apiVersion: apps/v1
kind: Deployment
metadata:
  name: wireguard
  namespace: wireguard
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: wireguard
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: wireguard
    spec:
      containers:
        - env:
            - name: DISABLE_IPV6
              value: "true"
            - name: INIT_ENABLED
              value: "true"
            - name: INIT_ALLOWED_IPS
              value: 192.168.2.0/24
            - name: INIT_DNS
              value: 192.168.2.1
          image: ghcr.io/wg-easy/wg-easy:15.4.0
          name: wg-easy
          ports:
            - containerPort: 51820
              name: wireguard
              protocol: UDP
            - containerPort: 51821
              name: http
          securityContext:
            capabilities:
              add:
                - NET_ADMIN
          volumeMounts:
            - mountPath: /etc/wireguard
              name: data
      initContainers:
        - args:
            - |
              # Rules in the pod's own network namespace, never the node's.
              # VPN clients may reach the home LAN, but not this pod (the web
              # UI), the pod network or the service network. The mangle table
              # runs before wg-easy's own filter rules, so its per-client
              # firewall can't open these up.
              set -eu
              iptables -t mangle -A PREROUTING -i wg0 -m addrtype --dst-type LOCAL -j DROP
              iptables -t mangle -A PREROUTING -i wg0 -d 10.42.0.0/16 -j DROP
              iptables -t mangle -A PREROUTING -i wg0 -d 10.43.0.0/16 -j DROP
          command:
            - /bin/sh
            - -c
          image: ghcr.io/wg-easy/wg-easy:15.4.0
          name: firewall
          securityContext:
            capabilities:
              add:
                - NET_ADMIN
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: wireguard-data