services:
  wg-server:
    build: ./wg-portal

    cap_add:
      - NET_ADMIN
    network_mode: host

    volumes:
      - ./initial_config:/initial_config:ro
      - ../data/wg-server-ui-data:/app/data:rw

    extra_hosts:
      - "host.docker.internal:host-gateway"

    environment:
      # Listen settings
      - LISTENING_ADDRESS=host.docker.internal:8123
      # WireGuard Settings
      - WG_DEVICES=wg-server
      - WG_DEFAULT_DEVICE=wg-server

      - CREATE_DEFAULT_PEER=true
      - USER_MANAGE_PEERS=true
      - DEFAULT_PEER_NAMES=PC,Server,Laptop,Mobile,Tablet
      # Core Settings
      - EXTERNAL_URL=https://vpn.company.com
      - WEBSITE_TITLE=WireGuard VPN
      - COMPANY_NAME=Your Company Name
      - ADMIN_USER=${WG_ADMIN_USER}
      - ADMIN_PASS=${WG_ADMIN_PASSWORD}
      # LDAP Settings
      - LDAP_ENABLED=true
      - LDAP_URL=ldap://127.0.0.1:389
      - LDAP_STARTTLS=false

      - LDAP_USER=cn=${LDAP_READONLY_USER_USERNAME},dc=company,dc=local
      - LDAP_PASSWORD=${LDAP_READONLY_USER_PASSWORD}

      - LDAP_BASEDN=dc=company,dc=local
      - LDAP_ADMIN_GROUP=cn=admins,ou=groups,dc=company,dc=local
      - LDAP_LOGIN_FILTER=(&(objectClass=organizationalPerson)(|(uid={{login_identifier}})(mail={{login_identifier}})))
      - LDAP_SYNC_FILTER=(&(objectClass=organizationalPerson)(uid=*))

    restart: unless-stopped