vh
398b58a161
wgtunnel deployed + accepted end-to-end (tunnel-dev): erebe/wstunnel v10.6.2 behind traefik on ana-docker, Host boring.phasefinal.com (Mode A anaprod cert), --restrict-to ana-wg:31337 (not an open relay). Mirror per fleet convention; full project in vh/wgtunnel.
20 lines
915 B
Bash
20 lines
915 B
Bash
# wgtunnel server stack — host env template.
|
|
# Copy to `.env` next to compose.yaml on ana-docker and adjust as needed.
|
|
# This template is committed; the real `.env` is gitignored (it is not secret
|
|
# today, but the pattern keeps host-specific values out of git).
|
|
|
|
# Pinned erebe/wstunnel image tag. NEVER :latest. (v10.6.2 verified as the current
|
|
# stable release, and `server --restrict-to <DEST:PORT>` confirmed against its --help.)
|
|
WGTUNNEL_IMAGE_TAG=v10.6.2
|
|
|
|
# The WireGuard endpoint wstunnel unwraps to (ana-wg). `--restrict-to` enforces
|
|
# that the server forwards only here — it is not an open relay.
|
|
WG_TARGET=10.250.50.252:31337
|
|
|
|
# Public hostname — a deliberately innocuous SNI. DNS-only CNAME to the colo edge
|
|
# (ana-srv1.phasefinal.com); never Cloudflare-proxied.
|
|
TUNNEL_HOST=boring.phasefinal.com
|
|
|
|
# Internal plain-WebSocket port the container listens on; traefik forwards here.
|
|
WSTUNNEL_PORT=8080
|