wireguard

cardinal blueprint install wireguard
# or override resources / env at install time:
cardinal blueprint install wireguard --memory 1g --cpus 2 -e KEY=value -y

cardinal run -d \
  --restart always \
  -n wireguard \
  -p "51820:51820/udp,51821:51821/tcp" \
  -v "wireguard_data:/etc/wireguard" \
  --memory 128m \
  --cpus 0.5 \
  --network host \
  --cap-add NET_ADMIN,SYS_MODULE \
  -e WG_HOST="vpn.example.com" \
  -e PASSWORD="vpn_admin123" \
  -e WG_PORT="51820" \
  -e WG_DEFAULT_ADDRESS="10.8.0.x" \
  -e WG_DEFAULT_DNS="1.1.1.1" \
  -e WG_ALLOWED_IPS="0.0.0.0/0" \
  -e WG_POST_UP="iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE" \
  -e WG_POST_DOWN="iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -j MASQUERADE" \
  weejewel/wg-easy:latest \
  node /app/server.js