softether-docker/docker-compose.yml at main · kh813/softether-docker · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
services:
  vpnserver:
    build:
      context: .
      args:
        SOFTETHER_REF: ${SOFTETHER_REF:-master}
        UNLOCK_FEATURES: ${UNLOCK_FEATURES:-false}
    image: softether-vpnserver:${TAG:-latest}
    container_name: softether-vpnserver
    restart: unless-stopped

    cpuset: '${CPU_SET:-0-1}'

    # CPU/メモリリソースの制限設定（CPU使用率の高騰・ビジーループ防止）
    deploy:
      resources:
        limits:
          cpus: '${CPUS:-1.0}'
          memory: ${MEMORY_LIMIT:-1G}

    # SecureNAT(L3/NAT)運用向けの最小権限。Local Bridgeで物理LANへ橋渡しする場合はこれでは不足します。
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun

    ports:
      - "443:443"        # 管理 / SSL-VPN
      - "992:992"         # SoftEther独自プロトコル(旧)
      - "5555:5555"       # SoftEther独自プロトコル
      - "1194:1194/udp"   # OpenVPN
      - "500:500/udp"     # IPsec (IKE)
      - "4500:4500/udp"   # IPsec (NAT-T)

    volumes:
      # ホスト側の永続データ領域。ここに vpn_server.config やログが溜まる。
      - ./data:/usr/vpnserver

    sysctls:
      - net.ipv4.ip_forward=1

    healthcheck:
      test: ["CMD", "/usr/vpnserver/vpncmd", "localhost", "/SERVER", "/CMD:ServerStatusGet"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s