feat: add WireGuard VPN stack with wg-easy

ai/Dockerfile

@@ -1,23 +0,0 @@
-FROM debian:13.4
-
-# Install uv (Python package manager), curl, poppler-utils, and imagemagick
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-        curl \
-        poppler-utils \
-        imagemagick && \
-    rm -rf /var/lib/apt/lists/*
-
-# Install uv if not already present (debian:13.4 doesn't ship it)
-COPY --from=ghcr.io/astral-sh/uv:latest /usr/local/bin/uv /usr/local/bin/uv
-RUN uv --version
-
-# Verify all expected tools are available
-RUN curl --version && \
-    pdftotext -v 2>&1 | head -1 && \
-    pdfinfo -v 2>&1 | head -1 && \
-    pdftoppm -v 2>&1 | head -1 && \
-    convert --version | head -1 && \
-    identify --version | head -1
-
-CMD ["/bin/bash"]

env/.env.example.paperclip

@@ -1,26 +0,0 @@
-# Paperclip Environment Variables
-# Copy this file to your .env (at the compose root or docker-compose working directory)
-# and fill in the secrets.
-#
-#   cp env/.env.example.paperclip .env
-#
-# Then reference it from compose.yml:
-#   env_file:
-#     - path: .env
-#       required: true
-
-# ---------------------------------------------------------------------------
-# Database
-# ---------------------------------------------------------------------------
-# PostgreSQL password for the paperclip-db service.
-# Generate a strong random password:
-#   openssl rand -base64 32
-PAPERCLIP_DB_PASSWORD=change_me_to_a_strong_random_password
-
-# ---------------------------------------------------------------------------
-# Authentication
-# ---------------------------------------------------------------------------
-# Secret key used by Better Auth for signing and verifying tokens.
-# Generate a strong random secret:
-#   openssl rand -base64 32
-PAPERCLIP_AUTH_SECRET=change_me_to_a_strong_random_secret

vpn/compose.yml

@@ -0,0 +1,35 @@
+version: "3.8"
+
+services:
+  wg-easy:
+    image: weejewel/wg-easy:latest
+    container_name: wg-easy
+    cap_add:
+      - NET_ADMIN
+      - SYS_MODULE
+    environment:
+      - WG_HOST=vpn.lazyworkhorse.net
+      - PASSWORD=${WG_PASSWORD}
+      - WG_PORT=51820
+      - WG_DEFAULT_ADDRESS=10.8.0.x
+      - WG_DEFAULT_DNS=1.1.1.1,8.8.8.8
+      - WG_ALLOWED_IPS=0.0.0.0/0, ::/0
+      - WG_PERSISTENT_KEEPALIVE=25
+      - UI_TRAFFIC_STATS=true
+      - UI_CHART_TYPE=0
+    ports:
+      - "51820:51820/udp"
+      - "51821:51821/tcp"
+    volumes:
+      - /mnt/HoardingCow_docker_data/WireGuard:/etc/wireguard:rw
+    sysctls:
+      - net.ipv4.conf.all.src_valid_mark=1
+      - net.ipv4.ip_forward=1
+    restart: unless-stopped
+    networks:
+      - vpn_net
+
+networks:
+  vpn_net:
+    external: true
+    name: vpn_net