From 31707cfaef70c1b672de8a5e39d6fbe38108efb4 Mon Sep 17 00:00:00 2001
From: datadunia <datadunia@ymail.com>
Date: Thu, 28 May 2026 13:31:24 +0700
Subject: [PATCH] =?UTF-8?q?feat:=20server-core=20=E2=86=92=20network=5Fmod?=
 =?UTF-8?q?e=20host=20for=20direct=20WireGuard=20routing?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- docker-compose.yml: server-core uses host network (no bridge isolation)
- docker-compose.yml: postgres/redis expose ports on 127.0.0.1 only
- docker-compose.dev.yml: also uses host network
- WireGuard now runs on host network stack (wg show works on host)
- nftables rules apply directly to host (proper peer isolation)
---
 docker-compose.dev.yml |  4 ++--
 docker-compose.yml     | 17 ++++++++---------
 2 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index a0df063..6eee033 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -1,4 +1,3 @@
-
 services:
   server-core:
     build:
@@ -8,5 +7,6 @@ services:
     command: ["sh", "-c", "go install github.com/air-verse/air@latest && air"]
     volumes:
       - ./apps/server-core:/app
+    network_mode: host
     environment:
-      - GIN_MODE=debug
+      - GIN_MODE=debug
\ No newline at end of file
diff --git a/docker-compose.yml b/docker-compose.yml
index 4b8288c..91915f1 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,4 +1,3 @@
-
 services:
   postgres:
     image: postgres:16-alpine
@@ -8,6 +7,8 @@ services:
       POSTGRES_DB: nexusguard
     volumes:
       - pgdata:/var/lib/postgresql/data
+    ports:
+      - "127.0.0.1:5432:5432"
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U nexusguard"]
       interval: 5s
@@ -21,6 +22,8 @@ services:
     image: redis:7-alpine
     volumes:
       - redisdata:/data
+    ports:
+      - "127.0.0.1:6379:6379"
     healthcheck:
       test: ["CMD", "redis-cli", "ping"]
       interval: 5s
@@ -34,20 +37,19 @@ services:
     build:
       context: ./apps/server-core
       dockerfile: Dockerfile
+    network_mode: host
     environment:
-      - DB_HOST=postgres
+      - DB_HOST=127.0.0.1
       - DB_PORT=5432
       - DB_USER=nexusguard
       - DB_PASSWORD=${DB_PASSWORD:-nexusguard}
       - DB_NAME=nexusguard
-      - REDIS_ADDR=redis:6379
+      - REDIS_ADDR=127.0.0.1:6379
       - JWT_SECRET=${JWT_SECRET:-changeme}
       - SERVER_SALT=${SERVER_SALT:-changeme}
       - NFTABLES_TABLE=nexusguard
       - IPAM_POOL=10.8.0.0/16
       - GIN_MODE=release
-    ports:
-      - "${API_PORT:-8080}:8080"
     depends_on:
       postgres:
         condition: service_healthy
@@ -57,15 +59,12 @@ services:
       - NET_ADMIN
       - NET_RAW
     restart: unless-stopped
-    networks:
-      - nexusnet
 
   dashboard-ui:
     build:
       context: ./apps/dashboard-ui
       dockerfile: Dockerfile
       args:
-        # Inject the root .env variable into the frontend build process
         VITE_API_BASE_URL: ${VITE_API_BASE_URL}
     ports:
       - "${WEB_PORT:-80}:80"
@@ -81,4 +80,4 @@ volumes:
 
 networks:
   nexusnet:
-    driver: bridge
+    driver: bridge
\ No newline at end of file