NordVPN

Build me a WireGuard setup assistant for remote access to a server I control, as a narrow substitute for NordVPN. Requirements:

- Create a CLI that asks for server address, tunnel subnet, and client names, then writes WireGuard configuration files using the installed WireGuard tools and their documented key generator.
- Produce a server config, one client config per device, and a peer inventory without recording private keys in the inventory. Use restrictive file permissions.
- Add a preflight command that checks WireGuard installation, listening port, IP forwarding, firewall rules, and whether the client can reach the server endpoint.
- Add a revoke command that removes one peer from the server config and prints the exact restart or reload action needed; never silently change a live tunnel.
- Keep configuration in a chosen local directory with a dated backup command. No hosted control plane, telemetry, or custom VPN protocol.
- State clearly in the UI and README that this gives access to one user-owned endpoint; it does not provide a global exit network, anonymity, streaming location options, or NordVPN's operations.
- README: server provisioning, DNS and firewall setup, client import, key rotation, and a simple connectivity check.

# AGENTS.md — Build guide for NordVPN

## Project scope
Configure a private encrypted tunnel to a user-owned server for personal remote access, with explicit threat-model documentation and no claim of replacing an audited commercial VPN.

Catalogue verdict: no. A consolation build is possible, but the paid product's decisive value sits outside a solo rebuild. For NordVPN, configure a private tunnel to a user-owned server for personal remote access. The hard boundary is global server fleet, capacity, obfuscation, audits, apps, abuse response, and support, plus security assurance, infrastructure, and trust.
Use the implementation prompt below to define the deliverable. Complete each phase's acceptance checks before extending the scope.

## Working agreement
- Inspect the repository and its existing instructions before choosing paths, dependencies or commands. Keep one coherent stack and explain changes to the proposed architecture.
- Plan a vertical slice that accepts a real input and produces the useful output described below. Persist only the state the prompt calls for; respect memory-only and upstream-managed workflows. Use fixtures only when they are clearly labelled.
- After scaffolding, document the actual install, development, check and build commands in README and keep them synchronized with the package or project manifest. Do not report commands as successful unless they ran.
- Work in small steps. At handoff, list implemented flows, checks actually performed, remaining blockers, and any credentials or provider setup the owner must supply.
- Do not publish, spend money, contact customers, delete source data or run irreversible migrations without the project owner's authorization.

## Prerequisites
- desktop OS
- secure backup location
- modern cryptographic libraries
- careful review before real-world use

## Stack and architecture
- Python standard library CLI
- Installed WireGuard tools
- Plain WireGuard configuration files

## Security and data integrity
- Generate keys with WireGuard tooling and restrict private-key file access
- Avoid printing private keys after initial client config creation
- Make revocation and server reload explicit

## Agent implementation rules
- Use current WireGuard configuration documentation
- Document host-specific firewall and forwarding steps

## Optional agent skills and references
No installable skill is listed for this guide; use the project rules and the stack documentation.

Read the linked SKILL.md and its dependencies before adding a skill. Select only the skills matching this project's runtime and task; their documentation does not supply API access, credentials or approval to perform external actions. Pin the reviewed revision where the tool supports it. Follow the chosen agent's documented project-level installation mechanism.

## Distribution ideas
These are optional planning notes. Obtain the owner's approval before publishing or contacting anyone.
- Present it as personal remote access to one server, with no commercial VPN network claims

## Engineering roadmap
1. Implement configuration generation around the installed WireGuard toolchain.
2. Add preflight, peer inventory, revocation, and dated backups.
3. Document the user-owned endpoint threat model and setup prerequisites.

## Paid-product capabilities outside this build
- global server fleet, capacity, obfuscation, audits, apps, abuse response, and support
- independent security audits
- global relay infrastructure
- breach monitoring data
- account recovery and support

## Implementation prompt
Build me a WireGuard setup assistant for remote access to a server I control, as a narrow substitute for NordVPN. Requirements:

- Create a CLI that asks for server address, tunnel subnet, and client names, then writes WireGuard configuration files using the installed WireGuard tools and their documented key generator.
- Produce a server config, one client config per device, and a peer inventory without recording private keys in the inventory. Use restrictive file permissions.
- Add a preflight command that checks WireGuard installation, listening port, IP forwarding, firewall rules, and whether the client can reach the server endpoint.
- Add a revoke command that removes one peer from the server config and prints the exact restart or reload action needed; never silently change a live tunnel.
- Keep configuration in a chosen local directory with a dated backup command. No hosted control plane, telemetry, or custom VPN protocol.
- State clearly in the UI and README that this gives access to one user-owned endpoint; it does not provide a global exit network, anonymity, streaming location options, or NordVPN's operations.
- README: server provisioning, DNS and firewall setup, client import, key rotation, and a simple connectivity check.

## Completion evidence
Demonstrate the prompt's acceptance scenarios against the scoped workflow. Include setup from a clean checkout and failure recovery. Check persistence across restart and export/restore only for the state the prompt says to store; for memory-only tools, confirm that temporary content is discarded as specified. Record actual results and remaining limitations. A detailed plan alone does not establish a working replacement.