Connect privately with WireGuard

Sooner or later you'll want to connect to production from your own machine. Maybe you need to run a query with psql, check a queue with redis-cli, or open an admin tool that should never be public. This guide sets that up with private access, from a fresh install of WireGuard to your first private connection. It takes about ten minutes.

Why not just open a port?

The quick way to reach a server from home is to open a port to the internet. That might be SSH on port 22, Postgres on 5432 or an admin panel on 8080. It works, and it's how a lot of breaches start.

• Everything open gets found. Scanners sweep every IPv4 address on the internet every few hours. A new server gets its first SSH login attempts within minutes of booting.
• A login prompt is attack surface. Anything that answers before you've proved who you are can have bugs that attackers reach first. In 2024, regreSSHion let attackers take over unpatched OpenSSH servers without logging in. Postgres and Redis have had their share of the same kind of bug.
• Passwords leak. A database open to the internet is only as safe as its password. Passwords end up in laptops, chat logs and old .env files.
• An allowlist doesn't follow you. Allowing only your home IP breaks every time you work from a café, a train or a hotel. Then the rule gets widened "for now".

WireGuard turns this around. It's a VPN built into Linux, Windows, macOS, iOS and Android. Its whole design is about 4,000 lines of code, small enough for one person to review. Three things make it a better front door:

• It's silent. WireGuard doesn't answer a packet unless it's signed with a key it knows. To a scanner, the port looks like nothing is there, so there's nothing to attack.
• Keys, not passwords. Each device has its own key pair. Nobody can guess it, and nobody can sign in with a leaked password.
• It goes where you go. Your device connects from any network, so you never need to open a port to "just my IP".

With private access, Appentic runs the WireGuard side for your project. Your databases and services never get a public address at all.

You don't need to close SSH on Appentic. Port 22 is closed on every machine, and there's no setting that opens it. A machine accepts only web traffic, public databases from their allowed addresses, and private access. When you need a terminal, the Shell page opens one in your browser.

What you'll set up

By the end of this guide:

1. Your laptop has the WireGuard app with a tunnel to your project.
2. You connect to your project's database with psql, at a private name like main-db.5295cbea4203.private.appentic.app.
3. If only you need to reach your database from outside Appentic, you can close it to the internet.

You'll need:

• A project with at least one machine and a database. A key value store or web service works the same way.
• psql on your laptop, if you want to follow the database steps. On a Mac, brew install libpq installs it. Then follow the line it prints about adding psql to your PATH.

Step 1: Install WireGuard

Install the official app from the WireGuard team. It's free on every platform.

On a Mac, WireGuard appears as a dragon icon in the menu bar. Click it and choose Manage Tunnels to open its window.

Step 2: Add your device in Appentic

1. Open your project and choose Networking in the sidebar.
2. Select the Private access tab.
3. Under Devices, type a name for this device in Device name, for example Ana's laptop. Use one name per person and device. Then you can remove one without affecting anyone else.
4. Click Add device.

The device's page opens. It shows the device's WireGuard config as text and as a QR code. The config holds this device's own key. Treat it like a password: don't share it, don't paste it into chat and never commit it to a repository.

The first device you add starts a small access point on one of your project's machines. It's free and uses 32 MB of that machine's memory. It's ready within a minute.

Step 3: Import the config

Pick your platform.

macOS and Windows

1. On the device's page, click Download config. You get a .conf file named after your project and device.
2. In WireGuard, click Import tunnel(s) from file and choose that file.
3. On a Mac, the first time you import a tunnel macOS asks whether WireGuard may add VPN configurations. Click Allow and confirm with your password or Touch ID.

The tunnel appears in WireGuard's list under the file's name.

iPhone, iPad and Android

1. In the WireGuard app, tap +, then Create from QR code (on Android: Scan from QR code).
2. Point the camera at the QR code on the device's page in Appentic.
3. Give the tunnel a name, such as your project's name.

Linux

1. Click Download config and rename the file to something short. Linux limits a WireGuard interface's name to 15 characters, for example myproject.conf.

2. Move it into place and lock it down:

   sudo install -m 600 myproject.conf /etc/wireguard/myproject.conf

Step 4: Connect

• macOS and Windows: select the tunnel and click Activate.
• Phones: turn on the tunnel's switch.
• Linux: run sudo wg-quick up myproject.

Within a few seconds, the tunnel's details show Latest handshake with a time. On Linux, run sudo wg show to see it. That means your device and your project have recognised each other's keys and the tunnel is up.

Only traffic for your project goes through the tunnel. Everything else on your device, including browsing, calls and downloads, uses your normal connection, just as before. You can be connected to several projects at once.

Step 5: Connect to your database

Back in Appentic, on the Private access tab, What your devices can reach lists every deployed database, key value store and web service in the project. Each one has a private name and address.

You'll also need your database's user, password and database name:

1. Open the database and stay on its Overview page.
2. Under Connection strings, find Internal (Appentic services) and click the eye button to show the password.
3. The string has the form postgresql://USER:PASSWORD@HOST:5432/DATABASE.

Now connect, using the private name in place of HOST:

psql "postgresql://USER:PASSWORD@main-db.5295cbea4203.private.appentic.app:5432/DATABASE"

You're in. Run \conninfo to see where you're connected. Your password travelled inside the WireGuard tunnel and never crossed the internet in the clear.

Use the private name rather than the address. The name stays the same if the database moves to another machine. Names only work while the tunnel is on.

Key value stores

Open the store, and copy its password from Connection string on its Overview page. Then:

redis-cli -h cache.5295cbea4203.private.appentic.app -p 6379 --askpass

Paste the password when it asks, then try PING. It answers PONG.

Private services

An internal API or an admin tool shouldn't have a public address at all:

1. Open the web service and choose Settings.
2. Under Who can reach it, turn on Private.

It no longer has a public address. Your other services reach it on the project's private network, and your devices reach it in the browser at its private name, like http://admin.5295cbea4203.private.appentic.app. See Private services.

Step 6 (optional): Close your database to the internet

Skip this step if something outside Appentic connects to your database on purpose, such as an analytics tool, a BI dashboard or a service hosted elsewhere. Those connect over public access, from the addresses on its allowed list. Leave public access on and they keep working. Private access works alongside it.

If you and your team are the only ones who connect from outside Appentic, your database doesn't need a door to the internet any more:

1. Open the database and choose Settings.
2. Turn off Public access.

Your services connect over the private network, so they keep working as before. Anything outside Appentic, including your laptop with the tunnel off, can no longer reach the database at all. From now on, your laptop reaches it only with the tunnel on.

Step 7 (optional): Stay connected

On a Mac or iPhone, WireGuard can turn the tunnel on by itself:

1. Deactivate the tunnel, then click Edit.
2. Tick On-demand, choose Ethernet and Wi-Fi (on a phone: Wi-Fi and Cellular), and click Save.

The tunnel now reconnects after sleep and whenever you change networks. Since only your project's traffic uses it, it doesn't slow anything else down. macOS usually runs one VPN at a time, so if you also use a work VPN, leave On-demand off and turn the tunnel on when you need it.

Lost a laptop? Remove the device

If a device is lost, sold or leaked its config, cut it off:

1. On the Private access tab, click Remove next to the device.
2. Confirm.

The device can't connect from then on, even with its config. The rest of your devices keep working. To set the device up again, add it as a new device.

Troubleshooting

Next steps

• Private access: limits, zones, and how the access point runs.
• Private services: internal APIs and admin tools with no public address.
• Connected networks: connect a whole office or another cloud, not just one device.
• Traffic rules: limit what each service can reach inside your project.