polaris-vpn 0.6.0 → 2.0.0-beta

package/CHANGELOG.md

@@ -5,11 +5,34 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.0.0-beta] - 2026-07-12
+
+### Added
+
+- **Zero-Log Self-Hosted DNS (Unbound)**: `polaris deploy` now automatically installs and configures Unbound directly on the VPS, binding it to the tunnel interface (`10.0.0.1:53`). Client configs use this by default, ensuring your DNS queries never hit public resolvers (like Cloudflare) and never leave the encrypted tunnel.
+- **Server Hardening (Fail2Ban)**: Deployment now automatically secures the VPS SSH port against automated botnet brute-force attacks by installing and enabling `fail2ban`.
+
+## [1.0.0] - 2026-07-12
+
+### Added
+
+- **Multi-Peer Management**: `polaris peer add <name>` allows you to provision additional client configurations dynamically on your existing WireGuard or AmneziaWG server. Use `polaris peer list` and `polaris peer remove <name>` to manage your peers.
+- **Terminal QR Codes**: Automatically generate terminal-rendered QR codes using `polaris peer qr <name>` for instantly setting up mobile devices (iOS/Android).
+- **System Kill Switch**: Run `polaris killswitch on` to drop all non-VPN outbound traffic (using `iptables` or `pf`) when the tunnel is active, ensuring zero IP leaks.
+
+## [0.7.0] - 2026-07-12
+
+### Added
+
+- **AmneziaWG Stealth Mode**: Added full support for AmneziaWG obfuscated WireGuard tunnels. Use `--mode amneziawg` with `polaris deploy` and `polaris start` to bypass Deep Packet Inspection (DPI) with randomized junk packet sizes and headers.
+- **Automated Obfuscation Params**: The CLI now automatically generates and manages unique AmneziaWG obfuscation parameters (`Jc`, `Jmin`, `Jmax`, `S1`, `S2`, `H1`-`H4`) without requiring manual user configuration.
+
 ## [0.6.0] - 2026-07-12
 
 ### Added
 
 - **First-Class Windows Support**: Polaris now natively binds to `wireguard.exe` NT Services on Windows, bypassing the need for `wg-quick` and `sudo`. This makes Polaris fully cross-platform.
+- **TUI Dashboard**: Added the `polaris dashboard` command, which launches a rich Terminal UI utilizing `blessed` and `blessed-contrib` to render live Rx/Tx bandwidth graphs, GeoIP server maps, and real-time WireGuard peer data.
 
 ## [0.5.0] - 2026-07-12
 

package/README.md

@@ -2,7 +2,7 @@
 
 ![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)
 
-Your True North in Digital Privacy. `polaris` is a production-quality, open-source, self-hosted VPN CLI tool. It wraps SSH dynamic port forwarding into a beautiful CLI experience.
+Your True North in Digital Privacy. `polaris` is a production-quality, open-source, self-hosted VPN CLI tool. It supports SSH dynamic port forwarding, WireGuard, and AmneziaWG (Stealth) tunnels.
 
 ### Prerequisites
 
@@ -45,10 +45,17 @@ polaris stop
 
 | Command | Description |
 | --- | --- |
-| `polaris start --server user@host [--port 1080]` | Start the encrypted SSH tunnel. |
+| `polaris deploy --server user@host --mode amneziawg` | Provision server with AmneziaWG (Stealth Mode) |
+| `polaris start --server user@host [--port 1080] [--mode <type>]` | Start the encrypted tunnel. |
 | `polaris stop` | Stop the active tunnel. |
+| `polaris dashboard` | Opens a rich Terminal User Interface (TUI) with real-time stats. |
 | `polaris status [--full]` | Show current tunnel status. `--full` shows GeoIP, ping latency, and WG stats. |
 | `polaris monitor` | Live bandwidth monitor for WireGuard tunnels. |
+| `polaris killswitch on/off` | Enable or disable the system-wide VPN kill switch. |
+| `polaris peer add <name>` | Generate and add a new peer config for WireGuard/AmneziaWG. |
+| `polaris peer list` | List all peers configured on the server. |
+| `polaris peer remove <name>` | Revoke a peer from the server. |
+| `polaris peer qr <name>` | Display the peer config as a QR code for mobile devices. |
 | `polaris check` | Run a 3-point privacy check (IP, DNS leak, IPv6 leak). |
 | `polaris add <alias> --server user@host` | Save a server profile for quick access. |
 | `polaris list` | List all saved server profiles. |
@@ -56,6 +63,22 @@ polaris stop
 | `polaris server start` | Start a local REST API on `127.0.0.1:7070`. |
 | `polaris update` | Update `polaris-vpn` to the latest version via npm. |
 
+#### `polaris dashboard`
+
+Opens a rich Terminal User Interface (TUI) with real-time graphs, server location maps, and live statistics (Rx/Tx, Ping).
+
+#### `polaris status [--full]`
+
+Displays the connection state, mode, current proxy IP, and active server. Use `--full` to query GeoIP and ping latency.
+
+#### `polaris monitor`
+
+Live bandwidth monitor that actively graphs the download and upload speeds of your tunnel.
+
+#### `polaris check`
+
+Checks if your IP matches the proxy, tests for DNS leaks via `ipleak.net`, and verifies IPv6 routing.
+
 > All commands support the `--json` flag for machine-readable output.
 
