[3alpha]

What type of PR is this?

Other — runtime refactor and security fix

What does this PR do? Why is it needed?

Replace the inherited LinuxServer runtime with a Dappnode-specific kernel WireGuard server. One Alpine Dockerfile serves AMD64 and ARM64, using upstream wg-quick, a small configuration renderer and tini. Remove s6, CoreDNS, resolver rewriting, module installation/loading, SYS_MODULE and the host /lib/modules mount. DNS goes directly to the configured Dappnode BIND servers. The native AMD64 VPN image decreases from approximately 119 MB to 21 MB.

Keep the API in strict TypeScript. Node built-ins and native qrencode replace the production npm dependency tree; the final application has no production npm dependencies or application node_modules. Preserve remote/local/QR credentials, CORS, the credential CLI and show-peer. Mount API configuration read-only, validate peer paths and active membership, and prevent credential caching and stack disclosure.

Preserve service names, network aliases, the config volume, keys, PSKs, peer addresses and existing client profiles. Keep older numeric PEERS counts and peer1 directories, alongside named peers and the old config location. Peer removal revokes tunnel and API access; re-add restores the same identity. Stage and kernel-validate generated configuration before publishing it. Existing client listen ports are retained. Never execute persisted shell state or log generated credentials.

Remove the remaining LinuxServer template fixtures/matching, custom route and keepalive overrides, UID/GID knobs and tools-version build override. Saved templates/CoreDNS files are inert; validation examines the actual VPN profiles. Files retain Dappnode's 1000:1000 ownership. Keep only sanitized rollback metadata for the currently installed Dappnode image.

Retain the RHSB-2026-012 fixes: patched Node 24.22.1 LTS, pinned base images and Alpine CA bundles >=20261020-r0. Verify distrust in both system bundles and Node's bundled roots.

Validation:

• Strict TypeScript build, formatting, 10 API tests, shell configuration/migration tests and ShellCheck pass. The complete application dependency audit reports zero advisories; all four locked packages are development tools or their types.
• Native ARM64 and AMD64 integration checks cover handshake/encrypted traffic, direct DNS and forwarding/NAT, API/CLI modes, read-only API storage, credential/key/PSK/address preservation, peer add/remove/re-add, restart recovery and rollback/roll-forward. AMD64 uses the installed 0.1.4 images with fresh synthetic credentials. A separate numeric installation exercises old PEERS counts, upgrade, resize, API/CLI and rollback without changing keys, profiles or addresses.
• A compatibility preflight passes against the installed config volume mounted read-only on dappnode-pablo. Installed service image IDs and start times remain unchanged. Disposable test containers publish no ports and are removed afterward.
• CI builds/tests both services and runs the disposable VPN integration suite before the existing release job. Retain the Compose version field required by the SDK validator; make the isolated test network's Docker-selected subnet explicit for older Docker daemons. The SDK build remains enabled for PRs and passes locally with SDK 0.3.55.

To reproduce locally:

yarn --cwd api install --frozen-lockfile
yarn --cwd api format:check
docker build -t wireguard-refactor:test .
docker build -t wireguard-api-refactor:test api
node tests/integration.cjs

The README documents native remote testing, release-baseline images and the historical-template fixture.

Other notes for review

The host must already support kernel WireGuard and netfilter. Client mode, extra tunnel files, custom profile options/firewall hooks, symlinks, CoreDNS-dependent clients and removed override variables require explicit migration; detected unsupported configuration fails before publication. Saved shell templates and CoreDNS files no longer control generation. Keep the previous image and a volume backup for rollback. LinuxServer Mods, cron and arbitrary initialization scripts are no longer part of the runtime.

No installed service was upgraded or restarted. An external user device/public endpoint was not exercised. Merge, release and deployment remain pending.