# Server configuration
[Interface]
# The (internal) IP we want to give the VPN server itself
Address = 10.10.0.1/24

# The port the server should listen to, 51820 is the default for WireGuard
ListenPort = 51820

# The private key of the server
PrivateKey = 4N9FtwbtC9iY9P1C85l1QmM0OxlGRT0cHVjEuRbLuVA=

# (De)initialize iptables rules for routing the VPN traffic
PostUp = iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -s 10.10.0.0/24 -o eth0 -j MASQUERADE


# Configure one or multiple VPN clients with a [Peer] entry for each.
# For this example we only configure 1 client
[Peer]
# The public key of the client you want to let connect to the server
PublicKey = 8EiAxqTGhKFJeLhDDaZcuEVqpGJK1qrq8Ht299J7Q2o=

# The (internal) IP we want this client to have
AllowedIPs = 10.10.0.5/32

$ wg genkey | tee private.key | wg pubkey > public.key

---
#! Deployment definition for WireGuard for a single instance container.
#! Configuration data from a secret gets mounted as files into the container.
#! The init container ensures forwarding is enabled.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: wireguard
  namespace: wireguard
  labels:
    app: wireguard
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: wireguard
  template:
    metadata:
      labels:
        app: wireguard
    spec:
      restartPolicy: Always
      initContainers:
      - name: init
        image: busybox:1.32.0
        command:
        - sh
        - -c
        - sysctl -w net.ipv4.ip_forward=1 && sysctl -w net.ipv4.conf.all.forwarding=1
        securityContext:
          privileged: true
          capabilities:
            add:
            - NET_ADMIN
      containers:
      - name: wireguard
        image: masipcat/wireguard-go:latest
        securityContext:
          privileged: true
          capabilities:
            add:
            - NET_ADMIN
        ports:
        - containerPort: 51820
          protocol: UDP
        command:
        - sh
        - -c
        - /entrypoint.sh
        env:
        - name: LOG_LEVEL
          value: info
        resources:
          requests:
            memory: "64Mi"
            cpu: "150m"
          limits:
            memory: "128Mi"
        volumeMounts:
        - name: wireguard-config
          mountPath: /etc/wireguard/wg0.key
          subPath: wg0.key
          readOnly: true
        - name: wireguard-config
          mountPath: /etc/wireguard/wg0.conf
          subPath: wg0.conf
          readOnly: true
      volumes:
      - name: wireguard-config
        secret:
          secretName: wireguard

---
#! Secret containing all configuration data for WireGuard, to be mapped as volume/files into container
apiVersion: v1
kind: Secret
metadata:
  name: wireguard
  namespace: wireguard
  labels:
    app: wireguard
type: Opaque
stringData:
  wg0.key: 4N9FtwbtC9iY9P1C85l1QmM0OxlGRT0cHVjEuRbLuVA=
  wg0.conf: |
    [Interface]
    Address = 10.10.0.1/24
    ListenPort = 51820
    PostUp = wg set wg0 private-key /etc/wireguard/wg0.key && iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -o eth0 -j MASQUERADE
    PostDown = iptables -t nat -D POSTROUTING -s 10.10.0.0/24 -o eth0 -j MASQUERADE
    SaveConfig = false

    [Peer]
    PublicKey = 8EiAxqTGhKFJeLhDDaZcuEVqpGJK1qrq8Ht299J7Q2o=
    AllowedIPs = 10.10.0.5/32    

---
#! Service definition for WireGuard, exposes its UDP port as a NodePort service externally on <NodeIP:31820>
apiVersion: v1
kind: Service
metadata:
  name: wireguard
  namespace: wireguard
  labels:
    app: wireguard
spec:
  type: NodePort
  selector:
    app: wireguard
  ports:
  - port: 51820
    targetPort: 51820
    nodePort: 31820
    protocol: UDP

kubectl -n wireguard apply -f wireguard.yml

$ nc -uvz 1.2.3.4 31820
Connection to 1.2.3.4 31820 port [udp/wireguard] succeeded!

