# wgtunnel server stack — host env template.
# Copy to `.env` next to compose.yaml on ana-docker and adjust as needed.
# This template is committed; the real `.env` is gitignored (it is not secret
# today, but the pattern keeps host-specific values out of git).

# Pinned erebe/wstunnel image tag. NEVER :latest. (v10.6.2 verified as the current
# stable release, and `server --restrict-to <DEST:PORT>` confirmed against its --help.)
WGTUNNEL_IMAGE_TAG=v10.6.2

# The WireGuard endpoint wstunnel unwraps to (ana-wg). `--restrict-to` enforces
# that the server forwards only here — it is not an open relay.
WG_TARGET=10.250.50.252:31337

# Public hostname — a deliberately innocuous SNI. DNS-only CNAME to the colo edge
# (ana-srv1.phasefinal.com); never Cloudflare-proxied.
TUNNEL_HOST=boring.phasefinal.com

# Internal plain-WebSocket port the container listens on; traefik forwards here.
WSTUNNEL_PORT=8080