glm-5.1
13b0991fb8
Resolved all 11 open questions based on project guidance: Transport: - OQ-01/OQ-07: ACME/Let's Encrypt with domain + IP paths (ADR-008) - OQ-02: Default to n0 relay, --iroh-relay override (ADR-009) - OQ-05: Transport chaining supported natively (ADR-010) Client: - OQ-06: Programmatic-first API, no ~/.ssh/config (ADR-011) Server: - OQ-04: Ed25519 + OpenSSH cert-authority, no password auth (ADR-012) - OQ-08: fail2ban-friendly logging + built-in rate limiting (ADR-013) TUN: - OQ-03/OQ-09: Deferred entirely, recommend tun2proxy (ADR-014) - tun-shim.md marked deprecated NAPI: - OQ-10: Expose both connect() and serve() (ADR-016) - OQ-11: Use napi-rs for FFI bridge (ADR-015) Additional ADRs created during review: - ADR-006: No logging of tunnel destinations (was phantom reference) - ADR-017: Stealth mode protocol multiplexing - ADR-018: Control channel for pubsub over SSH Fixed: ADR-002 status → Superseded, ADR-007 title typo, WRAUTH_SERVER typo, ADR-005 stale wraith-tun refs, undefined ACL feature removed from server.md, --proxy semantic difference documented.
28 lines
1.1 KiB
Markdown
28 lines
1.1 KiB
Markdown
---
|
|
status: deprecated
|
|
last_updated: 2026-06-01
|
|
---
|
|
|
|
# TUN Shim (Deprecated)
|
|
|
|
> **Note**: TUN functionality has been deferred from the wraith project. For VPN-like "route all traffic" behavior, use `tun2proxy` alongside wraith's SOCKS5 proxy. See ADR-014 for the rationale.
|
|
|
|
## What Changed
|
|
|
|
The `wraith-tun` separate process and all TUN-related code is out of scope. The recommended approach for VPN-like behavior is:
|
|
|
|
```bash
|
|
# Terminal 1: wraith SOCKS5 proxy (no root required)
|
|
wraith connect --server example.com --identity ~/.ssh/id_ed25519
|
|
|
|
# Terminal 2: tun2proxy routes all traffic through wraith's SOCKS5
|
|
sudo tun2proxy --proxy socks5://127.0.0.1:1080
|
|
```
|
|
|
|
This keeps the core wraith binary free of TUN complexity and leverages an existing, well-tested tool for TUN-to-SOCKS5 bridging.
|
|
|
|
## References
|
|
|
|
- [ADR-014](decisions/014-defer-tun-recommend-socks5-proxy.md) — decision to defer TUN
|
|
- [ADR-005](decisions/005-socks5-before-tun.md) — SOCKS5 is still the primary interface
|
|
- [tun2proxy](https://github.com/tun2proxy/tun2proxy) — recommended external tool for TUN support |