In this article, we will explore how to set up an exclusive Docker Compose service that can only be accessed via a VPN tunnel. Specifically, we'll cover a scenario where we have two containers in our service: "app" and "VPN server".
Prerequisites
Before we begin, it's assumed that you have the following installed and configured:
- Docker
- A VPN client and server that support OpenVPN
Overview
To achieve our goal, we'll need to perform the following steps:
- Set up a VPN server
- Configure the Docker Compose service to use the VPN server
- Restrict access to the service through the VPN tunnel
Step 1: Set up a VPN Server
For this example, we'll use OpenVPN as our VPN provider. You can set up your own VPN server or use a third-party service.
Installing and configuring the OpenVPN server
You can follow the official OpenVPN documentation to set up a server on your preferred operating system.
Step 2: Configure the Docker Compose Service
After setting up the VPN server, we need to configure our Docker Compose service to use it.
Creating the Docker Compose file
In your project directory, create a "docker-compose.yml" file
version: '3'
services:
app:
image: your-app-image
container_name: app
depends_on:
- vpn-server
networks:
- vpn-network
vpn-server:
image: openvpn-image
container_name: vpn-server
ports:
- "1194:1194/udp"
networks:
- vpn-network
networks:
vpn-network:
driver: bridge
external: true
Here, we have two services defined: "app" and "vpn-server". They both share the "vpn-network" network, allowing them to communicate securely over the VPN.
Step 3: Restrict Access to the Service through the VPN Tunnel
The final step is to configure the VPN server to only allow access from the Docker Compose service.
Configuring the OpenVPN server
To restrict access to the VPN server, follow these steps:
- Edit the OpenVPN server configuration file and add the following line:
client-config-dir /etc/openvpn/ccd
The "client-config-dir" directive specifies the path to a directory containing client-specific configuration files.
- Create a file called "[client IP address]" in the /etc/openvpn/ccd directory (where [client IP address] is the IP address of the Docker Compose service).
- Add the following lines to the file:
iroute 172.18.0.0 255.255.255.0
Replace "172.18.0.0" with the subnet of your Docker Compose network.
Configuring the Docker Compose Service
You also need to configure the Docker Compose service to use the VPN server as a default gateway.
Adding a script to the Dockerfile
Modify your application's Dockerfile and add the following lines:
RUN echo 'nameserver 8.8.8.8' > /etc/resolv.conf
RUN echo 'nameserver 8.8.4.4' >> /etc/resolv.conf
RUN echo 'up /etc/openvpn/update-resolv-conf' > /etc/openvpn/client.conf
RUN echo 'down /etc/openvpn/update-resolv-conf' >> /etc/openvpn/client.conf
These lines set up the DHCP client, configure the DNS servers, and update the resolv.conf file upon connecting to the VPN.
- We have set up an exclusive Docker Compose service that can only be accessed via a VPN tunnel.
- The "app" and "VPN