 ## Oracle Cloud Free Tier Setup
@@ -90,10 +113,11 @@ One Oracle VM can serve multiple people:
 
 ## Roadmap
 
-- **v0.1**: MVP — SSH SOCKS5 tunnel (Current)
-- **v0.2**: TLS tunnel + DNS-over-HTTPS + leak checker
+- **v0.1**: MVP — SSH SOCKS5 tunnel
 - **v0.5**: WireGuard full tunnel + server provisioning
-- **v1.0**: AmneziaWG stealth mode + multi-peer + QR codes + kill switch
+- **v0.6**: Windows NT Service bindings + Blessed TUI Dashboard
+- **v0.7**: AmneziaWG stealth mode (DPI bypass)
+- **v1.0**: Multi-peer management + QR codes + Kill switch (Current)
 
 ## Contributing
 

package/docs/ORACLE_CLOUD.md

@@ -0,0 +1,56 @@
+# Oracle Cloud "Always Free" VPS Guide
+
+Oracle Cloud offers the most generous free tier in the cloud computing market, making it the perfect companion for a self-hosted Polaris VPN.
+
+This guide will walk you through exactly how to set up an Oracle ARM instance, configure the firewall, and prepare it for Polaris.
+
+## 1. Sign Up for Oracle Cloud
+
+1. Go to [Oracle Cloud Free Tier](https://www.oracle.com/cloud/free/) and sign up.
+2. You will need to provide a credit/debit card for verification. **You will not be charged.** Oracle requires this to prevent spam.
+3. Select your **Home Region** carefully. You cannot change this later without deleting your account. Pick the region geographically closest to you for the lowest latency.
+   - *Example: If you are in South Asia, pick Mumbai or Hyderabad. If you are in Southeast Asia, pick Singapore.*
+
+## 2. Create the Compute Instance
+
+1. From the Oracle Cloud Dashboard, click **Create a VM instance**.
+2. **Name**: `polaris-vpn` (or whatever you prefer).
+3. **Placement**: Leave as default (AD-1).
+4. **Image and Shape**:
+   - Click **Edit**.
+   - **Image**: Select **Ubuntu** (Recommend version 22.04 or newer).
+   - **Shape**: Select **Ampere (ARM)** (`VM.Standard.A1.Flex`).
+   - Configure the shape to use **2 OCPUs** and **12 GB RAM**. (You are allowed up to 4 OCPUs and 24 GB RAM for free, but 2 OCPUs is more than enough for a VPN).
+5. **Networking**:
+   - Leave the default VCN settings.
+   - Ensure **Assign a public IPv4 address** is checked.
+6. **Add SSH keys**:
+   - Select **Generate a key pair for me**.
+   - Click **Save private key**. Keep this `.key` file safe! You will need it to connect.
+7. Click **Create** at the bottom of the page. Your instance will take about 2-3 minutes to provision.
+
+## 3. Configure the Virtual Cloud Network (VCN) Firewall
+
+By default, Oracle Cloud blocks all incoming traffic except SSH (Port 22). WireGuard (and AmneziaWG) requires UDP port 51820 to be open.
+
+1. On your instance details page, look for the **Primary VNIC** section and click on the **Subnet** link (e.g., `subnet-xxxx`).
+2. Under **Security Lists**, click the Default Security List.
+3. Click **Add Ingress Rules**.
+4. Configure the rule as follows:
+   - **Source Type**: CIDR
+   - **Source CIDR**: `0.0.0.0/0`
+   - **IP Protocol**: UDP
+   - **Destination Port Range**: `51820`
+   - **Description**: Allow WireGuard/AmneziaWG
+5. Click **Add Ingress Rules**.
+
+*(Note: If you plan to use the SSH SOCKS5 proxy instead of WireGuard, you don't need to open port 51820, as SSH uses port 22 which is already open).*
+
+## 4. Get Ready for Polaris
+
+1. Go back to your **Instance Details** page.
+2. Note down the **Public IP Address** (e.g., `123.45.67.89`).
+3. Note the default username for Ubuntu images is always `ubuntu`.
+4. Locate the private key you downloaded in Step 2.6 (e.g., `ssh-key-2026-07-12.key`).
+
+You are now ready to deploy Polaris! Head back to the [Full Setup Guide](./SETUP.md) and run the `polaris deploy` command with your new Oracle IP and SSH key.

package/docs/SETUP.md

@@ -0,0 +1,93 @@
+# Full Step-by-Step Setup Guide
+
+Welcome to Polaris VPN! This guide will take you from scratch to having a fully functional, DPI-resistant self-hosted VPN.
+
+## 1. Prepare a Virtual Private Server (VPS)
+
+Polaris needs a Linux server (Ubuntu/Debian recommended) to host the VPN.
+If you don't already have one, you can easily get a powerful one for **free forever**.
+
+👉 **[Click here for the Oracle Cloud Free Tier Guide](./ORACLE_CLOUD.md)**
+
+*Once you have your server's Public IP address and SSH Private Key, continue to Step 2.*
+
+## 2. Install Polaris VPN
+
+On your local machine (where you want to connect *from*), you need Node.js installed.
+
+Install the Polaris CLI globally:
+
+```bash
+npm install -g polaris-vpn
+```
+
+## 3. Provision the Server
+
+You will now use Polaris to automatically install and configure the VPN on your new VPS.
+
+Run the `deploy` command. We highly recommend using the `amneziawg` mode to ensure your VPN traffic cannot be blocked by Deep Packet Inspection (DPI):
+
+```bash
+polaris deploy --server ubuntu@<YOUR_SERVER_IP> --mode amneziawg
+```
+
+*Note: If you receive an SSH authentication error, you need to provide your SSH private key. By default, Polaris looks for `~/.ssh/id_rsa`. If your key is saved elsewhere (like the one downloaded from Oracle), you can use it like this:*
+
+```bash
+eval "$(ssh-agent -s)"
+ssh-add /path/to/your/oracle-ssh-key.key
+polaris deploy --server ubuntu@<YOUR_SERVER_IP> --mode amneziawg
+```
+
+This process takes about 2-3 minutes. Polaris will install AmneziaWG, configure the stealth parameters, set up the kernel modules, and generate your local client configuration.
+
+## 4. Start the Tunnel
+
+Once deployment is successful, you can connect to your new VPN!
+
+Run:
+
+```bash
+polaris start
+```
+
+You should see a success message. All your internet traffic is now encrypted and routed through your VPS!
+
+To verify everything is working and your IP has changed, run:
+
+```bash
+polaris check
+```
+
+## 5. Enable the Kill Switch (Optional)
+
+To ensure your real IP is never leaked if the VPN connection drops, enable the system kill switch:
+
+```bash
+polaris killswitch on
+```
+
+## 6. Connect Mobile Devices
+
+Want to use the VPN on your phone? Polaris can generate terminal QR codes!
+First, generate a new peer configuration on the server:
+
+```bash
+polaris peer add my-iphone
+```
+
+Then, display the QR code on your terminal:
+
+```bash
+polaris peer qr my-iphone
+```
+
+Download the **AmneziaWG** app on iOS or Android, tap the `+` button, select **Create from QR code**, and scan your screen!
+
+## 7. Stop the Tunnel
+
+When you are done, simply run:
+
+```bash
+polaris stop
+```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polaris-vpn",
-  "version": "0.6.0",
+  "version": "2.0.0-beta",
   "description": "Your True North in Digital Privacy. A self-hosted VPN CLI.",
   "type": "module",
   "bin": {
@@ -9,10 +9,15 @@
   },
   "files": [
     "src",
+    "docs",
     "README.md",
     "LICENSE",
     "CHANGELOG.md"
   ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Divyo/polaris-vpn.git"
+  },
   "engines": {
     "node": ">=18"
   },
@@ -32,6 +37,8 @@
     "oracle-cloud"
   ],
   "dependencies": {
+    "blessed": "^0.1.81",
+    "blessed-contrib": "^4.11.0",
     "chalk": "^5.6.2",
     "cli-table3": "^0.6.5",
     "commander": "^15.0.0",

package/src/cli.js

@@ -41,10 +41,10 @@ program
 
 program
   .command('start')
-  .description('Start the encrypted SSH, TLS or WireGuard tunnel')
+  .description('Start the encrypted SSH, TLS, WireGuard or AmneziaWG tunnel')
   .option('-s, --server <user@host>', 'SSH/TLS/WireGuard server to connect to')
   .option('-p, --port <number>', 'Local SOCKS5 port to bind', '1080')
-  .option('-m, --mode <type>', 'Tunnel mode: ssh, tls, wireguard or auto', 'auto')
+  .option('-m, --mode <type>', 'Tunnel mode: ssh, tls, wireguard, amneziawg or auto', 'auto')
   .action(async (options, cmd) => {
     if (!cmd.optsWithGlobals().json) printBanner();
     try {
@@ -85,6 +85,19 @@ program
     }
   });
 
+program
+  .command('dashboard')
+  .description('Open the live TUI dashboard')
+  .action(async (options, cmd) => {
+    try {
+      const run = (await import('./commands/dashboard.js')).default;
+      await run(cmd.optsWithGlobals());
+    } catch (err) {
+      printError('Command failed', err);
+      process.exit(1);
+    }
+  });
+
 program
   .command('check')
   .description('Run a 3-point privacy check (IP, DNS leak, IPv6 leak)')
@@ -190,10 +203,11 @@ dnsCmd
 
 program
   .command('deploy')
-  .description('Provision a fresh Ubuntu server as a WireGuard server')
+  .description('Provision a remote server with WireGuard or AmneziaWG')
   .requiredOption('-s, --server <user@host>', 'SSH server to configure')
   .option('-i, --identity <path>', 'SSH private key file path')
   .option('-p, --password <password>', 'SSH password (alternative to identity)')
+  .option('-m, --mode <type>', 'Tunnel mode: wireguard or amneziawg', 'wireguard')
   .action(async (options, cmd) => {
     if (!cmd.optsWithGlobals().json) printBanner();
     try {
@@ -205,7 +219,39 @@ program
     }
   });
 
-const peerCmd = program.command('peer').description('Manage WireGuard client peers');
+const ksCmd = program.command('killswitch').description('Manage the system VPN kill switch');
+
+ksCmd
+  .command('on')
+  .description('Enable the kill switch')
+  .action(async (options, cmd) => {
+    if (!cmd.optsWithGlobals().json) printBanner();
+    try {
+      const { setKillSwitchConfig } = await import('./utils/kill-switch.js');
+      setKillSwitchConfig(true);
+      printSuccess('Kill switch enabled. All non-VPN traffic will be blocked when the tunnel is active.');
+    } catch (err) {
+      if (!cmd.optsWithGlobals().json) printError('Command failed', err);
+      process.exit(1);
+    }
+  });
+
+ksCmd
+  .command('off')
+  .description('Disable the kill switch')
+  .action(async (options, cmd) => {
+    if (!cmd.optsWithGlobals().json) printBanner();
+    try {
+      const { setKillSwitchConfig } = await import('./utils/kill-switch.js');
+      setKillSwitchConfig(false);
+      printSuccess('Kill switch disabled.');
+    } catch (err) {
+      if (!cmd.optsWithGlobals().json) printError('Command failed', err);
+      process.exit(1);
+    }
+  });
+
+const peerCmd = program.command('peer').description('Manage WireGuard/AmneziaWG client peers');
 
 peerCmd
   .command('add <name>')

