ksantd/wg-gateway repository overview

docker run -d \
  --name wg-gateway \
  --network host \
  --cap-add NET_ADMIN \
  --cap-add SYS_MODULE \
  --device /dev/net/tun \
  -e WG_HOST=YOUR_PUBLIC_IP \
  -e WG_EASY_INIT_PASSWORD=YOUR_ADMIN_PASSWORD \
  -v /path/to/wireguard:/data/wireguard \
  -v /path/to/mihomo:/data/mihomo \
  ksantd/wg-gateway:latest
See GitHub (https://github.com/sers88/wg-gateway) for full docs, docker-compose, and Unraid template.
What's inside
Component	Purpose
wg-easy v15	WireGuard server + peer management UI
Mihomo v1.19.25	Proxy/routing engine (TUN mode)
metacubexd v1.248.1	Modern web dashboard for Mihomo
Architecture
WireGuard Client → wg0 → Policy Routing → Mihomo TUN → PROXY or DIRECT → Internet
                          (table 666)
Only WireGuard client traffic enters the proxy engine — host traffic is unaffected.
Key features
Host networking — required for WireGuard kernel module + TUN device + policy routing
Policy routing — custom ip rule / ip route table isolates WG traffic to Mihomo TUN
Auto-restore — routing daemon re-applies rules if services restart
Unraid ready — includes Community Applications template
License
MIT. Bundles wg-easy (AGPL-3.0), Mihomo (GPL-3.0), metacubexd (MIT).