VPN, Arch R

ArchR ships three VPN options: Tailscale, WireGuard and ZeroTier. archr-launcher has no switch for them yet, so they are turned on over SSH. When a game starts, active Tailscale and ZeroTier services are stopped and then restarted after the game exits. WireGuard is not on that list.

Tailscale

Tailscale is a zero-config WireGuard-based VPN that lets your handheld reach your PC from anywhere on the internet, securely.

Tailscale needs an SSO provider, Google, GitHub, Microsoft, or any of the supported identity providers.

Install on your PC

Download Tailscale for your OS and log in.

Enable on the handheld

The service only starts when tailscale.up=1 is set in /storage/.config/system/configs/system.cfg; the boot script then creates its marker file. To start it now without rebooting, over SSH:

sed -i 's/^tailscale\.up=.*/tailscale.up=1/' /storage/.config/system/configs/system.cfg
grep -q '^tailscale\.up=' /storage/.config/system/configs/system.cfg || echo 'tailscale.up=1' >> /storage/.config/system/configs/system.cfg
touch /storage/.cache/services/tailscaled.conf
systemctl start tailscaled
tailscale up

The first time, you'll see an authentication URL. Open it on your PC's browser, click Connect, and Tailscale binds the handheld to your tailnet.

Disconnect

Run tailscale down. To stop the service for good, set tailscale.up=0 and reboot.

After auth, your handheld appears under your tailnet's machines, and you can reach it over the tailnet for SSH and file transfer. Tailscale stops while a game runs, so remote sessions may drop, and Netplay over the tailnet needs the change described in During gameplay.

WireGuard

For when you have your own VPN server (e.g. via your router or a self-hosted setup).

Drop the config

Provide a standard wg0.conf from your VPN provider or self-hosted server. Place it at:

/storage/.config/wireguard/wg0.conf

You can copy it via SSH or Samba.

Sample minimal config:

[Interface]
PrivateKey = <your private key>
Address    = 10.111.10.2/24

[Peer]
PublicKey  = <server public key>
AllowedIPs = 0.0.0.0/0
Endpoint   = <server>:<port>

The DNS directive is not supported in this config. Remove any DNS = line or the connection won't come up.

Toggle

Bring the tunnel up or down over SSH with wg-quick (below).

Diagnose

wg show                # active tunnel status
curl -4 ifconfig.co    # current public IP
wg-quick up   /storage/.config/wireguard/wg0.conf
wg-quick down /storage/.config/wireguard/wg0.conf

Generate a keypair

For self-hosting, run wg-keygen to generate the keys under /storage/.cache/wireguard:

wg-keygen             # writes privatekey, publickey and preshared

It only creates keys. Write the client and server configurations yourself.

ZeroTier

ZeroTier is similar to Tailscale but with a different network model, you create networks on your ZeroTier dashboard and join devices to them.

Drop the network ID

/storage/.config/zerotier-networks

One network ID per line. Create the file via SSH or Samba.

Enable

Set zerotier.up=1 in /storage/.config/system/configs/system.cfg and reboot; the boot script creates the service's marker file and starts zerotier-one. To start it now over SSH, after setting the key:

touch /storage/.cache/services/zerotier.conf
systemctl start zerotier-one

Approve in dashboard

Back at my.zerotier.com → your network → Members: your handheld appears as pending. Tick the Auth box.

Manual join

You can also join from SSH:

zerotier-cli join <network-id>
zerotier-cli listnetworks

A manual join on its own does not persist. Memberships are reconciled with /storage/.config/zerotier-networks every time the service starts, including after each game, so record every network ID in that file.

Which one to use

	Tailscale	WireGuard	ZeroTier
Easiest setup	yes	no	no
Self-hostable	partial	yes	partial
Subnet routing	yes	yes	yes
Persistent peer-to-peer	with NATs	direct	with NATs

For most people: Tailscale if you want zero-config, WireGuard if you already have a VPN server, ZeroTier if you prefer their network model.

During gameplay

When a game launches, runemu.sh stops the Tailscale and ZeroTier services that are running (along with Syncthing and the simple HTTP server) and restarts them after the game exits. WireGuard is not on this list. Remote sessions over these VPNs may disconnect while you play.

Netplay over Tailscale or ZeroTier requires changing this default: edit /usr/bin/runemu.sh and remove the service from GAMEPLAY_PAUSE_SERVICES. The file belongs to a package, so a system update can put the original back; repeat the edit after updating.

VPN

On this page