Domoticz docker under Wireguard

[acaonweb]

hi, recently I've discovered an issue.
i've wireguard server for my lan, and I can access to my lan from remote, I can reach zigbee server, portainer server, node red server, etc
but not my domoticz server
domoticz is into a container

it's the only server I can't reach.
i suppose that is something related to domoticz container, but I cant find a way to resolve it
I attach domoticz and wg-easy stacks compose.

Domoticz info
Version: 2025.2 (build 16818)
Build Hash: 2f9016a8b
Compile Date: 2025-10-19 11:41:46
dzVents Version: 3.1.8
Python Version: 3.11.2 (main, Apr 28 2025, 14:11:48) [GCC 12.2.0]
Active User: pi


Thanx for any suggestion and help
Fabrizio


domoticz stack

Code: Select all

version: '3.8'

services:
  domoticz:
    image: domoticz/domoticz:stable
    container_name: domoticz
    restart: unless-stopped
    depends_on:
      - mosquitto
    networks:
      myNetwork:
        ipv4_address: ---.---.---.153
    ports:
      - "8080:8080"
    volumes:
      - /srv/dev-disk-by-uuid-36662cd8-800d-4017-83bc-40f63d06148e/domoticz:/opt/domoticz/userdata

  mosquitto:
    image: eclipse-mosquitto
    container_name: mosquitto
    restart: always
    volumes:
      - /srv/dev-disk-by-uuid-36662cd8-800d-4017-83bc-40f63d06148e/mqtt/config:/mosquitto/config
      - /srv/dev-disk-by-uuid-36662cd8-800d-4017-83bc-40f63d06148e/mqtt/data:/mosquitto/data
      - /srv/dev-disk-by-uuid-36662cd8-800d-4017-83bc-40f63d06148e/mqtt/log:/mosquitto/log
    networks:
      myNetwork:
        ipv4_address: ---.---.---,160
    ports:
      - 1883:1883
      - 9001:9001
    stdin_open: true 
    tty: true

  homebridge:
    image: homebridge/homebridge:ubuntu
    container_name: homebridge-dz
    restart: always
    depends_on:
      - domoticz
    
    # network_mode: host
    networks:
      myNetwork:
        ipv4_address: ---.---.---.142 #add ip here

    ports: 
      - "1968:1968"
              
    environment:
      - HOMEBRIDGE_CONFIG_UI_PORT=1968
    volumes:
      - /srv/dev-disk-by-uuid-83b6a8f9-5b92-4b9f-ab73-81c3cf7cc424/homebridge:/homebridge
      
networks:
  myNetwork:
    external: true
    name: myNetwork
    
    

wg-easy

Code: Select all

volumes:
  etc_wireguard:

services:
  wg-easy:
    environment:
      # Change Language:
      # (Supports: en, ua, ru, tr, no, pl, fr, de, ca, es, ko, vi, nl, is, pt, chs, cht, it, th, hi)
      - LANG=it
      # ⚠️ Required:
      # Change this to your host's public address
      - WG_HOST=---.---.----.168

      # Optional:
      - PASSWORD_HASH=$-------------------------------------------------------------------------------------------------- see "How_to_generate_an_bcrypt_hash.md" for generate the hash)
      - PORT=51821
      - WG_PORT=51821
      # - WG_CONFIG_PORT=92820
      # - WG_DEFAULT_ADDRESS=10.8.0.x
      # - WG_DEFAULT_DNS=1.1.1.1
      # - WG_MTU=1420
      - WG_ALLOWED_IPS=---.---.---.0/24
      # - WG_PERSISTENT_KEEPALIVE=25
      # - WG_PRE_UP=echo "Pre Up" > /etc/wireguard/pre-up.txt
      # - WG_POST_UP=echo "Post Up" > /etc/wireguard/post-up.txt
      # - WG_PRE_DOWN=echo "Pre Down" > /etc/wireguard/pre-down.txt
      # - WG_POST_DOWN=echo "Post Down" > /etc/wireguard/post-down.txt
      # - UI_TRAFFIC_STATS=true
      # - UI_CHART_TYPE=0 # (0 Charts disabled, 1 # Line chart, 2 # Area chart, 3 # Bar chart)
      # - UI_SHOW_LINKS=true
      # - UI_ENABLE_SORT_CLIENTS=true

    image: ghcr.io/wg-easy/wg-easy
    container_name: wg-easy
    volumes:
      - etc_wireguard:/etc/wireguard
    ports:
      - "51821:51821/udp"
      - "51821:51821/tcp"
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
      # - NET_RAW # ⚠️ Uncomment if using Podman
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1

[gizmocuz]

You did not discovered an issue, you have an issue

Using domoticz via wireguard for many years without issue.

You should not need to give each container a fixed IP address, your machine probably already has a fixed address that you configured in your router

Do you need a external network?

[acaonweb]

ok, maybe only me have this issue, but:
1) consider that I have a lot of docker stacks with their external IP that works great under VPN (domoticz is the only one)
2) my docker host IP has 8080 port not available
3) changing the domoticz port force me to change more than 20 scripts/nodered/python
4) I like to have organized in this way my servers

I can reach my docker frontend with a cloudflare tunnel, but VPN is a good "plan b" when cloud flare isn't ON

Have you some suggestion?

Thanx in advance
Fabrizio

[jannl]

Same here works great, like gizmocuz says.

Wireguard VPN on my fritzbox, pi has a fix IP, docker just runs. I added my whole internal subnet to Domoticz and because the VPN range is in that, never had a problem with that. Even with other VPN's like OpenVPN and and ipsec tunnel.

[acaonweb]

but you don't have an macvlan network in docker make domoticz container expose its own IP address, right?

[jannl]

but you don't have an macvlan network in docker make domoticz container expose its own IP address, right?

Nope.

I read a docker-host can not standard communicate with a macvlan without additional settings. KISS is my way to go.