ▄█▄▀█▄█▀ ▄▀█▄▀ ▀▀▀ ▀▀ ▀████
-wireguard    | ███████ ▄█▄  ▀█▄▄  ▀█ █▀ █▀▄ ▄ ▀▄█▄▄█▀▄█▄▄▄▄█▀ ▀█ █▀  ▄ ██▀▄█████
-wireguard    | ████▀█ █▀ ▄                                             █ ▄▀█████
-wireguard    | ████▀▄ ▄▄█▄▄  ▄ ▄██▄ ▀ █ ▀ ▄▄█▀▀ ▄ ▀▀▄█▀▄██▀▀ ▄   ▄▄▄▄▀▀▄▀▀▀ ████
-wireguard    | ████ ▀▄▄▀▀▄▀▀▀▄ ▄ █▄▄▀ ██▀▄▀ █▄██▀▀▄█▄▄█ ████▄ ▀█▄█▀▄▀ ▀▄ ▀ █████
-wireguard    | ████ ▀ ▀▀▄▄ ▄ █▄ ▄ ██ ▄▀█▄▄  ▄ ▄ █▄▀ ▄▄▀██▄▀▀██▀▀▄▄ ▄   ██ ▄▀████
-wireguard    | ██████████▄█▀▀█ ▄█ █▄▄ ▀▄▀█▀▀  ▄▄▄ ▀█▀█ ▄▀█▀█▀▀ ██▄▀ ▄▄▄ ▄██▄████
-wireguard    | ████ ▄▄▄▄▄ █▄▄▄█▀▄█▀██ ▄ ▀█ ▀  █▄█ ▀▀█▄ ██▄█ ▀▄ ▀█▄▄ █▄█    █████
-wireguard    | ████ █   █ █  ▄▄ ▄█   ▄▄█ █▀   ▄ ▄  █ ▄█▄▄█ █▀ ▄████ ▄▄  ▀▀▄▄████
-wireguard    | ████ █▄▄▄█ █ ▀ ▄▄█ ▄ ▀▀▄██▄▀█▀█ █▀█▀▀▀▄   ▄ █▀▀▄▀ ▄▀███▀██▀██████
-wireguard    | ████▄▄▄▄▄▄▄█▄██▄▄█▄▄▄▄▄██▄█▄▄▄█▄█▄█▄▄▄▄█▄▄▄█████▄▄█▄█▄▄████▄█████
-wireguard    | █████████████████████████████████████████████████████████████████
-wireguard    | █████████████████████████████████████████████████████████████████
-wireguard    | [cont-init.d] 30-config: exited 0.
-wireguard    | [cont-init.d] 99-custom-scripts: executing...
-wireguard    | [custom-init] no custom files found exiting...
-wireguard    | [cont-init.d] 99-custom-scripts: exited 0.
-wireguard    | [cont-init.d] done.
-wireguard    | [services.d] starting services
+./scripts/run.sh
 ```
 
-## Recommended configuration / Split tunnel:
-
-Modify your wireguard client `AllowedIps` to `10.1.0.0/24` to only tunnel the web panel and DNS traffic.
+---
 
-## Access PiHole
+Helped?
 
-While connected to WireGuard, navigate to http://10.1.0.100/admin
+<a href="https://www.buymeacoffee.com/kamartem" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/v2/default-orange.png" alt="Buy Me A Coffee" style="height: 60px !important;width: 217px !important;" ></a>
 
-*The password (unless you set it in `docker-compose.yml`) is blank.*
+---
 
-![](https://i.imgur.com/hlHL6VA.png)
+For full documentation & creds please visit [original repo](https://github.com/IAmStoxe/wirehole)

docker-compose.yml

@@ -1,81 +1,77 @@
 version: "3"
 
 networks:
-  piguard:
+  private_network:
     ipam:
       driver: default
       config:
-        - subnet: 10.1.0.0/24
+        - subnet: 10.2.0.0/24
+
 services:
+  unbound:
+    image: mvance/unbound:1.12.0
+    container_name: unbound
+    hostname: unbound
+    restart: unless-stopped
+    volumes:
+      - "./unbound:/opt/unbound/etc/unbound/"
+    networks:
+      private_network:
+        ipv4_address: 10.2.0.200
+
   wireguard:
-    depends_on: [unbound]
-    privileged: false
-    image: linuxserver/wireguard
+    image: linuxserver/wireguard:latest
     container_name: wireguard
+    depends_on: [unbound, pihole]
     cap_add:
       - NET_ADMIN
       - SYS_MODULE
     environment:
-      - PUID=1000
-      - PGID=1000
-      - TZ=America/Los_Angeles
-      # - SERVERURL=wireguard.domain.com #optional
-      - SERVERPORT=5555 #optional
-      - PEERS=1 #optional
-      - PEERDNS=10.1.0.100 # Set it to point to pihole
-      - INTERNAL_SUBNET=10.6.0.0 #optional
+      PUID: 1000
+      PGID: 1000
+      TZ: "${TIMEZONE}"
+      SERVERPORT: 51820
+      #- SERVERURL=my.ddns.net #optional - For use with DDNS (Uncomment to use)
+      PEERS: "${PEERS}"
+      PEERDNS: 10.2.0.100 # Set it to point to pihole
+      INTERNAL_SUBNET: 10.6.0.0
     volumes:
       - ./wireguard:/config
       - /lib/modules:/lib/modules
     ports:
-      - 5555:51820/udp
+      - "51820:51820/udp"
+    dns:
+      - 10.2.0.100 # Points to pihole
+      - 10.2.0.200 # Points to unbound
     sysctls:
       - net.ipv4.conf.all.src_valid_mark=1
     restart: unless-stopped
     networks:
-      piguard:
-        ipv4_address: 10.1.0.3
-
-  unbound:
-    container_name: unbound
-    privileged: false
-    volumes:
-      - "./unbound:/opt/unbound/etc/unbound/"
-    # ports:
-    #   - "53:53/tcp"
-    #   - "53:53/udp"
-    restart: unless-stopped
-    image: "mvance/unbound:latest"
-    networks:
-      piguard:
-        ipv4_address: 10.1.0.200
+      private_network:
+        ipv4_address: 10.2.0.3
 
   pihole:
-    depends_on: [unbound]
-    container_name: pihole
     image: pihole/pihole:latest
-    privileged: false
-    ports:
-      - "53:53/tcp"
-      - "53:53/udp"
-      # - "67:67/udp" # Uncomment for pihole dhcp
-      - "80:80/tcp"
-      - "443:443/tcp"
+    container_name: pihole
+    hostname: pihole
+    depends_on: [unbound]
+    restart: unless-stopped
+    dns:
+      - 127.0.0.1
+      - 10.2.0.200 # Points to unbound
     environment:
-      TZ: "America/Los_Angeles"
-      WEBPASSWORD: ''
-      ServerIP: 10.1.0.100
-      DNS1: 10.1.0.200
-      DNS2: 10.1.0.200
-    # Volumes store your data between container upgrades
+      TZ: "${TIMEZONE}"
+      WEBPASSWORD: "${PIHOLE_PASSWORD}"
+      ServerIP: 10.2.0.100 # Internal IP of pihole
+      DNS1: 10.2.0.200 # Unbound IP
+      DNS2: 10.2.0.200 # If we don't specify two, it will auto pick google.
     volumes:
       - "./etc-pihole/:/etc/pihole/"
       - "./etc-dnsmasq.d/:/etc/dnsmasq.d/"
     # Recommended but not required (DHCP needs NET_ADMIN)
     #   https://github.com/pi-hole/docker-pi-hole#note-on-capabilities
     cap_add:
       - NET_ADMIN
-    restart: unless-stopped
     networks:
-      piguard:
-        ipv4_address: 10.1.0.100
+      private_network:
+        ipv4_address: 10.2.0.100

scripts/.env.template

@@ -0,0 +1,7 @@
+TIMEZONE=${TIMEZONE:-Europe/Moscow}
+
+# PhiHole web admin password
+PIHOLE_PASSWORD=${PIHOLE_PASSWORD:-pihole_default_password}
+
+# How many peers to generate for you (clients). Just digit or comma-separated aliases
+PEERS=${PEERS:-1}

scripts/.env.vars.example

@@ -0,0 +1,3 @@
+TIMEZONE=Europe/Moscow
+PIHOLE_PASSWORD=pass1
+PEERS=macbook,iphone

scripts/run.sh

@@ -0,0 +1,112 @@
+#!/bin/bash
+
+# Available parameters are:
+# --down - stops and removes containers of running services
+# --logs - displays logs output
+# --pull - pulls fresh images before starting containers
+
+set -ea
+
+./scripts/templater.sh ./scripts/.env.template ./scripts/.env.vars > ./.env
+
+[ -f .env ] && source .env
+
+UNKNOWN_POSITIONAL_PARAMS=()
+
+while [ "$#" -gt 0 ]; do
+    key="$1"
+
+    case $key in
+        --down)
+            DOWN="$1"
+            shift # past parameter
+            ;;
+        --logs)
+            LOGS="$1"
+            shift # past parameter
+            ;;
+        --pull)
+            PULL="$1"
+            shift # past parameter
+            ;;
+        *)    # unknown option
+            UNKNOWN_POSITIONAL_PARAMS+=("$1")
