From b992a9fa2068da5753da3a8ffec8ac9951dec579 Mon Sep 17 00:00:00 2001 From: Michelle Wang Date: Mon, 2 Nov 2026 11:13:28 -0500 Subject: [PATCH 1/4] remove sys_modules --- docker-compose.yml | 2 -- vpnserver_config/config.env.sample | 3 --- 2 files changed, 5 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index f47503e..0428630 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -19,7 +19,6 @@ services: pull_policy: build cap_add: - net_admin # needed to handle wireguard interface - - sys_module # needed to remove wireguard kernel module devices: - /dev/net/tun # needed to handle wireguard interface sysctls: @@ -48,7 +47,6 @@ services: pull_policy: build cap_add: - net_admin # needed to handle wireguard interface - - sys_module # needed to remove wireguard kernel module devices: - /dev/net/tun # needed to handle wireguard interface volumes: diff --git a/vpnserver_config/config.env.sample b/vpnserver_config/config.env.sample index fcf52bf..bad9ce9 100644 --- a/vpnserver_config/config.env.sample +++ b/vpnserver_config/config.env.sample @@ -3,9 +3,6 @@ # Adapted from Fed-BioMed (Apache-2.0): # https://github.com/fedbiomed/fedbiomed/blob/v6.4.1/envs/vpn/docker/vpnserver/run_mounts/config/config.env.sample -# force use of boringtun over wireguard kernel module -export USE_WG_KERNEL_MOD=false - # replace VPN_SERVER_PUBLIC_ADDR by the public IP or DNS name # of the host (virtual) machine hosting vpn server # eg : VPN_SERVER_PUBLIC_ADDR=192.168.1.1 From 09eac4842fe4d5c05a9e5dd74e01df85ed6c6492 Mon Sep 17 00:00:00 2001 From: Michelle Wang Date: Mon, 2 Nov 2026 15:36:19 -0500 Subject: [PATCH 2/4] fix hardcoded VPN server port --- .env.example | 3 +++ README.md | 2 +- docker-compose.yml | 4 +++- vpnserver_config/config.env.sample | 1 - 4 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.env.example b/.env.example index ec7244f..dd187aa 100644 --- a/.env.example +++ b/.env.example @@ -18,3 +18,6 @@ FBM_CONTAINER_INSTANCE_ID=default # Timezone of the researcher container. If unset, UTC will be used TZ=America/Montreal + +# UDP port of the VPN server. If unset, 51820 is used +#VPN_SERVER_PORT=51820 diff --git a/README.md b/README.md index fe338ff..7d92165 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ The server runs with Docker Compose as three containers: ### Requirements - Docker with the Compose plugin (`docker compose`) -- Inbound UDP access to port 51820, for the nodes to reach the VPN server +- Inbound UDP access to port 51820 (or `VPN_SERVER_PORT` in `.env`), for the nodes to reach the VPN server ### Setup diff --git a/docker-compose.yml b/docker-compose.yml index 0428630..d013739 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -23,10 +23,12 @@ services: - /dev/net/tun # needed to handle wireguard interface sysctls: - net.ipv4.ip_forward=1 # relay traffic between VPN peers + environment: + - VPN_SERVER_PORT=${VPN_SERVER_PORT:-51820} volumes: - ./vpnserver_config:/config # contains VPN configurations ports: - - 51820:51820/udp # wireguard server + - ${VPN_SERVER_PORT:-51820}:${VPN_SERVER_PORT:-51820}/udp # wireguard server # separate network: clients on the same docker network cannot reach the # server through the host's published port networks: diff --git a/vpnserver_config/config.env.sample b/vpnserver_config/config.env.sample index bad9ce9..c996219 100644 --- a/vpnserver_config/config.env.sample +++ b/vpnserver_config/config.env.sample @@ -7,7 +7,6 @@ # of the host (virtual) machine hosting vpn server # eg : VPN_SERVER_PUBLIC_ADDR=192.168.1.1 export VPN_SERVER_PUBLIC_ADDR=replace_with.myserver.mydomain -export VPN_SERVER_PORT=51820 export VPN_IP=10.220.0.1 export VPN_SUBNET_PREFIX=14 From a0f35cca66565c45d8a37b995def70ccdf733163 Mon Sep 17 00:00:00 2001 From: Michelle Wang Date: Mon, 2 Nov 2026 17:24:13 -0500 Subject: [PATCH 3/4] remove placeholder value for VPN_SERVER_PUBLIC_ADDR --- vpnserver_config/config.env.sample | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/vpnserver_config/config.env.sample b/vpnserver_config/config.env.sample index c996219..5a1fab8 100644 --- a/vpnserver_config/config.env.sample +++ b/vpnserver_config/config.env.sample @@ -3,10 +3,9 @@ # Adapted from Fed-BioMed (Apache-2.0): # https://github.com/fedbiomed/fedbiomed/blob/v6.4.1/envs/vpn/docker/vpnserver/run_mounts/config/config.env.sample -# replace VPN_SERVER_PUBLIC_ADDR by the public IP or DNS name -# of the host (virtual) machine hosting vpn server +# required: public IP or DNS name of the machine hosting the VPN server, # eg : VPN_SERVER_PUBLIC_ADDR=192.168.1.1 -export VPN_SERVER_PUBLIC_ADDR=replace_with.myserver.mydomain +export VPN_SERVER_PUBLIC_ADDR= export VPN_IP=10.220.0.1 export VPN_SUBNET_PREFIX=14 From fdc6d0cc097f08f2eb4df4f3e297ced9dafc4667 Mon Sep 17 00:00:00 2001 From: Michelle Wang Date: Mon, 2 Nov 2026 23:51:06 -0500 Subject: [PATCH 4/4] use published ghcr images --- README.md | 6 +++--- docker-compose.yml | 12 ++---------- 2 files changed, 5 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index 7d92165..31e9616 100644 --- a/README.md +++ b/README.md @@ -29,10 +29,10 @@ The server runs with Docker Compose as three containers: cp vpnserver_config/config.env.sample vpnserver_config/config.env ``` -3. Build and start the VPN server: +3. Start the VPN server: ```bash - docker compose up -d --build vpn-server + docker compose up -d vpn-server ``` 4. Create the researcher peer and copy its configuration to the researcher VPN client: @@ -45,7 +45,7 @@ The server runs with Docker Compose as three containers: 5. Start the researcher: ```bash - docker compose up -d --build + docker compose up -d ``` 6. Register the public key of the researcher on the VPN server: diff --git a/docker-compose.yml b/docker-compose.yml index d013739..15b3450 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -11,12 +11,7 @@ services: vpn-server: container_name: brainflex-vpn-server-${FBM_CONTAINER_INSTANCE_ID:-default} hostname: brainflex-vpn-server-${FBM_CONTAINER_INSTANCE_ID:-default} - build: - context: https://github.com/neurodatascience/brainflex.git#main:docker/vpn-server - additional_contexts: - vpn-client: service:researcher-vpn # base image - image: brainflex/vpn-server:local - pull_policy: build + image: ghcr.io/neurodatascience/brainflex-vpn-server:0.1.0@sha256:29e6463ae5696478913ff0c0973729c10af426f6507ecdb27f6c0be38038a1fd cap_add: - net_admin # needed to handle wireguard interface devices: @@ -43,10 +38,7 @@ services: researcher-vpn: container_name: brainflex-researcher-vpn-${FBM_CONTAINER_INSTANCE_ID:-default} hostname: brainflex-researcher-${FBM_CONTAINER_INSTANCE_ID:-default} - build: - context: https://github.com/neurodatascience/brainflex.git#main:docker/vpn-client - image: brainflex/vpn-client:local - pull_policy: build + image: ghcr.io/neurodatascience/brainflex-vpn-client:0.1.0@sha256:1c353258abde508771422e71384301aea88915b2f34bd2e236f3c8a9ab250de4 cap_add: - net_admin # needed to handle wireguard interface devices: