Relay for a home host

A host behind a router has no public address for the control plane and SSH to reach. A relay fixes that: a small public Linux VM (the smallest instance anywhere is enough, 1 vCPU and 1 GB) lends one of its extra IPv4 addresses to each host. The host dials a WireGuard tunnel to the relay; traffic for its public IP is forwarded down the tunnel and answered through it. The relay runs no boxes and knows nothing about the control plane.

On the relay VMCopy Anchor Link

curl -fsSL https://kvbox.sh/install-relay.sh | bash
kvbox-relay add home1 --ip <extra-public-ip>

The installer sets up WireGuard, IP forwarding and the kvbox-relay command. add creates a peer for the host and prints one line to paste on the host.

kvbox-relay ls
kvbox-relay status
kvbox-relay rm home1

On the hostCopy Anchor Link

kvbox server relay <the line kvbox-relay add printed>
kvbox server relay off     # take the tunnel down

The host brings the tunnel up (and again on boot) and, when it later joins a control plane, advertises the lent public IP by default. The relay forwards the control plane port 7777 and the per-box SSH ports 20000 to 60000.