vh
398b58a161
wgtunnel deployed + accepted end-to-end (tunnel-dev): erebe/wstunnel v10.6.2 behind traefik on ana-docker, Host boring.phasefinal.com (Mode A anaprod cert), --restrict-to ana-wg:31337 (not an open relay). Mirror per fleet convention; full project in vh/wgtunnel.
34 lines
1.6 KiB
Markdown
34 lines
1.6 KiB
Markdown
# wgtunnel — obfuscated WireGuard front (server stack)
|
|
|
|
The server-side stack for **wgtunnel**: a WireGuard tunnel that survives captive-portal /
|
|
DPI networks (airplane, hotel) by wrapping WG in WebSocket-over-TLS on `:443`.
|
|
|
|
This is the **`erebe/wstunnel` server** behind traefik on **ana-docker**. traefik terminates
|
|
TLS for `boring.phasefinal.com` (Mode A, `anaprod` Let's Encrypt cert) and forwards the
|
|
WebSocket to this container, which unwraps it to UDP and delivers it to the WireGuard server
|
|
at `ana-wg` (`10.250.50.252:31337`). `--restrict-to` pins the only forwarding target, so it
|
|
is **not an open relay**.
|
|
|
|
- **Host:** ana-docker (`10.250.50.70`), on the external `traefik-net`.
|
|
- **Public path:** `boring.phasefinal.com` (DNS-only CNAME → `ana-srv1.phasefinal.com` →
|
|
`38.120.12.44`, never Cloudflare-proxied) → traefik `:443` → this container → `ana-wg:31337`.
|
|
- **Image:** `ghcr.io/erebe/wstunnel` (pinned via `.env`, never `:latest`).
|
|
- **Healthcheck:** greps `/proc/net/tcp` for the listener (the image has no `nc`/`curl` and
|
|
dash lacks `/dev/tcp`).
|
|
|
|
## Deploy
|
|
|
|
```bash
|
|
# canonical: stacks/wgtunnel/ -> /opt/docker/compose/wgtunnel/ on ana-docker
|
|
scripts/deploy-stack.sh ana-docker wgtunnel # diffs vs live, prompts y/N
|
|
# on the host: cp .env.example .env (adjust), then: docker compose up -d
|
|
```
|
|
|
|
## Full project
|
|
|
|
The complete wgtunnel project (client-side bring-up, captive-portal handling, design docs)
|
|
lives in its own repo, **`vh/wgtunnel`** (`~/development/wgtunnel`). This directory mirrors
|
|
only the deployed server stack for fleet-convention drift tracking.
|
|
|
|
Author: Vuong Hoang.
|