# wgtunnel — obfuscated WireGuard front (server stack)

The server-side stack for **wgtunnel**: a WireGuard tunnel that survives captive-portal /
DPI networks (airplane, hotel) by wrapping WG in WebSocket-over-TLS on `:443`.

This is the **`erebe/wstunnel` server** behind traefik on **ana-docker**. traefik terminates
TLS for `boring.phasefinal.com` (Mode A, `anaprod` Let's Encrypt cert) and forwards the
WebSocket to this container, which unwraps it to UDP and delivers it to the WireGuard server
at `ana-wg` (`10.250.50.252:31337`). `--restrict-to` pins the only forwarding target, so it
is **not an open relay**.

- **Host:** ana-docker (`10.250.50.70`), on the external `traefik-net`.
- **Public path:** `boring.phasefinal.com` (DNS-only CNAME → `ana-srv1.phasefinal.com` →
  `38.120.12.44`, never Cloudflare-proxied) → traefik `:443` → this container → `ana-wg:31337`.
- **Image:** `ghcr.io/erebe/wstunnel` (pinned via `.env`, never `:latest`).
- **Healthcheck:** greps `/proc/net/tcp` for the listener (the image has no `nc`/`curl` and
  dash lacks `/dev/tcp`).

## Deploy

```bash
# canonical: stacks/wgtunnel/  ->  /opt/docker/compose/wgtunnel/ on ana-docker
scripts/deploy-stack.sh ana-docker wgtunnel      # diffs vs live, prompts y/N
# on the host: cp .env.example .env (adjust), then: docker compose up -d
```

## Full project

The complete wgtunnel project (client-side bring-up, captive-portal handling, design docs)
lives in its own repo, **`vh/wgtunnel`** (`~/development/wgtunnel`). This directory mirrors
only the deployed server stack for fleet-convention drift tracking.

Author: Vuong Hoang.