own wireguard

Dockers/pia-wireguard/README.md

@@ -0,0 +1,38 @@
+# `pia-wireguard` (PIA WireGuard gateway container)
+
+Deze container zet **Private Internet Access (PIA)** op via **WireGuard** en laat andere containers dezelfde VPN-stack gebruiken via `network_mode: service:...`.
+
+## Vereisten
+
+- Docker/Compose
+- Kernel WireGuard support op de host
+- Container runtime permissies:
+  - `cap_add: [NET_ADMIN]`
+  - `devices: [/dev/net/tun]`
+
+## Environment variables
+
+- **Required**
+  - `PIA_USER`: je PIA username
+  - `PIA_PASS`: je PIA password
+  - `PIA_REGIONS`: CSV (`nl_amsterdam,de_berlin`) of JSON array (`["nl_amsterdam","de_berlin"]`)
+
+- **Optional**
+  - `PIA_PORT_FORWARD`: `true|false` (default `false`)
+  - `PIA_STATE_DIR`: default `/pia`
+  - `PIA_PF_FILE`: default `/pia/port_forward.json`
+  - `PIA_PF_PORT_FILE`: default `/pia/port_forward.port`
+  - `PIA_HANDSHAKE_MAX_AGE_SECONDS`: default `180`
+  - `PIA_HEALTH_URL`: default `https://api64.ipify.org`
+
+## Output
+
+Wanneer `PIA_PORT_FORWARD=true`:
+
+- `port_forward.json` (mountbaar naar host): bevat `port`, `region`, `expires_at`, `refreshed_at`
+- `port_forward.port`: bevat enkel het poortnummer
+
+## Compose voorbeeld
+
+Zie [`docker-compose.example.yml`](docker-compose.example.yml).
+