{"id":19637855,"url":"https://github.com/n-r-w/shadow-server","last_synced_at":"2025-04-28T10:30:22.036Z","repository":{"id":193768373,"uuid":"689111657","full_name":"n-r-w/shadow-server","owner":"n-r-w","description":"Cloak + WireGuard + Docker + LAN gateway/proxy (server-side)","archived":false,"fork":false,"pushed_at":"2023-12-13T06:46:10.000Z","size":32,"stargazers_count":20,"open_issues_count":0,"forks_count":4,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-05T08:05:22.565Z","etag":null,"topics":["cloak","docker","gateway","wireguard"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/n-r-w.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-09-08T20:39:59.000Z","updated_at":"2025-03-24T19:07:43.000Z","dependencies_parsed_at":"2023-09-09T22:29:35.169Z","dependency_job_id":"9185b6a3-a65d-41a6-a08c-c593ed033a68","html_url":"https://github.com/n-r-w/shadow-server","commit_stats":null,"previous_names":["n-r-w/shadow-server"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/n-r-w%2Fshadow-server","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/n-r-w%2Fshadow-server/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/n-r-w%2Fshadow-server/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/n-r-w%2Fshadow-server/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/n-r-w","download_url":"https://codeload.github.com/n-r-w/shadow-server/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251295055,"owners_count":21566388,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cloak","docker","gateway","wireguard"],"created_at":"2024-11-11T12:36:30.985Z","updated_at":"2025-04-28T10:30:21.301Z","avatar_url":"https://github.com/n-r-w.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Cloak + WireGuard + Docker  + LAN gateway (server-side)\n\n## Server-side setup for internet access through a separate gateway in the local network. Client-side here \u003chttps://github.com/n-r-w/shadow-client\u003e\n\nData flows through the following chain:\n\n- Computer (LAN) with the client part of this configuration specified as gateway or proxy server\n- Gateway (LAN)\n- WireGuard client (LAN)\n- Cloak client (LAN)\n- Censored Internet\n- Cloak server (remote)\n- WireGuard server (remote)\n- Free Internet\n\nFor simplicity, all operations are performed as root, using Ubuntu 22.04 as an example. All settings are for IPv4 only. First, you need to follow this guide, and then the client-side part \u003chttps://github.com/n-r-w/shadow-client\u003e\n\nTested on:\n\n- Remote server Ununtu 22.04 (VPS, 1 CPU core, 1GB RAM)\n- Local server Ubuntu 20.04 (2 CPU cores, 2GB RAM, single ethernet port).\n- Speedtest Download Mbps: 108, Upload Mbps: 71. This is slower than a direct WireGuard connection (Download Mbps: 254, Upload Mbps: 189) because the traffic goes through Cloak and is encrypted to make it indistinguishable from regular HTTP traffic, disguising it as a VPN connection. The bottleneck here is the server's CPU. If a dual-core configuration is used, the speed should be higher.\n\n## Go to the home folder\n\n```bash\ncd /root\n```\n\n## Configuring the Firewall\n\n```bash\nufw allow openssh \u0026\u0026 ufw allow http \u0026\u0026 ufw allow https \u0026\u0026 echo \"y\" | ufw enable\n```\n\n## Server Preparation\n\n```bash\napt update \u0026\u0026 apt install -y nano wget git wireguard \u0026\u0026 \\\nwget https://github.com/cbeuw/Cloak/releases/download/v2.7.0/ck-server-linux-amd64-v2.7.0 \u0026\u0026 \\\nmv ck-server-linux-amd64-v2.7.0 ck-server \u0026\u0026 chmod +x ck-server\n```\n\nWe've downloaded WireGuard and Cloak server for generating encryption keys. Once generated, they are no longer needed on the host.