From 3c40e94a576c29a2e3c70198a7b9e26ceb0b5303 Mon Sep 17 00:00:00 2001 From: dev Date: Sat, 12 Sep 2026 18:51:19 +0300 Subject: [PATCH] fix: get cloudflared WireGuard tunnel actually serving - Dockerfile.cloudflared: add iptables + ip6tables (wg-quick needs them for ::/0 full tunnel) - docker-compose: privileged:true for cloudflared so wg-quick can set net.ipv4.conf.all.src_valid_mark - start-cloudflared.sh: restore resolv.conf after wg-quick (resolvconf wiped docker DNS 127.0.0.11 => app unresolvable => Host Error) --- Dockerfile.cloudflared | 2 +- docker-compose.yml | 1 + start-cloudflared.sh | 4 ++++ 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/Dockerfile.cloudflared b/Dockerfile.cloudflared index bf25e02..b2be198 100644 --- a/Dockerfile.cloudflared +++ b/Dockerfile.cloudflared @@ -6,7 +6,7 @@ FROM cloudflare/cloudflared:latest AS cf FROM alpine:3.20 -RUN apk add --no-cache wireguard-tools iproute2 +RUN apk add --no-cache wireguard-tools iproute2 iptables ip6tables COPY --from=cf /usr/local/bin/cloudflared /usr/bin/cloudflared COPY start-cloudflared.sh /start-cloudflared.sh ENTRYPOINT ["/bin/sh", "/start-cloudflared.sh"] diff --git a/docker-compose.yml b/docker-compose.yml index 5367315..32deeff 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -79,6 +79,7 @@ services: restart: unless-stopped cap_add: - NET_ADMIN + privileged: true volumes: - ./wg:/etc/wireguard:ro environment: diff --git a/start-cloudflared.sh b/start-cloudflared.sh index 236c6ee..a03c089 100755 --- a/start-cloudflared.sh +++ b/start-cloudflared.sh @@ -6,7 +6,11 @@ set -e # cloudflared стартует сразу, как в базовой схеме Quick Tunnel. if [ -f /etc/wireguard/wg0.conf ]; then echo "WireGuard config found, bringing up wg0..." + cp /etc/resolv.conf /tmp/resolv.conf.default wg-quick up wg0 + # wg-quick/resolvconf перезаписывает resolv.conf (убирает docker-DNS 127.0.0.11), + # из-за чего внутреннее имя app не резолвится. Восстанавливаем прежний конфиг. + cat /tmp/resolv.conf.default > /etc/resolv.conf echo "Waiting for WireGuard handshake..." # Формат `wg show wg0 latest-handshakes`: " "; 0 = handshake ещё не было. until wg show wg0 latest-handshakes | awk '{ if ($2 != 0) found=1 } END { exit !found }'; do