Promote WireGuard from usermod to a core feature?

[film42]

Overview

Context: I work on and operate wled.online, a hosted WireGuard control plane for managing your WLED devices. It can proxy and provide other cool integrations. I'm trying to make WLED dead-simple to operate when you're away from home. But, what I'm proposing below benefits anyone running their own WireGuard gateway (home server, VPS, etc.), not just my service. WireGuard is a fantastic, self-hostable protocol.

Since most of us are running ESP32 boards, WireGuard is pretty much the only practical way to get an encrypted tunnel to a remote service. TLS's handshake and buffer requirements eat too much working memory. WireGuard's footprint is small. That's why wled.online is WireGuard-only.

The downside today: using the WireGuard usermod means building your own firmware. I set up a GitHub project to make prebuilt binaries with WireGuard available to everyone, but traction is low. I also see sign-ups where users clearly expect WireGuard to "just work" and give up when they discover it requires custom firmware.

So I wanted to gauge interest in promoting WireGuard from usermod to an official core feature.

To be specific about scope: compiled in by default for ESP32 boards, but inactive until configured. Happy to provide any data on the two controllers I manage via wled.online almost daily.

Describe alternatives you've considered

The MQTT integration is quite limited and is being reworked, which is great to see, but it will still run into the encrypted-connection problem. TLS will be heavy in both code size and working memory. MQTT will remain useful for homelab users or anyone with a local gateway, but WireGuard handles the remote case much better and doesn't require a second set of APIs.

Additional context

I mentioned the controllers I manage via WireGuard usermod. I just wanted to report that it's been very stable. The one bug I've hit: the interface doesn't restart when a public key changes, so a gateway config change requires a controller restart. I think it's a one-line change to fix this. I'm writing this to remind myself to open a PR to fix it 😅 .

If there's appetite for this, I will happily volunteer to do the work!

Are there any major red flags or blockers here? Would love to hear concerns before I start on anything.

[DedeHai]

the wireguard usermod adds ~27k of flash use. In order to justify this much would need it to be useful for a lot of users. I don't see that, especially as your page is not open source and free to use for anyone.

[film42]

The ~27k number seems right, but I think the cost is being evaluated the wrong way. What's the correct cost for security? WLED ships with no security out of the box. Bundling WireGuard gets real, modern encryption at ~1/5 the flash of a TLS stack.

With it, you can assemble a local encrypted WLED network, or self-host a WireGuard tunnel and reach your controllers when you're not home. For users who find that overwhelming, there are free and paid options to make it easier. I think that's extremely useful to most WLED users.

[netmindz]

I won't not agree that a large proportion of users need to access WLED from outside the home and of those that do, I would have thought those users are also likely to be using Home Assistant

[film42]

I think you're right that there's heavy overlap with HA users, @netmindz. I'm one myself. But HA doesn't solve remote access either. Out of the box it's LAN-only too, so those users still need a VPN/reverse proxy on top of an always-on machine. That's a tall order for the average user.

When I open sourced an MCP server for WLED a few months ago, the comments on reddit were asking for advice on setting up a reverse proxy, with one user asking for advice on port-forwarding... 😬 . So, I'm not sure how many folks are running WLED on the public internet but I'm guessing it's more than zero.

The gap: today, remote access means adding machines inside your house and keeping them alive. With WireGuard in core, the controller relays through a machine you control outside it. Be it a cheap VPS, or a hosted service for people who don't want to run one. And, it's encrypted over the wire from the moment it leaves the controller.

[blazoncek]

Let me chime in as I put 5 years of development into WLED.

WLED is free and open source (and I hope it stays that way). IMO any tool that wants a feature to be built into core WLED has to be free and open source as well. However I am not opposed to make "advanced" features available behind a paywall. But only "advanced" - seldom used - features.

... and there is a question if "wled.online" doesn't infringe on WLED trademark.

[Aircoookie]

My stance is that I would be in favor of adding WireGuard as a core feature to default ESP32 builds if and only if a suitable server software (that can be as simple as forwarding the existing WLED UI on a customizable port) is available for self-hosting (at home or e.g on a self-chosen VPS) as free and open-source software (I would recommend copyleft in this case so that no one can take your code to build a competing commercial offer without also open-sourcing their project).

@film42 If you would consider open-sourcing core parts of your service for self-hosting, that would be a win-win solution IMO. You would gain more customers willing to pay (no hassle with custom builds or setting up servers, which is your core USP anyways) AND contribute to the overall OSS community by offering a libre solution for those that love to tinker themselves.

[film42]

I would be more than OK with open sourcing some or all of WLED Online. It's really not a complicated stack. Most of the work goes into ensuring users can't arbitrarily proxy bytes through my gateway, since WireGuard is a light weight proxy.

Just for reference, if you want to self-host a WG gateway for just you to access your WLED web UI given you have a server with a public IP:

sudo apt update && sudo apt install wireguard -y

# Server side
wg genkey | sudo tee /etc/wireguard/server_private.key | wg pubkey | sudo tee /etc/wireguard/server_public.key

# Client connections for phone and WLED
wg genkey | tee phone_private.key | wg pubkey > phone_public.key
wg genkey | tee wled_private.key | wg pubkey > wled_public.key

# Write your WG config to point to use these keys
vim /etc/wireguard/wg0.conf

# Start our new profile
sudo systemctl enable --now wg-quick@wg0

WireGuard ships an official iOS / Android app. Add your credentials to their app to connect. For WLED you just plug in the secrets. Then you can access the web UI via its WG ip address. I.e. http://172.16.0.2/. You don't need any proprietary software to access your controller.

There are quick-start and long-start guides:

• https://www.pivpn.io/
• https://www.digitalocean.com/community/tutorials/how-to-set-up-wireguard-on-ubuntu-20-04
• https://www.wireguard.com/quickstart/

You could also then use oauth2-proxy to add authentication over your controllers. You can then add Caddy to get automatic SSL for secure access. You can have a cron that CURLs your configuration every day for safe keeping. You can host the open-sourced MCP server integration. You've now effectively built your own private WLED online without any proprietary software.

Btw @blazoncek , it's not clear to me who owns the WLED trademark, if anyone. I looked into it a few months ago, and could not find anything.

[softhack007]

WLED trademark, if anyone. I looked into it a few months ago, and could not find anything.

I agree this is a complicated story, and the answer is hidden in the EUPL-1.2 license terms. Afaik you can do a lot of things as a user/licensee, but the trademark rights stay with the wled development team.

Edit: in May we've added some information to the FAQ https://kno.wled.ge/basics/faq/#bundling-wled-with-custom-hardware-license

This is not legal advice. Please consult a layer.

Situation	What to do
Using WLED's name/logo in marketing	Be careful — the license does not grant trademark rights

Edit2 the license text says:

WLED/LICENSE

Lines 139 to 142 in a565670

	Legal Protection: This Licence does not grant permission to use the trade
	names, trademarks, service marks, or names of the Licensor, except as required
	for reasonable and customary use in describing the origin of the Work and
	reproducing the content of the copyright notice.

[softhack007]

... and there is a question if "wled.online" doesn't infringe on WLED trademark.

I agree with @blazoncek - "wled.online" sounds like it's an official wled address, similar to install.wled.me, wled-install.github.io or kno.wled.ge. That's more than just "reasonable use for describing the origin", its possibly an abuse of "WLED" to promote business.

But that's slightly legal-off-topic for now - I think we can discuss "adding wireguard to official builds" without resolving the trademark question.

[film42]

Thanks, @softhack007 ! I looked at the US trademarks and saw WLED was abandoned.