# `pia-wireguard` (PIA WireGuard gateway container)

Deze container zet **Private Internet Access (PIA)** op via **WireGuard** en laat andere containers dezelfde VPN-stack gebruiken via `network_mode: service:...`.

## Vereisten

- Docker/Compose
- Kernel WireGuard support op de host
- Container runtime permissies:
  - `cap_add: [NET_ADMIN]`
  - `devices: [/dev/net/tun]`

## Environment variables

- **Required**
  - `PIA_USER`: je PIA username
  - `PIA_PASS`: je PIA password
  - `PIA_REGIONS`: CSV (`nl_amsterdam,de_berlin`) of JSON array (`["nl_amsterdam","de_berlin"]`)

- **Optional**
  - `PIA_PORT_FORWARD`: `true|false` (default `false`)
  - `PIA_STATE_DIR`: default `/pia`
  - `PIA_PF_FILE`: default `/pia/port_forward.json`
  - `PIA_PF_PORT_FILE`: default `/pia/port_forward.port`
  - `PIA_HANDSHAKE_MAX_AGE_SECONDS`: default `180`
  - `PIA_HEALTH_URL`: default `https://api64.ipify.org`

## Output

Wanneer `PIA_PORT_FORWARD=true`:

- `port_forward.json` (mountbaar naar host): bevat `port`, `region`, `expires_at`, `refreshed_at`
- `port_forward.port`: bevat enkel het poortnummer

## Compose voorbeeld

Zie [`docker-compose.example.yml`](docker-compose.example.yml).