Create ‘vds_relay_and_home_server’ by surdeus

Create ‘vds_relay_and_home_server’ (by surdeus at 24 Jul 26 23:18 MSK)

Hyphae affected: vds_relay_and_home_server

diff --git a/vds_relay_and_home_server.myco b/vds_relay_and_home_server.myco
new file mode 100644
index 0000000..b8d3a9f
--- /dev/null
+++ b/vds_relay_and_home_server.myco
@@ -0,0 +1,150 @@
+= Home Server Relay Setup via VDS
+
+This document summarizes the complete setup for using a cheap VDS as a secure, DPI-proof relay for a home server, while preserving the real client IP address for HTTP/HTTPS services.
+
+----
+
+== 1. AmneziaWG Tunnel (DPI Bypass)
+
+Standard WireGuard is easily blocked by Deep Packet Inspection (DPI). We use **AmneziaWG** to obfuscate the handshake.
+
+*. **VDS (Debian) Setup**
+* {
+Install tools: `sudo apt install amneziawg -y`
+Generate keys and create `/etc/wireguard/wg0.conf`.
+Add obfuscation parameters under `[Interface]`:
+```
+Jc = 4
+Jmin = 50
+Jmax = 1000
+S1 = 17
+S2 = 38
+H1 = 1
+H2 = 2
+H3 = 3
+H4 = 4
+```
+Use `-I 1` in `PostUp` rules to force them to the top of the firewall chain, preventing them from being overwritten:
+```
+PostUp = iptables -I INPUT 1 -i %i -j ACCEPT; iptables -I FORWARD 1 -i %i -j ACCEPT; iptables -I FORWARD 1 -o %i -j ACCEPT; iptables -t nat -I POSTROUTING 1 -o eth0 -j MASQUERADE
+PostDown = iptables -D INPUT -i %i -j ACCEPT; iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
+```
+Enable IP forwarding: `echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf`
+Start service: `sudo systemctl enable --now awg-quick@wg0`
+}
+
+*. **Home Server (Fedora) Setup**
+* {
+Install tools via COPR or compile from source: `sudo dnf install amneziawg-dkms amneziawg-tools -y`
+Create `/etc/wireguard/wg0.conf` with matching keys and the **exact same** obfuscation parameters under `[Interface]`.
+Add `PersistentKeepalive = 25` under `[Peer]` to prevent NAT timeouts.
+Start service: `sudo systemctl enable --now awg-quick@wg0`
+}
+
+----
+
+== 2. HAProxy Relay (VDS)
+
+HAProxy acts as a lightweight Layer 4 TCP relay, forwarding traffic to the home server while injecting the **PROXY protocol** header to preserve the real client IP.
+
+*. Install: `sudo apt install haproxy -y`
+*. Configure `/etc/haproxy/haproxy.cfg`:
+* {
+```
+global
+ log /dev/log local0
+ maxconn 4096
+ user haproxy
+ group haproxy
+ daemon
+
+defaults
+ log global
+ mode tcp
+ option tcplog
+ option dontlognull
+ timeout connect 5s
+ timeout client 30s
+ timeout server 30s
+
+frontend http_in
+ bind *:80
+ default_backend http_home
+
+backend http_home
+ server home_server 10.0.0.2:80 send-proxy
+
+frontend https_in
+ bind *:443
+ default_backend https_home
+
+backend https_home
+ server home_server 10.0.0.2:443 send-proxy
+```
+**Note:** Use `send-proxy` (v1 text format), **not** `send-proxy-v2`.
+}
+*. Restart: `sudo systemctl restart haproxy`
+*. Open firewall: `sudo ufw allow 80/tcp` and `sudo ufw allow 443/tcp`
+
+----
+
+== 3. Caddy Web Server (Home Server)
+
+Caddy handles Auto-HTTPS, routing, and reads the PROXY protocol header. The **critical fix** is explicitly trusting the VDS IP using the `allow` directive, and separating the `:80` and `:443` listener wrappers to avoid Auto-HTTPS parsing bugs.
+
+*. Install: `sudo dnf install 'dnf-command(copr)' -y && sudo dnf copr enable @caddy/caddy -y && sudo dnf install caddy -y`
+*. Configure `/etc/caddy/Caddyfile`:
+* {
+```
+{
+ servers :80 {
+ listener_wrappers {
+ proxy_protocol {
+ allow 10.0.0.1
+ }
+ }
+ }
+ servers :443 {
+ listener_wrappers {
+ proxy_protocol {
+ allow 10.0.0.1
+ }
+ tls
+ }
+ }
+}
+
+http://wiki.mojosa.su {
+ redir https://{host}{uri}
+}
+
+wiki.mojosa.su {
+ log {
+ output file /var/log/caddy/access.log
+ format console
+ }
+
+ # Replace with your actual service:
+ # reverse_proxy localhost:8080
+ respond "Success! Real IP: {http.request.remote.host}" 200
+}
+```
+}
+*. Ensure log directory permissions: `sudo mkdir -p /var/log/caddy && sudo chown caddy:caddy /var/log/caddy`
+*. Restart: `sudo systemctl restart caddy`
+
+----
+
+== 4. Firewall & Final Checks
+
+*. **Home Server (Fedora)**: Allow traffic only through the WireGuard tunnel.
+* {
+`sudo firewall-cmd --permanent --zone=trusted --add-interface=wg0`
+`sudo firewall-cmd --reload`
+}
+*. **Verification**: Access the site from a **different network** (e.g., cellular data). The response and `/var/log/caddy/access.log` should show your real public IP, not `10.0.0.1`.
+
+----
+
+=> https://caddyserver.com/docs/caddyfile/options#name Caddy Server Options Documentation
+=> https://github.com/amnezia-vpn AmneziaVPN GitHub Repository