Install the hub

The installer sets up the whole hub on one host: the relay, a WireGuard interface, a firewall table and the services that bring them up on boot. Run it as root.

What you need

• A Linux server with systemd and root access. We tested the script on Debian 13. It also knows dnf, but we have not tried that path.
• A public IPv4 address, or a name that points to it.
• Two open ports: TCP for the relay (8443 by default) and UDP for WireGuard (20820 by default).

A small VPS is enough. In our tests the relay used about 10 MB of memory and 3 % of one core while it carried a 2560×1440 stream with sound.

Open the ports in your host’s panel too

Many hosting providers filter inbound UDP in their own firewall, before the packet reaches your server. On our test server the router’s handshake never arrived until we allowed the WireGuard port in the provider’s panel. Do that before you debug anything else.

Install

1. Put install.sh and the watchpost-relay binary in one folder on the server.

2. Run the script with your public address, so the app can find the hub:

   sudo ./install.sh --host hub.example.com

   To change the ports, add --relay-port and --tunnel-port.

3. Read the hub code the script prints at the end. It holds the address, the certificate fingerprint and the admin token. Save it: the app asks for it when you add the hub.

Lost the code? watchpost-relay admin new prints a hub code with an admin token.

What the script changes

It installs wireguard-tools, nftables and openssl if they are missing, and creates a system user wphub. In /etc/watchpost it writes the relay config and a self-signed certificate valid for ten years, and the app checks its fingerprint. /etc/wireguard/wg-wp.conf gets the address 10.77.0.1/24 and a key of its own. The firewall rules live in a table named inet watchpost.

Your routes, sysctl settings and other firewall rules stay as they were. Nothing is forwarded through the host between the tunnels and its own network.

Four services start on boot:

Service	What it does
watchpost-hub-firewall	Loads the firewall table
wg-quick@wg-wp	Brings up the WireGuard interface
watchpost-hub-agent	Runs as root and changes WireGuard peers on the relay’s behalf
watchpost-relay	The relay itself, without privileges

The split is deliberate. A break-in into the relay gives no rights over the host’s network.

Check that it runs

systemctl is-active watchpost-hub-firewall wg-quick@wg-wp watchpost-hub-agent watchpost-relay
sudo wg show wg-wp

You should see four active lines and the wg-wp interface. Peers appear after you connect the first site.

Update and remove

Run install.sh again to update. The binary and the services are replaced. Keys, configuration, sites and the admin token stay.

sudo ./install.sh uninstall removes the services, the firewall table and the binary, and keeps keys and sites, so a later install picks them up. Add --purge to delete those too.