+            shift # past parameter
+            ;;
+    esac
+done
+
+if [ "${#UNKNOWN_POSITIONAL_PARAMS[@]}" -ne 0 ]; then
+    printf '%s\n' "Unrecognized parameters: '${UNKNOWN_POSITIONAL_PARAMS[*]}'"
+    printf '%s\n' "Available parameters are:"
+    printf '%s\n' "--down - stops and removes containers of running services"
+    printf '%s\n' "--logs - displays logs output for all services"
+    printf '%s\n' "--pull - pulls fresh images before starting containers"
+    exit 0
+fi
+
+COMPOSE_PROFILES_PREFIX="COMPOSE_PROFILES=${COMPOSE_PROFILES}"
+printf '%s\n' "Start with profiles: ${COMPOSE_PROFILES}"
+
+DOCKER_COMPOSE_CONFIG="${COMPOSE_PROFILES_PREFIX} docker-compose -f docker-compose.yml"
+DOCKER_COMPOSE_UP_OPTIONS=""
+
+OVERRIDE_YML="docker-compose.override.yml"
+if test -f "$OVERRIDE_YML"; then
+    DOCKER_COMPOSE_CONFIG+=" -f ${OVERRIDE_YML}"
+fi
+
+#### DOWN ####
+DOCKER_COMPOSE_DOWN=("${DOCKER_COMPOSE_CONFIG}" "down --remove-orphans")
+if [ "${SERVICE_NAME:=false}" != "false" ]; then
+#    DOCKER_COMPOSE_DOWN=("${DOCKER_COMPOSE_DOWN[@]}" "${SERVICE_NAME}")
+    DOCKER_COMPOSE_DOWN=("${DOCKER_COMPOSE_CONFIG}" "rm -sv" "${SERVICE_NAME}")
+fi
+
+if [ "${DOWN}" == "--down" ]; then
+    printf '%s\n' "Stopping containers, removing containers and networks ..."
+    printf '%s\n' "Running command: ${DOCKER_COMPOSE_DOWN[*]}"
+    eval "${DOCKER_COMPOSE_DOWN[@]}"
+    exit 0;
+fi
+#### END DOWN ####
+
+#### LOG ####
+DOCKER_COMPOSE_LOGS=("${DOCKER_COMPOSE_CONFIG}" "logs" "${SERVICE_NAME}")
+if [ "${SERVICE_NAME:=false}" != "false" ]; then
+    DOCKER_COMPOSE_LOGS=("${DOCKER_COMPOSE_LOGS[@]}" "${SERVICE_NAME}")
+fi
+
+if [ "${LOGS}" == "--logs" ]; then
+    printf '%s\n' "Displaying logs output ..."
+    printf '%s\n' "Running command: ${DOCKER_COMPOSE_LOGS[*]}"
+    eval "${DOCKER_COMPOSE_LOGS[@]}"
+    exit 0;
+fi
+#### END LOG ####
+
+#### UP ####
+DOCKER_COMPOSE_UP=("${DOCKER_COMPOSE_CONFIG}" "up" "${DOCKER_COMPOSE_UP_OPTIONS}")
+
+DOCKER_COMPOSE=(
+    "${DOCKER_COMPOSE_DOWN[@]}" "&&"
+    "${DOCKER_COMPOSE_UP[@]}"
+)
+
+DOCKER_COMPOSE_PULL=("${DOCKER_COMPOSE_CONFIG}" "pull")
+
+if [ "${PULL}" == "--pull" ]; then
+    printf '%s\n' "Enforced pull of fresh images ..."
+    DOCKER_COMPOSE=("${DOCKER_COMPOSE[@]:0:3}" "${DOCKER_COMPOSE_PULL[@]}" "&&" "${DOCKER_COMPOSE[@]:3}")
+fi
+
+if [ "${SERVICE_NAME:=false}" != "false" ]; then
+    DOCKER_COMPOSE=("${DOCKER_COMPOSE[@]}" "${SERVICE_NAME}")
+fi
+
+printf '%s\n' "Running command: ${DOCKER_COMPOSE[*]}"
+
+eval "${DOCKER_COMPOSE[@]}"
+#### END UP ####
+
+set +a

scripts/templater.sh

@@ -0,0 +1,38 @@
+#!/bin/sh
+
+# $1 - file template
+# $2 (optional) - file vars
+
+#set -eu # unset variables are errors & non-zero return values exit the whole script
+[ "${DEBUG:-}" = "true" ] && set -x
+
+template="./.env.template"
+fin="./.env.vars"
+
+cat_template() {
+  echo "cat << EOT"
+  if [ -n "$1" ]; then
+    cat "$1"
+  else
+    [ -n $template ] && cat $template
+  fi
+
+
+  echo EOT
+}
+
+# source file vars
+if [ -f "$2" ]; then
+  set -a; . "$2"; set +a;
+else
+  [ -f $fin ] && (set -a; . $fin; set +a; )
+fi
+
+# source file template
+if [ -f "$1" ]; then
+  set -a; . "$1"; set +a;
+else
+  [ -f "${template}" ] && (set -a; . "${template}"; set +a; )
+fi
+
+cat_template $1 | sh