Open francois-pasquier opened 7 months ago
The way you configure your docker is up to you - if you use network mode host, that just means all the ports that the container is using will be used on the host machine, and: a) they need to be "free" b) will allocate and expose all ports. When using a typical docker configuration, you explicitly state which ports to expose and bind them to which port on the host machine.
The error above indicates that the address of your defguard instance is wrong - could you share your configuration (without any tokens/private keys) - so that we could know more about your setup and help you?
Well, I am raising the issue as the behavior is present just after following the documentation to setup the project.
Here is my configuration:
version: "3"
services:
db:
container_name: defguard-db
image: postgres:15-alpine
restart: unless-stopped
environment:
POSTGRES_DB: defguard
POSTGRES_USER: defguard
POSTGRES_PASSWORD: ${DEFGUARD_DB_PASSWORD}
volumes:
- ./.volumes/db:/var/lib/postgresql/data
# ports:
# - "5432:5432"
# caddy:
# image: caddy:2.7-alpine
# restart: unless-stopped
# volumes:
# - ./.volumes/caddy/data:/data
# - ./.volumes/caddy/config:/config
# - ./.volumes/caddy/Caddyfile:/etc/caddy/Caddyfile
# ports:
# # http
# - "80:80"
# # https
# - "443:443"
core:
container_name: defguard
image: ghcr.io/defguard/defguard:${CORE_IMAGE_TAG:-latest}
restart: unless-stopped
environment:
DEFGUARD_AUTH_SECRET: ${DEFGUARD_AUTH_SECRET}
DEFGUARD_GATEWAY_SECRET: ${DEFGUARD_GATEWAY_SECRET}
DEFGUARD_YUBIBRIDGE_SECRET: ${DEFGUARD_YUBIBRIDGE_SECRET}
DEFGUARD_SECRET_KEY: ${DEFGUARD_SECRET_KEY}
DEFGUARD_DEFAULT_ADMIN_PASSWORD: ${DEFGUARD_DEFAULT_ADMIN_PASSWORD}
DEFGUARD_DB_HOST: db
DEFGUARD_DB_PORT: 5432
DEFGUARD_DB_USER: defguard
DEFGUARD_DB_PASSWORD: ${DEFGUARD_DB_PASSWORD}
DEFGUARD_DB_NAME: defguard
DEFGUARD_URL: ${DEFGUARD_URL}
DEFGUARD_LOG_LEVEL: info
DEFGUARD_WEBAUTHN_RP_ID: ${DEFGUARD_WEBAUTHN_RP_ID}
DEFGUARD_ENROLLMENT_URL: ${DEFGUARD_ENROLLMENT_URL}
DEFGUARD_GRPC_CERT: /ssl/defguard.crt
DEFGUARD_GRPC_KEY: /ssl/defguard.key
## RSA setup guide: https://defguard.gitbook.io/defguard/community-features/setting-up-your-instance/docker-compose#openid-rsa-setup
DEFGUARD_OPENID_KEY: /keys/rsakey.pem
## LDAP setup guide: https://defguard.gitbook.io/defguard/features/ldap-synchronization-setup
# DEFGUARD_LDAP_URL: ldap://localhost:389 # [LDAP]
# DEFGUARD_LDAP_BIND_USERNAME: cn=admin,dc=example,dc=org # [LDAP]
# DEFGUARD_LDAP_BIND_PASSWORD: password # [LDAP]
ports:
# web
# - "8000:8000"
# grpc
- "50055:50055"
depends_on:
- db
volumes:
# SSL setup guide: https://defguard.gitbook.io/defguard/features/setting-up-your-instance/docker-compose#ssl-setup
- ./.volumes/ssl:/ssl
## RSA setup guide: https://defguard.gitbook.io/defguard/community-features/setting-up-your-instance/docker-compose#openid-rsa-setup
- ./.volumes/core/rsakey.pem:/keys/rsakey.pem
proxy:
container_name: defguard-proxy
image: ghcr.io/defguard/defguard-proxy:${PROXY_IMAGE_TAG:-latest}
restart: unless-stopped
environment:
DEFGUARD_PROXY_UPSTREAM_GRPC_URL: http://core:50055/
DEFGUARD_PROXY_GRPC_CA: /ssl/defguard-ca.pem
volumes:
# SSL setup guide: https://defguard.gitbook.io/defguard/features/setting-up-your-instance/docker-compose#ssl-setup
- ./.volumes/ssl:/ssl
# ports:
# web
# - "8080:8080"
depends_on:
- core
gateway:
container_name: defguard-gateway
image: ghcr.io/defguard/gateway:${GATEWAY_IMAGE_TAG:-latest}
restart: unless-stopped
sysctls:
- net.ipv4.conf.all.src_valid_mark=1
environment:
DEFGUARD_GRPC_URL: http://defguard:50055
DEFGUARD_STATS_PERIOD: 30
DEFGUARD_TOKEN: ${DEFGUARD_TOKEN}
ports:
# wireguard endpoint
- "51820:51820/udp"
cap_add:
- NET_ADMIN
networks:
default:
name: secure_proxy
external: true
The second error I was talking about, was just a misconfiguration from my end. Nevermind!
That said, I can't ping anything when connected through the wireguard link which follows:
VPN IP and mask: 10.0.30.1/24
Gateway address: My external ip
Gateway port: 51820
Allowed ips: 0.0.0.0/0
DNS: 1.1.1.1
Allowed groups: All groups
Also, the matrix server is not working
Are we supposed to use
network_mode: host
or not?There are two issues in this configuration error ->
1. There is both
network_mode: host
and port binding in the templatedocker-compose.yaml
file. It's simply not possible to assign ports in the case ofnetwork_node: host
2. I tried removing the
network_mode: host
as I don't think it should be mandatory. That said, I am getting this error when setting up a wireguard configuration for a user: