checkpoint: implement wgcloak v1 foundations

examples/client.advanced.toml

@@ -0,0 +1,39 @@
+# Advanced client example. Values are placeholders, not credentials.
+
+[client]
+server = "vpn.example.invalid"
+id = "replace-me"
+secret_file = "/etc/wgcloak/client.secret"
+
+[local]
+listen = "127.0.0.1:51821"
+
+[transport]
+mode = "auto"
+
+# Auto probing is target behavior; use only transports supported by the build.
+[transport.auto]
+order = ["direct_udp", "quic", "http3", "tls_tcp"]
+probe_timeout_ms = 1500
+retries = 2
+
+[transport.direct_udp]
+port = 51830
+keepalive_secs = 15
+
+[transport.quic]
+port = 443
+keepalive_secs = 15
+
+[transport.http3]
+port = 443
+path = "/tunnel"
+
+[transport.tls_tcp]
+port = 443
+
+[network]
+max_datagram_size = 1200
+
+[logging]
+level = "info"

examples/client.minimal.toml

@@ -0,0 +1,13 @@
+# Minimal client. Replace the hostname, id, and secret path before use.
+# The secret file must contain a generated secret and be mode 0600.
+
+[client]
+server = "vpn.example.invalid"
+id = "replace-me"
+secret_file = "/etc/wgcloak/client.secret"
+
+[local]
+listen = "127.0.0.1:51821"
+
+[transport]
+mode = "auto"

examples/server.advanced.toml

@@ -0,0 +1,49 @@
+# Advanced server example. Values are placeholders, not credentials.
+
+[server]
+listen = "0.0.0.0:51830"
+
+[backend]
+target = "127.0.0.1:51820"
+
+[transports.direct_udp]
+enabled = true
+port = 51830
+
+[transports.quic]
+enabled = true
+port = 443
+
+[transports.http3]
+enabled = true
+port = 443
+path = "/tunnel"
+
+[transports.tls_tcp]
+enabled = true
+port = 443
+
+# Required when TLS-capable transports are enabled.
+[tls]
+certificate = "/etc/letsencrypt/live/vpn.example.invalid/fullchain.pem"
+private_key = "/etc/letsencrypt/live/vpn.example.invalid/privkey.pem"
+
+[session]
+idle_timeout_secs = 120
+
+[limits]
+max_sessions = 1024
+max_sessions_per_ip = 32
+max_pending_handshakes = 256
+handshake_timeout_ms = 3000
+
+[[auth.clients]]
+id = "laptop"
+secret_file = "/etc/wgcloak/clients/laptop.secret"
+
+[[auth.clients]]
+id = "desktop"
+secret_file = "/etc/wgcloak/clients/desktop.secret"
+
+[logging]
+level = "info"

examples/server.minimal.toml

@@ -0,0 +1,22 @@
+# Minimal server. Replace the backend and client secret path before use.
+# The listener address/port is an example; open only the transports you need.
+
+[server]
+listen = "0.0.0.0:51830"
+
+[backend]
+target = "127.0.0.1:51820"
+
+# Milestone 1 direct-UDP deployment. Other transports are planned or optional.
+[transports.quic]
+enabled = false
+
+[transports.http3]
+enabled = false
+
+[transports.tls_tcp]
+enabled = false
+
+[[auth.clients]]
+id = "replace-me"
+secret_file = "/etc/wgcloak/clients/replace-me.secret"