TheCamp VPN
A one-click Windows client for a WireGuard server I run on my own VPS.
The source is private. The server details are deliberately not published here.
- Protocol
- WireGuard
- Server
- Singapore, own VPS
- Client
- Electron, Windows
- Keys
- Generated per device
TheCamp VPN is a small Windows app for connecting to a WireGuard server that I run on the same VPS as The Camp's sites. The idea is a client that anyone can download and use: press Connect and the traffic leaves through Singapore.
I stood up both halves on 23 September 2026: the WireGuard interface on the server, and a client that handles its own keys, writes the tunnel configuration and installs it. It is a prototype, and the status section below says exactly where it stops.
Client
First run
keypair saved in the local profile
Connect
main process builds the config
wireguard.exe
installs the tunnel service
Server
Firewall
one UDP port open for WireGuard
wg0 interface
enabled at boot, forwarding on
Peer list
public keys only
What it does
The parts worth talking about
Keys that never leave the device
Each install generates its own keypair on first run (Curve25519 via tweetnacl) and stores it in the user's local profile. The interface only ever sees the public key.
No homemade cryptography
The app does not embed a VPN implementation. It drives the official WireGuard for Windows command line, installing the tunnel as a Windows service, and disconnects first because the service name is fixed.
A small attack surface
Context isolation is on and Node integration is off. The interface can list servers by id and name, and nothing else: server keys and endpoints stay in the main process, with environment overrides for each.
Ready for more regions
Servers are a list in one config file, so adding Hong Kong is one entry once that VPS exists. The client is already written to switch between them.
Packaging around a tooling problem
electron-builder's signing tools need symlink permission that this machine does not allow. A small build script runs the build anyway, patches the administrator-elevation manifest into the executable with rcedit, and zips a portable app.
The server side
WireGuard on Ubuntu with an enabled-at-boot interface, IP forwarding, and a single firewall rule for its UDP port. The rest of the box stays closed, as for every other service on that VPS.
Status
What works and what is next
It is a prototype, and I would rather say so than round it up.
Built and running
The server interface is up and enabled at boot. The client builds into a portable Windows app that creates keys, writes the tunnel and installs it.
Not proven end to end yet
The one registered device has not completed a handshake, so I call this a prototype and not a service. A device's key must also be added to the server by hand: there is no sign-up or backend by design.
Next
Record the first real connection, then add a simple enrolment flow so that adding a device is not an SSH session, and a second region.
Stack
Built with
- WireGuard
- Electron
- Node.js
- tweetnacl
- electron-builder
- rcedit
- Ubuntu
- ufw
WireGuard is a registered trademark of Jason A. Donenfeld. This project is not affiliated with or endorsed by the WireGuard project.