services:
  wireguard:
    image: linuxserver/wireguard
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv4.ip_forward=1
    privileged: true
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
    volumes:
      - ./server_wg0.conf:/config/wg_confs/wg0.conf
      - /lib/modules:/lib/modules
    ports:
      # WireGuard's main listening port
      - "{{ listen_port }}:{{ listen_port }}/udp"
{% for rule in forwards %}
      # Forwarding rule: Host port {{ rule['server_port'] }} -> {{ rule['client_ip'] }}:{{ rule['client_port'] }}
      - "{{ rule['server_port'] }}:{{ rule['server_port'] }}/{{ rule['tsl_method'] }}"
{% endfor %}
