dumbproxy VS wg-setup

Or instead you can have HTTP proxy over TLS in just four steps: https://github.com/Snawoot/dumbproxy/wiki/Quick-deployment

You don't even need a client for this, any modern browser can work with it right away: https://github.com/Snawoot/dumbproxy#using-http-over-tls-pro...

Or just consider some HTTP over TLS proxy like this one: https://github.com/Snawoot/dumbproxy

It may appear a bit more flexible option, especially if forwarding all traffic to VPN entirely is undesirable.

[Unit] Description=Dumb Proxy Documentation=https://github.com/Snawoot/dumbproxy/ After=network.target network-online.target Requires=network-online.target [Service] EnvironmentFile=/etc/default/dumbproxy User=root Group=root ExecStart=/usr/local/bin/dumbproxy $OPTIONS TimeoutStopSec=5s PrivateTmp=true ProtectSystem=full LimitNOFILE=20000 [Install] WantedBy=default.target

I have a WireGuard VPN with about 250 devices, most of them POS machines in the wild. I adopted WireGuard for our first machines about half a year before the 1.0 release, so there weren't much tools yet.

I piggybacked onto the original configuration file format and built myself https://github.com/WolleTD/wg-setup, which helps me validating the correctness and uniqueness of new entries, hacks names into the entries and even updates an internal DNS zone.

I really don't have to care much for key rotation, though. As most of the devices are out of our control anyway, they aren't allowed to connect to anything inside the VPN. It's just for us to connect to them.