From 01266aa06731aea1b4e8911a99e858b3d47e129f Mon Sep 17 00:00:00 2001 From: Eduardo David Paredes Vara Date: Sun, 18 Oct 2026 22:03:04 +0000 Subject: [PATCH] feat(wireguard): configure native OIDC authentication --- wireguard/docker-compose.yml | 9 +++++++++ wireguard/stack.env | 13 ++++++++++++- 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/wireguard/docker-compose.yml b/wireguard/docker-compose.yml index 9cf796f..cee0f13 100644 --- a/wireguard/docker-compose.yml +++ b/wireguard/docker-compose.yml @@ -23,6 +23,15 @@ services: DISABLE_IPV6: ${DISABLE_IPV6} + OAUTH_PROVIDERS: ${OAUTH_PROVIDERS} + OAUTH_OIDC_SERVER: ${OAUTH_OIDC_SERVER} + OAUTH_OIDC_CLIENT_ID: ${OAUTH_OIDC_CLIENT_ID} + OAUTH_OIDC_CLIENT_SECRET: ${OAUTH_OIDC_CLIENT_SECRET} + OAUTH_OIDC_NAME: ${OAUTH_OIDC_NAME} + OAUTH_AUTO_REGISTER: ${OAUTH_AUTO_REGISTER} + OAUTH_ALLOWED_DOMAINS: ${OAUTH_ALLOWED_DOMAINS} + DISABLE_PASSWORD_AUTH: ${DISABLE_PASSWORD_AUTH} + volumes: - ${WG_DATA_PATH}:/etc/wireguard:Z - ${WG_MODULES_PATH}:/lib/modules:ro,Z diff --git a/wireguard/stack.env b/wireguard/stack.env index aba2378..c26bec5 100644 --- a/wireguard/stack.env +++ b/wireguard/stack.env @@ -1,5 +1,5 @@ ##### wg-easy ##### -WG_EASY_IMAGE=ghcr.io/wg-easy/wg-easy:15.2.2 +WG_EASY_IMAGE=ghcr.io/wg-easy/wg-easy:15.4.0 WG_HOST=app.example.com WG_PORT=51820 WG_UI_PORT=51821 @@ -9,6 +9,17 @@ INIT_USERNAME=example-user INIT_PASSWORD=change-me DISABLE_IPV6=true +##### OAuth nativo (Authentik) — capa extra sobre el forward-auth de Traefik ##### +# Rellenar tras crear el OAuth2/OpenID Provider en Authentik (ver README) +OAUTH_PROVIDERS=oidc +OAUTH_OIDC_SERVER=https://auth.example.com/application/o/wireguard-oidc/ +OAUTH_OIDC_CLIENT_ID=change-me +OAUTH_OIDC_CLIENT_SECRET=change-me +OAUTH_OIDC_NAME=Authentik +OAUTH_AUTO_REGISTER=false +OAUTH_ALLOWED_DOMAINS=example.com,example.org +DISABLE_PASSWORD_AUTH=false + WG_DATA_PATH=/opt/wg-easy WG_MODULES_PATH=/lib/modules WG_UDP_PORT=51820