package/src/commands/dashboard.js

@@ -0,0 +1,229 @@
+import blessed from 'blessed';
+import contrib from 'blessed-contrib';
+import { getActiveTunnel } from '../core/tunnel-service.js';
+import { getProxiedIp } from '../net/ip-check.js';
+import fetch from 'node-fetch';
+import { spawnSync } from 'child_process';
+import os from 'os';
+
+const pingServer = (ip) => {
+  const isWin = os.platform() === 'win32';
+  const args = isWin ? ['-n', '1', '-w', '2000', ip] : ['-c', '1', '-W', '2', ip];
+  const res = spawnSync('ping', args, { encoding: 'utf-8' });
+  if (res.status === 0) {
+    if (isWin) {
+      const match = res.stdout.match(/Average = (\d+)ms/);
+      if (match) return `${match[1]} ms`;
+    } else {
+      const match = res.stdout.match(/time=([\d.]+)\s*ms/);
+      if (match) return `${match[1]} ms`;
+    }
+  }
+  return 'Timeout';
+};
+
+const getGeoIp = async (ip) => {
+  try {
+    const res = await fetch(`http://ip-api.com/json/${ip}`);
+    const data = await res.json();
+    if (data.status === 'success') {
+      return { 
+        text: `${data.city}, ${data.country}`,
+        lat: data.lat,
+        lon: data.lon,
+        isp: data.isp
+      };
+    }
+  } catch (err) {}
+  return null;
+};
+
+const formatBytes = (bytes) => {
+  if (bytes === 0) return '0 B';
+  const k = 1024;
+  const sizes = ['B', 'KB', 'MB', 'GB', 'TB'];
+  const i = Math.floor(Math.log(bytes) / Math.log(k));
+  return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];
+};
+
+const getWgStats = () => {
+  const dumpRes = spawnSync('sudo', ['wg', 'show', 'all', 'dump'], { encoding: 'utf-8' });
+  if (dumpRes.status !== 0) return null;
+  const lines = dumpRes.stdout.trim().split('\n');
+  if (lines.length <= 1) return null;
+  
+  let totalRx = 0;
+  let totalTx = 0;
+  const peers = [];
+  for (let i = 1; i < lines.length; i++) {
+    const peerInfo = lines[i].split('\t');
+    const rx = parseInt(peerInfo[6], 10) || 0;
+    const tx = parseInt(peerInfo[7], 10) || 0;
+    totalRx += rx;
+    totalTx += tx;
+    peers.push({
+      pubKey: peerInfo[1].substring(0, 8) + '...',
+      endpoint: peerInfo[4],
+      rx,
+      tx
+    });
+  }
+  return { totalRx, totalTx, peers };
+};
+
+export default async () => {
+  const info = getActiveTunnel();
+  
+  if (!info) {
+    console.error('Tunnel is down. Start the tunnel first to use the dashboard.');
+    process.exit(1);
+  }
+
+  const screen = blessed.screen({
+    smartCSR: true,
+    title: 'Polaris VPN Dashboard'
+  });
+
+  const grid = new contrib.grid({ rows: 12, cols: 12, screen: screen });
+
+  // 1. Header Box (Status, IP, Uptime)
+  const headerBox = grid.set(0, 0, 3, 4, blessed.box, {
+    label: ' Tunnel Status ',
+    content: 'Loading...',
+    tags: true,
+    style: { fg: 'green', border: { fg: 'cyan' } }
+  });
+
+  // 2. Line Chart (Bandwidth)
+  const lineChart = grid.set(0, 4, 6, 8, contrib.line, {
+    label: ' Bandwidth (Bytes/s) ',
+    showLegend: true,
+    legend: { width: 12 },
+    style: { baseline: 'gray', line: 'yellow', text: 'green' },
+    xLabelPadding: 3,
+    xPadding: 5
+  });
+
+  // 3. Map (GeoIP)
+  const mapWidget = grid.set(3, 0, 9, 7, contrib.map, {
+    label: ' Server Location ',
+    style: { shapeColor: 'cyan' }
+  });
+
+  // 4. Peers Table
+  const peersTable = grid.set(6, 7, 6, 5, contrib.table, {
+    keys: true,
+    fg: 'white',
+    selectedFg: 'white',
+    selectedBg: 'blue',
+    interactive: false,
+    label: ' Active Peers ',
+    width: '100%',
+    height: '100%',
+    border: { type: 'line', fg: 'cyan' },
+    columnSpacing: 2,
+    columnWidth: [15, 20, 10, 10]
+  });
+
+  const rxData = { title: 'RX', x: [], y: [], style: { line: 'green' } };
+  const txData = { title: 'TX', x: [], y: [], style: { line: 'red' } };
+  
+  // Seed initial chart data
+  for (let i = 0; i < 20; i++) {
+    const t = new Date(Date.now() - (20 - i) * 1000).toLocaleTimeString().split(' ')[0];
+    rxData.x.push(t);
+    rxData.y.push(0);
+    txData.x.push(t);
+    txData.y.push(0);
+  }
+
+  let prevRx = 0;
+  let prevTx = 0;
+  let hasInitWg = false;
+  let currentIp = 'Loading...';
+  let geoData = null;
+  let latency = '...';
+  let geoFetched = false;
+
+  screen.key(['escape', 'q', 'C-c'], () => {
+    return process.exit(0);
+  });
+
+  const updateDashboard = async () => {
+    // 1. Fetch IP & GeoIP (runs once)
+    if (!geoFetched) {
+      geoFetched = true;
+      try {
+        currentIp = await getProxiedIp(info.port);
+        geoData = await getGeoIp(currentIp);
+        if (geoData) {
+          mapWidget.addMarker({ lat: geoData.lat, lon: geoData.lon, color: 'red', char: 'X' });
+        }
+      } catch (err) {}
+    }
+
+    // 2. Fetch Ping
+    const serverIp = info.server.split('@').pop();
+    latency = pingServer(serverIp);
+
+    // 3. Update Header
+    const uptimeMin = Math.floor((Date.now() - new Date(info.startTime).getTime()) / 60000);
+    headerBox.setContent(
+      `{bold}Status{/bold}:  {green-fg}UP{/green-fg}\n` +
+      `{bold}Server{/bold}:  ${info.server}\n` +
+      `{bold}Mode{/bold}:    ${(info.mode || 'ssh').toUpperCase()}\n` +
+      `{bold}IP{/bold}:      ${currentIp}\n` +
+      `{bold}Uptime{/bold}:  ${uptimeMin} min\n` +
+      `{bold}Ping{/bold}:    ${latency}\n` +
+      `{bold}GeoIP{/bold}:   ${geoData ? geoData.text : 'N/A'}`
+    );
+
+    // 4. Update WG Stats & Chart
+    if (info.mode === 'wireguard' || info.mode === 'amneziawg' || info.mode === 'auto') {
+      const stats = getWgStats();
+      if (stats) {
+        if (!hasInitWg) {
+          prevRx = stats.totalRx;
+          prevTx = stats.totalTx;
+          hasInitWg = true;
+        } else {
+          const rxSpeed = stats.totalRx - prevRx;
+          const txSpeed = stats.totalTx - prevTx;
+          prevRx = stats.totalRx;
+          prevTx = stats.totalTx;
+
+          const t = new Date().toLocaleTimeString().split(' ')[0];
+          rxData.x.shift();
+          rxData.x.push(t);
+          rxData.y.shift();
+          rxData.y.push(rxSpeed);
+
+          txData.x.shift();
+          txData.x.push(t);
+          txData.y.shift();
+          txData.y.push(txSpeed);
+
+          lineChart.setData([rxData, txData]);
+        }
+
+        const tableData = stats.peers.map(p => [
+          p.pubKey, 
+          p.endpoint || 'N/A', 
+          formatBytes(p.rx), 
+          formatBytes(p.tx)
+        ]);
+        
+        peersTable.setData({
+          headers: ['Peer', 'Endpoint', 'RX', 'TX'],
+          data: tableData.length ? tableData : [['No peers', '-', '-', '-']]
+        });
+      }
+    }
+
+    screen.render();
+  };
+
+  setInterval(updateDashboard, 1000);
+  updateDashboard();
+  screen.render();
+};

package/src/commands/start.js

@@ -88,8 +88,21 @@ export default async (options) => {
     const hostPart = server.includes('@') ? server.split('@')[1] : server;
     let actualMode = requestedMode;
 
