ProtonVPN WireGuard support #152

New issue

Open

opened 2026-08-24 15:13:05 -04:00 by mysticalsoap · 0 comments

mysticalsoap commented

2026-08-24 15:13:05 -04:00

Owner

Deferred past the current release by design: OpenVPN import (#33/#146) is the headline feature and the WireGuard tunnel path hasn't been exercised at all yet, even with a manual config.

What it takes, roughly in order:

Validate the WireGuard plumbing itself first — aqomui has the machinery (gen_wg_key, protocol tables, the WireGuard branch in tunnel.py, Mullvad's WG-only import) but none of it has been tested live. A manual WG config from any provider is the cheapest smoke test.
Key registration is Proton's hard part. Unlike Mullvad's register-once key upload, Proton ties WG keys to short-lived certificates issued per session via the authenticated certificate endpoint — the official clients renew them continuously. Needs investigating what Duration the API grants a third-party session; if it's short, renewal machinery is required, which makes #147's persisted-session/refresh-token work a hard prerequisite (a scheduled renewal can't solve a CAPTCHA, same as auto-update).
Server model: /vpn/logicals already carries per-physical-server X25519PublicKey; WG entries would double the imported server count, which raises the stakes on the server-navigation UX work and touches the multi-entry-per-type groundwork from #138.
Config generation is the easy part: standard WG interface (10.2.0.2/32, DNS 10.2.0.1) + peer per server, port 51820.

🤖 Generated with Claude Code

Deferred past the current release by design: OpenVPN import (#33/#146) is the headline feature and the WireGuard tunnel path hasn't been exercised at all yet, even with a manual config. What it takes, roughly in order: 1. **Validate the WireGuard plumbing itself first** — aqomui has the machinery (`gen_wg_key`, protocol tables, the WireGuard branch in tunnel.py, Mullvad's WG-only import) but none of it has been tested live. A manual WG config from any provider is the cheapest smoke test. 2. **Key registration is Proton's hard part.** Unlike Mullvad's register-once key upload, Proton ties WG keys to short-lived certificates issued per session via the authenticated certificate endpoint — the official clients renew them continuously. Needs investigating what `Duration` the API grants a third-party session; if it's short, renewal machinery is required, which makes **#147's persisted-session/refresh-token work a hard prerequisite** (a scheduled renewal can't solve a CAPTCHA, same as auto-update). 3. **Server model**: `/vpn/logicals` already carries per-physical-server `X25519PublicKey`; WG entries would double the imported server count, which raises the stakes on the server-navigation UX work and touches the multi-entry-per-type groundwork from #138. 4. Config generation is the easy part: standard WG interface (10.2.0.2/32, DNS 10.2.0.1) + peer per server, port 51820. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

mysticalsoap added the

architecture

label

2026-08-24 15:13:05 -04:00

mysticalsoap referenced this issue

2026-08-24 16:24:47 -04:00

ProtonVPN import: support Proton's human-verification (CAPTCHA) flow #150