\n\nEnable ip forward\n\n```bash\necho \"net.ipv4.ip_forward=1\" \u003e\u003e /etc/sysctl.conf \u0026\u0026 sysctl -p\n```\n\n## docker setup\n\n### Install docker Manually\n\nInstall docker manually using manual at \u003chttps://docs.docker.com/engine/install/ubuntu/\u003e + install docker-compose:\n\n```bash\napt update \u0026\u0026 apt install -y ca-certificates curl gnupg \u0026\u0026 \\\ninstall -m 0755 -d /etc/apt/keyrings \u0026\u0026 \\\ncurl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg --yes \u0026\u0026 \\\nchmod a+r /etc/apt/keyrings/docker.gpg \u0026\u0026 \\\nif [ ! -e /etc/apt/sources.list.d/docker.list ]; then\necho \\\n\"deb [arch=\"$(dpkg --print-architecture)\" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \\\n\"$(. /etc/os-release \u0026\u0026 echo \"$VERSION_CODENAME\")\" stable\" | \\\nsudo tee /etc/apt/sources.list.d/docker.list \u003e /dev/null\nfi \u0026\u0026 \\\napt update \u0026\u0026 \\\napt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin \u0026\u0026 \\\nwget https://github.com/docker/compose/releases/download/v2.21.0/docker-compose-linux-x86_64 \u0026\u0026 \\\nmv docker-compose-linux-x86_64 /usr/local/bin/docker-compose \u0026\u0026 \\\nchmod +x /usr/local/bin/docker-compose\n```\n\n### Alternatively, install docker via snap (in Ubuntu 22.04, it is not working at the moment)\n\n```bash\napt install -y snapd \u0026\u0026 snap install docker\nsnap refresh docker --channel=latest/edge\n```\n\n## Generation of encryption keys\n\n### Generating wireguard keys\n\n```bash\nwg genkey | tee wg-server-private.key | wg pubkey \u003e wg-server-public.key \u0026\u0026 \\\nwg genkey | tee wg-client-private.key | wg pubkey \u003e wg-client-public.key\n```\n\n- ```wg-server-private.key``` server private key\n- ```wg-server-public.key``` server public key. Will be needed when installing the client part \u003chttps://github.com/n-r-w/shadow-client\u003e\n- ```wg-client-private.key``` client private key. Will be needed when installing the client part \u003chttps://github.com/n-r-w/shadow-client\u003e\n- ```wg-client-public.key``` client public key\n\n### Generating cloak keys\n\n```bash\n./ck-server -k \u003e cloak.keys \u0026\u0026 ./ck-server -u \u003e cloak.uid\n```\n\n- ```cloak.keys``` cloak keys pair. public key (will be needed when installing the client part \u003chttps://github.com/n-r-w/shadow-client\u003e), private key\n- ```cloak.uid``` cloak client UID\n\n## Setup\n\n### Download this repository\n\n```bash\ngit clone https://github.com/n-r-w/shadow-server.git \u0026\u0026 cd shadow-server\n```\n\n### Set up environment variables for docker\n\nIn the doc directory there is an example file with environment variables ```env.txt```. Copy it to the ```.env``` file, which contains environment variables for ```docker-compose```\n\n```bash\napt install -y nano \u0026\u0026 \\\ncp ./doc/env.txt ./.env \u0026\u0026 \\\nnano ./.env\n```\n\nSetting the values ​​of the variables\n\n- ```CK_UID``` take from file ```cloak.uid```\n- ```CK_PRIVATE_KEY``` take from file (second key) ```cloak.keys```\n- ```WG_SERVER_PRIVATE_KEY``` take from file ```wg-server-private.key```\n- ```WG_CLIENT_PUBLIC_KEY``` take from file ```wg-client-public.key```\n\n## Test run\n\nWe check that everything starts (the first launch is long)\n\n```bash\ndocker-compose up\n```\n\nPress CTRL+C and then\n\n```bash\ndocker-compose down\n```\n\n## Create systemd service to automatically launch a container\n\nIf installed via ```snap```:\n\n```bash\ncp ./doc/shadow-server-snap.service /etc/systemd/system/shadow-server-snap.service \u0026\u0026 \\\nsystemctl daemon-reload \u0026\u0026 \\\nsystemctl enable shadow-server-snap \u0026\u0026 \\\nsystemctl start shadow-server-snap\n```\n\nIf you installed it according to the instructions from the ubuntu website:\n\n```bash\ncp ./doc/shadow-server.service /etc/systemd/system/shadow-server.service \u0026\u0026 \\\nsystemctl daemon-reload \u0026\u0026 \\\nsystemctl enable shadow-server \u0026\u0026 \\\nsystemctl start shadow-server\n```\n\nThat's it, now we need to proceed to installing the client \u003chttps://github.com/n-r-w/shadow-client\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fn-r-w%2Fshadow-server","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fn-r-w%2Fshadow-server","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fn-r-w%2Fshadow-server/lists"}