wiredoor/wiredoor-cli repository overview

Expose private services securely through reverse VPN tunnel powered by WireGuard and NGINX.

Documentation⁠ • CLI⁠ • Helm Charts⁠

Wiredoor is a self-hosted, open-source ingress-as-a-service platform that allows you to expose applications and services running in private or local networks to the internet—securely, reliably, and without complex infrastructure.

⁠Usage

The Wiredoor Docker Gateway is a lightweight container that connects to your Wiredoor Server as a gateway node, allowing you to expose services publicly from other containers in the same Docker network.

This is especially useful for self-contained Docker stacks where you want to route traffic to one or multiple services from public internet.

⁠How it Works

• The wiredoor-gateway container connects to your Wiredoor Server using the gateway node token.
• It establishes a secure WireGuard VPN tunnel.
• Any service running inside the defined subnet (in this case 172.18.50.0/24) can be exposed through Wiredoor — as long as the gateway container can reach it.

⁠Service Name Resolution

The wiredoor-gateway image includes a preconfigured service that allows you to resolve services in your Docker Compose stack by name, just like internal DNS inside Docker.

This means that when exposing services through Wiredoor, you don't need to know the internal IPs of your containers — you can simply use their service name (e.g. wordpress, app1, etc.).

⁠Exposing services from docker-compose.yml stack

Here is a full example using Wiredoor Gateway with multiple services:

networks:
  wiredoor:
    driver: bridge
    ipam:
      config:
        - subnet: 172.18.50.0/24 # Make sure that this match with Gateway Subnet defined in your wiredoor gateway node
  stack:

services:
  wiredoor-gw:
    image: wiredoor/wiredoor-cli:latest
    cap_add:
      - NET_ADMIN
    sysctls:
      - net.ipv4.ip_forward=1
    environment:
      WIREDOOR_URL: https://your-wiredoor-instance_or_ip
      TOKEN: your-gateway-node-token
    networks:
      - wiredoor
  
  wordpress:
    image: wordpress
    restart: always
    ports:
      - 8080:80
    environment:
      WORDPRESS_DB_HOST: db
      WORDPRESS_DB_USER: exampleuser
      WORDPRESS_DB_PASSWORD: examplepass
      WORDPRESS_DB_NAME: exampledb
    volumes:
      - wordpress:/var/www/html
    networks:
      - wiredoor
      - stack

  db:
    image: mysql:8.0
    restart: always
    environment:
      MYSQL_DATABASE: exampledb
      MYSQL_USER: exampleuser
      MYSQL_PASSWORD: examplepass
      MYSQL_RANDOM_ROOT_PASSWORD: '1'
    volumes:
      - db:/var/lib/mysql
    networks:
      - stack

volumes:
  wordpress:
  db:

⁠Tips and Best Practices

• Always assign the gateway and target containers to the same Docker network
• Define a custom subnet to have predictable IPs (helps debugging and restrictions)
• Use valid DNS-compatible container names (lowercase, no spaces)
• Restart the stack if you update network configs or the gateway image

⁠Troubleshooting