[MAINT] Docker updates

.env.example

@@ -18,3 +18,6 @@ FBM_CONTAINER_INSTANCE_ID=default
 
 # Timezone of the researcher container. If unset, UTC will be used
 TZ=America/Montreal
+
+# UDP port of the VPN server. If unset, 51820 is used
+#VPN_SERVER_PORT=51820

README.md

@@ -13,7 +13,7 @@ The server runs with Docker Compose as three containers:
 ### Requirements
 
 - Docker with the Compose plugin (`docker compose`)
-- Inbound UDP access to port 51820, for the nodes to reach the VPN server
+- Inbound UDP access to port 51820 (or `VPN_SERVER_PORT` in `.env`), for the nodes to reach the VPN server
 
 ### Setup
 
@@ -29,10 +29,10 @@ The server runs with Docker Compose as three containers:
    cp vpnserver_config/config.env.sample vpnserver_config/config.env
    ```
 
-3. Build and start the VPN server:
+3. Start the VPN server:
 
    ```bash
-   docker compose up -d --build vpn-server
+   docker compose up -d vpn-server
    ```
 
 4. Create the researcher peer and copy its configuration to the researcher VPN client:
@@ -45,7 +45,7 @@ The server runs with Docker Compose as three containers:
 5. Start the researcher:
 
    ```bash
-   docker compose up -d --build
+   docker compose up -d
    ```
 
 6. Register the public key of the researcher on the VPN server:

docker-compose.yml

@@ -11,23 +11,19 @@ services:
   vpn-server:
     container_name: brainflex-vpn-server-${FBM_CONTAINER_INSTANCE_ID:-default}
     hostname: brainflex-vpn-server-${FBM_CONTAINER_INSTANCE_ID:-default}
-    build:
-      context: https://github.com/neurodatascience/brainflex.git#main:docker/vpn-server
-      additional_contexts:
-        vpn-client: service:researcher-vpn # base image
-    image: brainflex/vpn-server:local
-    pull_policy: build
+    image: ghcr.io/neurodatascience/brainflex-vpn-server:0.1.0@sha256:29e6463ae5696478913ff0c0973729c10af426f6507ecdb27f6c0be38038a1fd
     cap_add:
       - net_admin # needed to handle wireguard interface
-      - sys_module # needed to remove wireguard kernel module
     devices:
       - /dev/net/tun # needed to handle wireguard interface
     sysctls:
       - net.ipv4.ip_forward=1 # relay traffic between VPN peers
+    environment:
+      - VPN_SERVER_PORT=${VPN_SERVER_PORT:-51820}
     volumes:
       - ./vpnserver_config:/config # contains VPN configurations
     ports:
-      - 51820:51820/udp # wireguard server
+      - ${VPN_SERVER_PORT:-51820}:${VPN_SERVER_PORT:-51820}/udp # wireguard server
     # separate network: clients on the same docker network cannot reach the
     # server through the host's published port
     networks:
@@ -42,13 +38,9 @@ services:
   researcher-vpn:
     container_name: brainflex-researcher-vpn-${FBM_CONTAINER_INSTANCE_ID:-default}
     hostname: brainflex-researcher-${FBM_CONTAINER_INSTANCE_ID:-default}
-    build:
-      context: https://github.com/neurodatascience/brainflex.git#main:docker/vpn-client
-    image: brainflex/vpn-client:local
-    pull_policy: build
+    image: ghcr.io/neurodatascience/brainflex-vpn-client:0.1.0@sha256:1c353258abde508771422e71384301aea88915b2f34bd2e236f3c8a9ab250de4
     cap_add:
       - net_admin # needed to handle wireguard interface
-      - sys_module # needed to remove wireguard kernel module
     devices:
       - /dev/net/tun # needed to handle wireguard interface
     volumes:

vpnserver_config/config.env.sample

@@ -3,14 +3,9 @@
 # Adapted from Fed-BioMed (Apache-2.0):
 # https://github.com/fedbiomed/fedbiomed/blob/v6.4.1/envs/vpn/docker/vpnserver/run_mounts/config/config.env.sample
 
-# force use of boringtun over wireguard kernel module
-export USE_WG_KERNEL_MOD=false
-
-# replace VPN_SERVER_PUBLIC_ADDR by the public IP or DNS name
-# of the host (virtual) machine hosting vpn server
+# required: public IP or DNS name of the machine hosting the VPN server,
 # eg : VPN_SERVER_PUBLIC_ADDR=192.168.1.1
-export VPN_SERVER_PUBLIC_ADDR=replace_with.myserver.mydomain
-export VPN_SERVER_PORT=51820
+export VPN_SERVER_PUBLIC_ADDR=
 
 export VPN_IP=10.220.0.1
 export VPN_SUBNET_PREFIX=14