+    const AWG_CONF = path.join(CONFIG_DIR, 'wg', 'awg0.conf');
+
+    const hasAwgQuick = () => {
+      try {
+        const res = spawnSync('which', ['awg-quick'], { encoding: 'utf-8' });
+        return res.status === 0;
+      } catch (e) {
+        return false;
+      }
+    };
+
     if (requestedMode === 'auto') {
-      if (fs.existsSync(WG_CONF) && hasWgQuick()) {
+      if (fs.existsSync(AWG_CONF) && hasAwgQuick()) {
+        actualMode = 'amneziawg';
+      } else if (fs.existsSync(WG_CONF) && hasWgQuick()) {
         actualMode = 'wireguard';
       } else {
         if (!isJson) {
@@ -115,7 +128,7 @@ export default async (options) => {
 
     const res = await startTunnel(server, port, actualMode, isJson);
     
-    if (actualMode === 'wireguard') {
+    if (actualMode === 'wireguard' || actualMode === 'amneziawg') {
       if (!isJson) {
         spinner.text = 'Waiting for interface to configure...';
       }
@@ -128,12 +141,12 @@ export default async (options) => {
       
       if (!isJson) {
         spinner.stop();
-        printSuccess(`WireGuard full tunnel established successfully to ${server}`);
+        printSuccess(`${actualMode === 'amneziawg' ? 'AmneziaWG (Stealth)' : 'WireGuard'} full tunnel established successfully to ${server}`);
         console.log(`\n  ${chalk.dim('Old IP:')} ${chalk.red(oldIp)}`);
         console.log(`  ${chalk.dim('New IP:')} ${chalk.green(newIp)}`);
         console.log(`  ${chalk.dim('Routing:')} System-wide (All OS traffic)`);
       } else {
-        console.log(JSON.stringify({ success: true, oldIp, newIp, mode: 'wireguard', pid: res.pid }));
+        console.log(JSON.stringify({ success: true, oldIp, newIp, mode: actualMode, pid: res.pid }));
       }
     } else {
       if (!isJson) {

package/src/core/deploy-service.js

@@ -2,7 +2,7 @@ import { Client } from 'ssh2';
 import fs from 'fs';
 import path from 'path';
 import os from 'os';
-import { generateKeyPair } from '../tunnel/wg.js';
+import { generateKeyPair, generateAwgParams } from '../tunnel/wg.js';
 import { ensureDir, CONFIG_DIR } from '../utils/config.js';
 
 const getDefaultPrivateKey = () => {
@@ -37,6 +37,7 @@ export const deployServer = async (serverStr, options = {}) => {
   const parts = serverStr.split('@');
   const username = parts.length > 1 ? parts[0] : 'ubuntu';
   const host = parts.length > 1 ? parts[1] : parts[0];
+  const isAwg = options.mode === 'amneziawg';
   
   const privateKey = options.privateKey 
     ? fs.readFileSync(options.privateKey) 
@@ -49,6 +50,7 @@ export const deployServer = async (serverStr, options = {}) => {
   // 1. Generate local keys
   const serverKeys = generateKeyPair();
   const clientKeys = generateKeyPair();
+  const awgParams = isAwg ? generateAwgParams() : null;
 
   const conn = new Client();
 
@@ -56,10 +58,17 @@ export const deployServer = async (serverStr, options = {}) => {
     conn.on('ready', async () => {
       try {
         const onProgress = options.onProgress || (() => {});
+        const ifaceName = isAwg ? 'awg0' : 'wg0';
+        const configDir = isAwg ? '/etc/amnezia/amneziawg' : '/etc/wireguard';
+        const quickCmd = isAwg ? 'awg-quick' : 'wg-quick';
 
         // Step 1: Install packages
-        onProgress('Installing WireGuard and UFW on remote VPS...');
-        let res = await sshExec(conn, 'sudo apt-get update -y && sudo apt-get install -y wireguard ufw');
+        onProgress(`Installing ${isAwg ? 'AmneziaWG' : 'WireGuard'}, UFW, Unbound, and Fail2Ban...`);
+        let installCmd = 'sudo apt-get update -y && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y wireguard ufw unbound fail2ban';
+        if (isAwg) {
+          installCmd = 'sudo apt-get update -y && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y software-properties-common && sudo add-apt-repository -y ppa:amnezia/ppa && sudo apt-get update -y && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y amneziawg-dkms amneziawg-tools ufw unbound fail2ban';
+        }
+        let res = await sshExec(conn, installCmd);
         if (res.code !== 0) throw new Error(`Installation failed: ${res.stderr}`);
 
         // Step 2: Enable packet forwarding
@@ -73,26 +82,59 @@ export const deployServer = async (serverStr, options = {}) => {
         const ethInterface = res.stdout.trim() || 'eth0';
 