---
#! Deployment definition for AdGuard Home for a single instance container,
#! storing configuration data on a persistent volume claim.
#! The management web interface on port 3000 and the DNS port 53
#! are be made accessible via Kubernetes service definition, see further below.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: adguardhome
  namespace: adguardhome
  labels:
    app: adguardhome
spec:
  replicas: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 0
  selector:
    matchLabels:
      app: adguardhome
  template:
    metadata:
      labels:
        app: adguardhome
    spec:
      containers:
      - name: adguardhome
        image: adguard/adguardhome:v0.106.3
        securityContext:
          privileged: false
          allowPrivilegeEscalation: false
        ports:
        - containerPort: 3000
          protocol: TCP
        - containerPort: 53
          protocol: UDP
        resources:
          requests:
            memory: "128Mi"
            cpu: "200m"
          limits:
            memory: "256Mi"
        readinessProbe:
          httpGet:
            path: /
            port: 3000
        livenessProbe:
          httpGet:
            path: /
            port: 3000
        volumeMounts:
        - name: adguardhome-config
          mountPath: /opt/adguardhome/conf
        - name: adguardhome-logs
          mountPath: /opt/adguardhome/work
      volumes:
      - name: adguardhome-config
        persistentVolumeClaim:
          claimName: adguardhome
      - name: adguardhome-logs
        emptyDir: {}

---
#! Persistent volume claim to store all AdGuard Home configuration data
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: adguardhome
  namespace: adguardhome
  labels:
    app: adguardhome
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 2Gi

---
#! Service definition for the AdGuard Home web interface and DNS port
apiVersion: v1
kind: Service
metadata:
  name: adguardhome
  namespace: adguardhome
  labels:
    app: adguardhome
spec:
  type: ClusterIP
  selector:
    app: adguardhome
  ports:
  - port: 3000
    targetPort: 3000
    protocol: TCP
  - port: 53
    targetPort: 53
    protocol: UDP

---
#! Ingress resource, used for HTTP(S) access to the AdGuard Home web interface via Kubernetes ingress-controller
#! https://kubernetes.io/docs/concepts/services-networking/ingress-controllers/
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: adguardhome
  namespace: adguardhome
  labels:
    app: adguardhome
  annotations:
    #! Modify "cert-manager.io/cluster-issuer" to match your certificate ClusterIssuer if you are using cert-manager,
    #! otherwise remove it entirely
    cert-manager.io/cluster-issuer: letsencrypt-prod
    #! Modify "kubernetes.io/ingress.class" to match your ingress-controller
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  tls:
  - hosts:
    #! Configure the hostname for the AdGuard Home web interface
    - adguardhome.my-example-domain.com
    secretName: adguardhome-tls
  rules:
  #! Configure the hostname for the AdGuard Home web interface
  - host: adguardhome.my-example-domain.com
    http:
      paths:
      - backend:
          serviceName: adguardhome
          servicePort: 3000

kubectl -n adguard apply -f adguard.yml

# Client configuration
[Interface]
# Assign the IP as configured on the server config for this peer
Address = 10.10.0.5/32

# The private key of this client (its corresponding public key is in the server config for this peer)
PrivateKey = wMq8AvPsaJSTaFEnwv+J535BGZZ4eWybs5x31r7bhGA=

# DNS server the VPN client should use once connected.
# In our case this is the ClusterIP of our AdGuard Home Kubernetes service
DNS = 10.0.15.31


# The VPN server we want to connect to
[Peer]
# The public key of the server you want to connect to
PublicKey = uJ0bUIe8Kc+vp27sJVDLH8lAmo4E3dfGtzRvOAGQZ0U=

# The IP that points to our WireGuard pod on Kubernetes, could be a K8s LoadBalancer IP, ClusterIP, etc..
# In our case it is the node IP directly as we used a NodePort
Endpoint = 1.2.3.4:31820

# What IPs/subnet should be routed through the VPN? Use "0.0.0.0/0, ::/0" for all traffic
AllowedIPs = 0.0.0.0/0, ::/0

# Keep the connection alive through NAT and firewalls by sending a keepalive packet every 25 seconds
PersistentKeepalive = 25

# pacman -S qrencode
resolving dependencies...
looking for conflicting packages...

Packages (1) qrencode-4.1.1-1

Total Installed Size:  0.10 MiB
Net Upgrade Size:      0.00 MiB

:: Proceed with installation? [Y/n] Y
(1/1) checking keys in keyring                            [##############################] 100%
(1/1) checking package integrity                          [##############################] 100%
(1/1) loading package files                               [##############################] 100%
(1/1) checking for file conflicts                         [##############################] 100%
(1/1) checking available disk space                       [##############################] 100%
:: Processing package changes...
(1/1) installing qrencode                                 [##############################] 100%
:: Running post-transaction hooks...
(1/1) Arming ConditionNeedsUpdate...

$ qrencode -t ANSIUTF8 -r client.conf
[QR CODE in terminal]

$ qrencode -t PNG -r client.conf -o client_conf.png