CloudGateway

CloudGateway is a shared regional WireGuard VPN platform, live at gocloudlaunch.com. Each OCI region runs one long-lived server. Use the macOS or iOS app, or the cloudgateway CLI on macOS and Linux, to manage clients and connections. The web dashboard also provides config export and admin tools. Firebase owns product state and stored configs.

Built from CloudLaunch, extending its VPN proof of concept into a shared regional service.

Screenshots

iOS app

macOS app

Website

Architecture

React dashboard
  -> Firebase Auth
  -> Firebase reads for dashboard data/config display
  -> https://<region>.<origin>/api/*
      -> Cloudflare proxied DNS
      -> Caddy on regional OCI server
      -> FastAPI on 127.0.0.1
      -> Firebase Admin SDK
      -> WireGuard host commands

WireGuard client
  -> wg.<regionId>.<origin>:51820 (non-proxied DNS -> server public IPv4)
  -> wg0 on regional OCI server

Cloudflare fronts the regional API only. It is not part of the VPN data path; WireGuard clients resolve the non-proxied (grey-cloud) wg.<regionId>.<origin> record and connect directly to the server's public IPv4.

Components

• Web dashboard: React/TypeScript and Tailwind, Firebase sign-in, region/client inventory, config export, and admin tools.
• Apple clients: iOS app, macOS menu app, and CLI. Kit/AppCore share VPN/config APIs and app contracts; platform targets own UI and runtime adapters. The Mac app and CLI share a background controller.
• Linux CLI: CLI and systemd daemon, tested on Ubuntu 24.04 LTS on ARM64 and AMD64. Mesh is the default; Full is experimental on cloud VMs.
• Regional API: FastAPI with Firebase Admin SDK and locked WireGuard/policy mutations. It runs as root on loopback behind Caddy.
• Firebase: Auth and Firestore, the source of truth for accounts, roles, regions, limits, clients, stored configs, and desired peers.
• OCI hosts: Terraform-managed WireGuard, Caddy, account isolation, and DNS filtering. AWS is used only for SES email.

API routing and peer state

The apex API serves discovery/access at https://api.<origin>/api/*; regional operations use https://<regionId>.<origin>/api/*. The web app derives these hosts from its hostname. Local development uses the CRA proxy; see the web guide for overrides.

wg0.conf stays interface-only. Firebase owns desired peers; API mutations apply live changes under a host lock, and boot/on-demand sync rebuilds peers from Firebase. Account-scoped ACLs isolate users; regional mesh connects authorized clients across regions. Never persist peers to host configuration files.

DNS and privacy

AdGuard Home listens only on tunnel DNS addresses and sends allowed queries to local Unbound. Unbound forwards over DNS-over-TLS to Quad9, Mullvad, and DNS.SB, with local DNSSEC validation. DNS query logs and statistics are disabled. See the DNS guide.

Control-plane JSON logs may contain request IDs, routes, outcomes, and user emails. Never log VPN traffic, DNS queries, destination/packet metadata, connection history, private keys, full configs, Firebase credentials, or auth tokens. ACL logs/status expose aggregate counts, hashes, booleans, region IDs, and update time only, with no account/client identifiers or tunnel addresses.

Usage

• Email me or message me on LinkedIn if you want to try it.

• Use the CloudGateway macOS app, the cloudgateway CLI on macOS or Linux, or the CloudGateway iOS app on iPhone or iPad.

• Apple apps manage the tunnel through their packet tunnel extensions. Linux uses a root systemd daemon and the kernel WireGuard interface.

iOS

• Build and install the CloudGateway iOS app from Xcode.
• Sign in with your Firebase email/password account.
• Choose one active config by client display name and region.
• Install the VPN profile, then start or stop the tunnel from the app.

macOS

• Download the CloudGateway macOS app from gocloudlaunch.com and install it at /Applications/CloudGateway.app.
• Open the menu bar app and sign in through the browser.
• Complete the one-time VPN extension and profile approvals.
• Choose a client by name and region, then connect or disconnect from the menu. Use Add Client or Remove Client to manage clients.

macOS CLI

• Choose Install Command Line Tool… from the macOS app menu to install cloudgateway at ~/.local/bin/cloudgateway.
• Add ~/.local/bin to your shell's PATH. The menu offers Add to Zsh PATH… for supported zsh setups; open a new login shell after setup.
• Use the same macOS user that completed desktop VPN setup. The CLI shares sign-in, inventory, and VPN state with the menu bar app.

cloudgateway auth login
cloudgateway ls -l
cloudgateway up chicago 1
cloudgateway status
cloudgateway down

The CLI also supports client creation and removal, JSON output, diagnostics, and SSH use. See the CLI setup and command reference.

Linux CLI

The Linux client provides the same commands and JSON contract as the macOS CLI. It has been tested on Ubuntu 24.04 LTS on ARM64 and AMD64, including sign-in and connectivity within and across regions.

Linux defaults to Mesh mode: CloudGateway peers use the VPN while ordinary internet traffic and DNS keep using the host's network. Full mode is experimental on cloud VMs and routes internet traffic and system DNS through the selected region. It may need provider-specific DHCP/DNS configuration. Existing saved mode choices are retained.

Other Linux distributions with systemd and kernel WireGuard will likely need only small installer or network-integration changes, but remain unverified.

See installation and commands, Mesh vs Full and cloud VM setup, and the VM results.

Documentation

• All guides and runbooks
• Quick deployment
• Apple apps and CLI
• Web development
• Tool versions