         // Step 4: Write server config
-        onProgress('Configuring WireGuard server wg0...');
+        onProgress(`Configuring server ${ifaceName}...`);
+        
+        let obfuscationBlock = '';
+        if (isAwg) {
+          obfuscationBlock = `Jc = ${awgParams.Jc}
+Jmin = ${awgParams.Jmin}
+Jmax = ${awgParams.Jmax}
+S1 = ${awgParams.S1}
+S2 = ${awgParams.S2}
+H1 = ${awgParams.H1}
+H2 = ${awgParams.H2}
+H3 = ${awgParams.H3}
+H4 = ${awgParams.H4}`;
+        }
+
         const serverConf = `[Interface]
 PrivateKey = ${serverKeys.privateKey}
 Address = 10.0.0.1/24
 ListenPort = 51820
-PostUp = ufw route allow in on wg0; iptables -t nat -A POSTROUTING -o ${ethInterface} -j MASQUERADE
-PostDown = ufw route delete allow in on wg0; iptables -t nat -D POSTROUTING -o ${ethInterface} -j MASQUERADE
+PostUp = ufw route allow in on ${ifaceName}; iptables -t nat -A POSTROUTING -o ${ethInterface} -j MASQUERADE
+PostDown = ufw route delete allow in on ${ifaceName}; iptables -t nat -D POSTROUTING -o ${ethInterface} -j MASQUERADE
+${obfuscationBlock}
 
 [Peer]
 PublicKey = ${clientKeys.publicKey}
 AllowedIPs = 10.0.0.2/32
 `;
 
-        res = await sshExec(conn, `cat << 'EOF' > /tmp/wg0.conf\n${serverConf}\nEOF\nsudo mv /tmp/wg0.conf /etc/wireguard/wg0.conf && sudo chmod 600 /etc/wireguard/wg0.conf`);
+        res = await sshExec(conn, `sudo mkdir -p ${configDir} && cat << 'EOF' > /tmp/${ifaceName}.conf\n${serverConf}\nEOF\nsudo mv /tmp/${ifaceName}.conf ${configDir}/${ifaceName}.conf && sudo chmod 600 ${configDir}/${ifaceName}.conf`);
         if (res.code !== 0) throw new Error(`Server config write failed: ${res.stderr}`);
 
         // Step 5: Start service
-        onProgress('Starting WireGuard interface...');
-        res = await sshExec(conn, 'sudo systemctl stop wg-quick@wg0 || true && sudo systemctl start wg-quick@wg0 && sudo systemctl enable wg-quick@wg0');
-        if (res.code !== 0) throw new Error(`Starting WireGuard failed: ${res.stderr}`);
+        onProgress(`Starting ${ifaceName} interface...`);
+        res = await sshExec(conn, `sudo systemctl stop ${quickCmd}@${ifaceName} || true && sudo systemctl start ${quickCmd}@${ifaceName} && sudo systemctl enable ${quickCmd}@${ifaceName}`);
+        if (res.code !== 0) throw new Error(`Starting tunnel failed: ${res.stderr}`);
+
+        // Step 5b: Configure Unbound DNS
+        onProgress('Configuring Unbound Zero-Log DNS...');
+        const unboundConf = `server:
+    interface: 10.0.0.1
+    access-control: 10.0.0.0/24 allow
+    hide-identity: yes
+    hide-version: yes
+    use-caps-for-id: yes
+    prefetch: yes
+`;
+        res = await sshExec(conn, `cat << 'EOF' > /tmp/polaris-dns.conf\n${unboundConf}\nEOF\nsudo mv /tmp/polaris-dns.conf /etc/unbound/unbound.conf.d/polaris-dns.conf && sudo systemctl restart unbound && sudo systemctl enable unbound`);
+        if (res.code !== 0) throw new Error(`Unbound setup failed: ${res.stderr}`);
+
+        // Step 5c: Start Fail2Ban
+        onProgress('Starting Fail2Ban SSH protection...');
+        res = await sshExec(conn, 'sudo systemctl enable fail2ban && sudo systemctl restart fail2ban');
+        if (res.code !== 0) throw new Error(`Fail2ban setup failed: ${res.stderr}`);
 
         // Step 6: Configure UFW firewall
         onProgress('Configuring UFW firewall...');
@@ -104,7 +146,8 @@ AllowedIPs = 10.0.0.2/32
         const clientConf = `[Interface]
 PrivateKey = ${clientKeys.privateKey}
 Address = 10.0.0.2/24
-DNS = 1.1.1.1
+DNS = 10.0.0.1
+${obfuscationBlock}
 
 [Peer]
 PublicKey = ${serverKeys.publicKey}
@@ -117,15 +160,17 @@ PersistentKeepalive = 25
         ensureDir(wgDir);
         
         // Save client config
-        const clientConfPath = path.join(wgDir, 'wg0.conf');
+        const clientConfPath = path.join(wgDir, `${ifaceName}.conf`);
         fs.writeFileSync(clientConfPath, clientConf, 'utf-8');
 
         // Also save provisioning info to config
         fs.writeFileSync(path.join(wgDir, 'deploy.json'), JSON.stringify({
           server: serverStr,
+          mode: options.mode || 'wireguard',
           serverPublicKey: serverKeys.publicKey,
           clientPublicKey: clientKeys.publicKey,
           interface: ethInterface,
+          awgParams: isAwg ? awgParams : null,
           timestamp: new Date().toISOString()
         }, null, 2), 'utf-8');
 

package/src/core/peer-service.js

@@ -65,10 +65,13 @@ const sshExec = (client, command) => {
 export const addPeer = async (name) => {
   const info = getDeployInfo();
   const conn = await sshConnect(info);
+  const isAwg = info.mode === 'amneziawg';
+  const confFile = isAwg ? '/etc/amnezia/amneziawg/awg0.conf' : '/etc/wireguard/wg0.conf';
+  const quickCmd = isAwg ? 'awg-quick@awg0' : 'wg-quick@wg0';
 
   try {
-    // 1. Read remote wg0.conf
-    const catRes = await sshExec(conn, 'sudo cat /etc/wireguard/wg0.conf');
+    // 1. Read remote config
+    const catRes = await sshExec(conn, `sudo cat ${confFile}`);
     if (catRes.code !== 0) throw new Error(`Failed to read server config: ${catRes.stderr}`);
     const configContent = catRes.stdout;
 
@@ -99,18 +102,32 @@ PublicKey = ${peerKeys.publicKey}
 AllowedIPs = ${peerIp}/32
 `;
 
-    const writeCmd = `echo "${peerConfigBlock.replace(/"/g, '\\"')}" | sudo tee -a /etc/wireguard/wg0.conf`;
+    const writeCmd = `echo "${peerConfigBlock.replace(/"/g, '\\"')}" | sudo tee -a ${confFile}`;
     let res = await sshExec(conn, writeCmd);
     if (res.code !== 0) throw new Error(`Failed to append remote peer: ${res.stderr}`);
 
