Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions blueprints/wings/docker-compose.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
version: '3.8'

services:
wings:
image: ghcr.io/pterodactyl/wings:v1.11.11 # latest version (v1.12.0) doesnt work - https://github.com/pterodactyl/panel/pull/5324
restart: always
ports:
- 8080
- 2022
Comment thread
zaralX marked this conversation as resolved.
tty: true
environment:
TZ: "UTC"
WINGS_UID: 988
WINGS_GID: 988
WINGS_USERNAME: pterodactyl
volumes:
- "/var/run/docker.sock:/var/run/docker.sock"
- "/var/lib/docker/containers/:/var/lib/docker/containers/"
- "/etc/wings/:/etc/pterodactyl/"
- "/var/lib/pterodactyl/:/var/lib/pterodactyl/"
- "/var/log/pterodactyl/:/var/log/pterodactyl/"
- "/tmp/pterodactyl/:/tmp/pterodactyl/"
- "/etc/ssl/certs:/etc/ssl/certs:ro"
Comment on lines +16 to +23
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Host bind mounts expose sensitive host paths

This template mounts the Docker socket (/var/run/docker.sock) and several host directories directly. While this is required for Wings to manage game server containers, it effectively grants the container full Docker daemon access and read/write to host paths. This is a significant security surface — users deploying this template should be aware that Wings requires these elevated privileges by design.

Additionally, the host path mounts (e.g., /etc/wings/, /var/lib/pterodactyl/) are not using named Docker volumes, which means they depend on specific host directory structures. Consider adding a comment at the top of the compose file explaining these requirements and the security implications, similar to how other templates (e.g., crowdsec) document their prerequisites.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

labels:
- "traefik.enable=true"
- "traefik.http.routers.c1.rule=Host(`your.wings.domain`)"
- "traefik.http.routers.c1.entrypoints=websecure"
Comment on lines +24 to +27
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why do we need this?

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why do we need this?

founded this on pterodactyl discord

- "traefik.http.services.c1.loadbalancer.server.port=8080"
- "traefik.http.routers.c1.tls=true"
- "traefik.http.middlewares.c1-headers.headers.customrequestheaders.X-Forwarded-Proto=https"
- "traefik.http.routers.c1.middlewares=c1-headers"
- "traefik.http.services.c1.loadbalancer.server.scheme=https"
- "traefik.http.routers.c1.tls.certresolver=myresolver"
Comment on lines +24 to +33
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Traefik labels conflict with Dokploy's routing

These Traefik labels are redundant and potentially problematic. Dokploy manages its own Traefik routing configuration based on the [[config.domains]] section in template.toml. Including hardcoded Traefik labels with a placeholder domain (your.wings.domain) and a cert resolver (myresolver) will likely conflict with Dokploy's automatic routing setup.

The template.toml already correctly configures domain routing for port 8080. This entire labels block should be removed:

Suggested change
labels:
- "traefik.enable=true"
- "traefik.http.routers.c1.rule=Host(`your.wings.domain`)"
- "traefik.http.routers.c1.entrypoints=websecure"
- "traefik.http.services.c1.loadbalancer.server.port=8080"
- "traefik.http.routers.c1.tls=true"
- "traefik.http.middlewares.c1-headers.headers.customrequestheaders.X-Forwarded-Proto=https"
- "traefik.http.routers.c1.middlewares=c1-headers"
- "traefik.http.services.c1.loadbalancer.server.scheme=https"
- "traefik.http.routers.c1.tls.certresolver=myresolver"

If custom Traefik configuration is genuinely needed beyond what Dokploy provides, it should be documented clearly, but in this case the template.toml domain configuration is sufficient.

Binary file added blueprints/wings/pterodactyl.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
11 changes: 11 additions & 0 deletions blueprints/wings/template.toml
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
[variables]
main_domain = "${domain}"

[config]
env = []
mounts = []

[[config.domains]]
serviceName = "wings"
port = 8080
host = "${main_domain}"
16 changes: 16 additions & 0 deletions meta.json
Original file line number Diff line number Diff line change
Expand Up @@ -6204,6 +6204,22 @@
"os"
]
},
{
"id": "wings",
"name": "Pterodactyl Wings",
"version": "v1.11.11",
"description": "The server control plane for Pterodactyl Panel. Written from the ground-up with security, speed, and stability in mind.",
"logo": "pterodactyl.png",
"links": {
"github": "https://github.com/pterodactyl/wings",
"website": "https://pterodactyl.io",
"docs": "https://pterodactyl.io/project/introduction.html"
},
"tags": [
"self-hosted",
"open-source"
]
},
{
"id": "wordpress",
"name": "Wordpress",
Expand Down