vh
398b58a161
wgtunnel deployed + accepted end-to-end (tunnel-dev): erebe/wstunnel v10.6.2 behind traefik on ana-docker, Host boring.phasefinal.com (Mode A anaprod cert), --restrict-to ana-wg:31337 (not an open relay). Mirror per fleet convention; full project in vh/wgtunnel.
wgtunnel — obfuscated WireGuard front (server stack)
The server-side stack for wgtunnel: a WireGuard tunnel that survives captive-portal /
DPI networks (airplane, hotel) by wrapping WG in WebSocket-over-TLS on :443.
This is the erebe/wstunnel server behind traefik on ana-docker. traefik terminates
TLS for boring.phasefinal.com (Mode A, anaprod Let's Encrypt cert) and forwards the
WebSocket to this container, which unwraps it to UDP and delivers it to the WireGuard server
at ana-wg (10.250.50.252:31337). --restrict-to pins the only forwarding target, so it
is not an open relay.
- Host: ana-docker (
10.250.50.70), on the externaltraefik-net. - Public path:
boring.phasefinal.com(DNS-only CNAME →ana-srv1.phasefinal.com→38.120.12.44, never Cloudflare-proxied) → traefik:443→ this container →ana-wg:31337. - Image:
ghcr.io/erebe/wstunnel(pinned via.env, never:latest). - Healthcheck: greps
/proc/net/tcpfor the listener (the image has nonc/curland dash lacks/dev/tcp).
Deploy
# canonical: stacks/wgtunnel/ -> /opt/docker/compose/wgtunnel/ on ana-docker
scripts/deploy-stack.sh ana-docker wgtunnel # diffs vs live, prompts y/N
# on the host: cp .env.example .env (adjust), then: docker compose up -d
Full project
The complete wgtunnel project (client-side bring-up, captive-portal handling, design docs)
lives in its own repo, vh/wgtunnel (~/development/wgtunnel). This directory mirrors
only the deployed server stack for fleet-convention drift tracking.
Author: Vuong Hoang.