-    // Sync remote wireguard
-    await sshExec(conn, 'sudo systemctl restart wg-quick@wg0');
+    // Sync remote tunnel
+    await sshExec(conn, `sudo systemctl restart ${quickCmd}`);
+
+    let obfuscationBlock = '';
+    if (isAwg && info.awgParams) {
+      obfuscationBlock = `Jc = ${info.awgParams.Jc}
+Jmin = ${info.awgParams.Jmin}
+Jmax = ${info.awgParams.Jmax}
+S1 = ${info.awgParams.S1}
+S2 = ${info.awgParams.S2}
+H1 = ${info.awgParams.H1}
+H2 = ${info.awgParams.H2}
+H3 = ${info.awgParams.H3}
+H4 = ${info.awgParams.H4}`;
+    }
 
     // 3. Save peer config locally
     const clientConf = `[Interface]
 PrivateKey = ${peerKeys.privateKey}
 Address = ${peerIp}/24
-DNS = 1.1.1.1
+DNS = 10.0.0.1
+${obfuscationBlock}
 
 [Peer]
 PublicKey = ${info.serverPublicKey}
@@ -135,10 +152,13 @@ PersistentKeepalive = 25
 export const listPeers = async () => {
   const info = getDeployInfo();
   const conn = await sshConnect(info);
+  const isAwg = info.mode === 'amneziawg';
+  const confFile = isAwg ? '/etc/amnezia/amneziawg/awg0.conf' : '/etc/wireguard/wg0.conf';
+  const showCmd = isAwg ? 'awg show awg0 dump' : 'wg show wg0 dump';
 
   try {
     // 1. Read remote configuration to parse names
-    const catRes = await sshExec(conn, 'sudo cat /etc/wireguard/wg0.conf');
+    const catRes = await sshExec(conn, `sudo cat ${confFile}`);
     if (catRes.code !== 0) throw new Error('Failed to read remote config');
     const content = catRes.stdout;
 
@@ -158,9 +178,9 @@ export const listPeers = async () => {
       }
     }
 
-    // 2. Fetch wg status
-    const showRes = await sshExec(conn, 'sudo wg show wg0 dump');
-    if (showRes.code !== 0) throw new Error('Failed to run wg show');
+    // 2. Fetch tunnel status
+    const showRes = await sshExec(conn, `sudo ${showCmd}`);
+    if (showRes.code !== 0) throw new Error('Failed to run show command');
     
     const dumpLines = showRes.stdout.trim().split('\n');
     const list = [];
@@ -193,9 +213,12 @@ export const listPeers = async () => {
 export const removePeer = async (name) => {
   const info = getDeployInfo();
   const conn = await sshConnect(info);
+  const isAwg = info.mode === 'amneziawg';
+  const confFile = isAwg ? '/etc/amnezia/amneziawg/awg0.conf' : '/etc/wireguard/wg0.conf';
+  const quickCmd = isAwg ? 'awg-quick@awg0' : 'wg-quick@wg0';
 
   try {
-    const catRes = await sshExec(conn, 'sudo cat /etc/wireguard/wg0.conf');
+    const catRes = await sshExec(conn, `sudo cat ${confFile}`);
     if (catRes.code !== 0) throw new Error('Failed to read remote config');
     const content = catRes.stdout;
 
@@ -209,11 +232,11 @@ export const removePeer = async (name) => {
     const newContent = filteredBlocks.join('[Peer]');
 
     // Save remote config back
-    const writeRes = await sshExec(conn, `cat << 'EOF' > /tmp/wg0.conf\n${newContent}\nEOF\nsudo mv /tmp/wg0.conf /etc/wireguard/wg0.conf && sudo chmod 600 /etc/wireguard/wg0.conf`);
+    const writeRes = await sshExec(conn, `cat << 'EOF' > /tmp/temp.conf\n${newContent}\nEOF\nsudo mv /tmp/temp.conf ${confFile} && sudo chmod 600 ${confFile}`);
     if (writeRes.code !== 0) throw new Error('Failed to update remote config');
 
-    // Sync remote wireguard
-    await sshExec(conn, 'sudo systemctl restart wg-quick@wg0');
+    // Sync remote tunnel
+    await sshExec(conn, `sudo systemctl restart ${quickCmd}`);
 
     // Remove local peer config if it exists
     const peerConfPath = path.join(CONFIG_DIR, 'wg', 'peers', `${name}.conf`);

package/src/core/tunnel-service.js

@@ -9,15 +9,17 @@ import { loadDaemonState, clearDaemonState, killPid, saveDaemonState } from '../
 import { TUNNEL_PID_FILE, TUNNEL_CONFIG_FILE, CONFIG_DIR, ensureDir } from '../utils/config.js';
 
 const WG_CONF = path.join(CONFIG_DIR, 'wg', 'wg0.conf');
+const AWG_CONF = path.join(CONFIG_DIR, 'wg', 'awg0.conf');
 
 export const getActiveTunnel = () => {
   const info = loadDaemonState(TUNNEL_PID_FILE, TUNNEL_CONFIG_FILE);
   if (!info) return null;
 
