VPN (WireGuard)

Reach the dashboard, the admin apps and your home network from anywhere, without opening more ports.

Set up

1. Install on the server.

   zh vpn install

2. Forward UDP 51820 in your router to the server.
3. Check DNS. vpn.example.com (with your domain) must point straight to your public IP. The Cloudflare proxy does not carry WireGuard.
4. Add a device. Give it a name and scan the QR code with the WireGuard app on your phone.

   zh vpn add phone

5. Lock down admin access. Security → access rules: Admin only from home network or VPN.

How it runs

WireGuard runs in the Linux kernel as wg-quick@wg0, not in a container. Installing and removing it is only possible on the server. The dashboard shows the QR code and the configuration of new devices.