-  // For WireGuard, PID file tracks start process, but we verify interface status
-  if (info.mode === 'wireguard') {
+  // For WireGuard/AmneziaWG, PID file tracks start process, but we verify interface status
+  if (info.mode === 'wireguard' || info.mode === 'amneziawg') {
+    const showCmd = info.mode === 'amneziawg' ? 'awg' : 'wg';
     try {
-      const showRes = spawnSync('sudo', ['wg', 'show'], { encoding: 'utf-8' });
+      const showRes = spawnSync('sudo', [showCmd, 'show'], { encoding: 'utf-8' });
       if (showRes.status !== 0 || !showRes.stdout.includes('interface:')) {
         clearDaemonState(TUNNEL_PID_FILE, TUNNEL_CONFIG_FILE);
         return null;
@@ -33,8 +35,9 @@ export const getActiveTunnel = () => {
 export const stopActiveTunnel = (isJson = false) => {
   const info = getActiveTunnel();
   if (info) {
-    if (info.mode === 'wireguard') {
-      stopWgTunnel(WG_CONF, isJson);
+    if (info.mode === 'wireguard' || info.mode === 'amneziawg') {
+      const confPath = info.mode === 'amneziawg' ? AWG_CONF : WG_CONF;
+      stopWgTunnel(confPath, isJson, info.mode === 'amneziawg');
       disableKillSwitch(info.server);
     } else {
       killPid(info.pid);
@@ -49,24 +52,26 @@ export const startTunnel = async (server, port, mode = 'ssh', isJson = false) =>
   ensureDir();
 
   let pid;
-  if (mode === 'wireguard') {
-    if (!fs.existsSync(WG_CONF)) {
-      throw new Error(`WireGuard client configuration not found at ${WG_CONF}. Please provision the server first with "polaris deploy".`);
+  if (mode === 'wireguard' || mode === 'amneziawg') {
+    const isAwg = mode === 'amneziawg';
+    const confPath = isAwg ? AWG_CONF : WG_CONF;
+    if (!fs.existsSync(confPath)) {
+      throw new Error(`${isAwg ? 'AmneziaWG' : 'WireGuard'} client configuration not found at ${confPath}. Please provision the server first with "polaris deploy".`);
     }
 
-    pid = startWgTunnel(WG_CONF, isJson);
+    pid = startWgTunnel(confPath, isJson, isAwg);
     
     // Save state before enableKillSwitch in case sudo prompt needs to block
     saveDaemonState(TUNNEL_PID_FILE, TUNNEL_CONFIG_FILE, {
       pid,
       server,
       port: 0,
-      mode: 'wireguard',
+      mode: mode,
       startTime: new Date().toISOString()
     });
 
     enableKillSwitch(server);
-    return { pid, server, port: 0, mode: 'wireguard' };
+    return { pid, server, port: 0, mode: mode };
   } 
   
   if (mode === 'tls') {

package/src/tunnel/wg.js

@@ -1,5 +1,7 @@
 import { spawnSync, spawn } from 'child_process';
 import crypto from 'crypto';
+import os from 'os';
+import path from 'path';
 
 // Pure JS Curve25519/X25519 key generator matching WireGuard format
 export const generateKeyPair = () => {
@@ -27,11 +29,24 @@ export const generateKeyPair = () => {
   };
 };
 
-import os from 'os';
-import path from 'path';
+export const generateAwgParams = () => {
+  return {
+    Jc: crypto.randomInt(1, 100),
+    Jmin: crypto.randomInt(1, 50),
+    Jmax: crypto.randomInt(50, 1000),
+    S1: crypto.randomInt(15, 150),
+    S2: crypto.randomInt(15, 150),
+    H1: crypto.randomInt(1, 2147483647),
+    H2: crypto.randomInt(1, 2147483647),
+    H3: crypto.randomInt(1, 2147483647),
+    H4: crypto.randomInt(1, 2147483647)
+  };
+};
 
-export const startWgTunnel = (confPath, isJson = false) => {
+export const startWgTunnel = (confPath, isJson = false, isAwg = false) => {
   const isWin = os.platform() === 'win32';
+  const quickCmd = isAwg ? 'awg-quick' : 'wg-quick';
+  const serviceCmd = isAwg ? 'amneziawg' : 'wireguard';
 
   if (!isWin) {
     const sudoCheck = spawnSync('sudo', ['-n', 'true']);
@@ -41,27 +56,29 @@ export const startWgTunnel = (confPath, isJson = false) => {
   }
 
   if (isWin) {
-    const res = spawnSync('wireguard', ['/installtunnelservice', confPath], {
+    const res = spawnSync(serviceCmd, ['/installtunnelservice', confPath], {
       stdio: isJson ? 'ignore' : 'inherit'
     });
     if (res.status !== 0) {
-      throw new Error(`wireguard /installtunnelservice failed (ensure Admin privileges) with code ${res.status}`);
+      throw new Error(`${serviceCmd} /installtunnelservice failed (ensure Admin privileges) with code ${res.status}`);
     }
     return process.pid;
   }
 
-  const res = spawnSync('sudo', ['wg-quick', 'up', confPath], {
+  const res = spawnSync('sudo', [quickCmd, 'up', confPath], {
     stdio: isJson ? 'ignore' : 'inherit'
   });
   
   if (res.status !== 0) {
-    throw new Error(`wg-quick up failed with code ${res.status}`);
+    throw new Error(`${quickCmd} up failed with code ${res.status}`);
   }
   return process.pid;
 };
 
-export const stopWgTunnel = (confPath, isJson = false) => {
+export const stopWgTunnel = (confPath, isJson = false, isAwg = false) => {
   const isWin = os.platform() === 'win32';
+  const quickCmd = isAwg ? 'awg-quick' : 'wg-quick';
+  const serviceCmd = isAwg ? 'amneziawg' : 'wireguard';
 
   if (!isWin) {
     const sudoCheck = spawnSync('sudo', ['-n', 'true']);
@@ -72,20 +89,20 @@ export const stopWgTunnel = (confPath, isJson = false) => {
 
   if (isWin) {
     const interfaceName = path.parse(confPath).name;
-    const res = spawnSync('wireguard', ['/uninstalltunnelservice', interfaceName], {
+    const res = spawnSync(serviceCmd, ['/uninstalltunnelservice', interfaceName], {
       stdio: isJson ? 'ignore' : 'inherit'
     });
     if (res.status !== 0) {
-      throw new Error(`wireguard /uninstalltunnelservice failed with code ${res.status}`);
+      throw new Error(`${serviceCmd} /uninstalltunnelservice failed with code ${res.status}`);
     }
     return;
   }
 
-  const res = spawnSync('sudo', ['wg-quick', 'down', confPath], {
+  const res = spawnSync('sudo', [quickCmd, 'down', confPath], {
     stdio: isJson ? 'ignore' : 'inherit'
   });
   
   if (res.status !== 0) {
-    throw new Error(`wg-quick down failed with code ${res.status}`);
+    throw new Error(`${quickCmd} down failed with code ${res.status}`);
   }
 };