Skip to content
BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

4 Commits
docs
docs
 
 
infra
infra
 
 
CONTRIBUTING.md
CONTRIBUTING.md
 
 
LICENSE
LICENSE
 
 
LICENSE-CLIENT
LICENSE-CLIENT
 
 
README.md
README.md
 
 
SECURITY.md
SECURITY.md
 
 

Repository files navigation

Snow Radar

Go Version Flutter Version Terraform License API Build Client Build Security Docs

Privacy-first VPN platform with censorship-resistant exit nodes in Singapore and Germany. Built on WireGuard + AmneziaWG, orchestrated by a Go control plane, delivered via Flutter apps.

Why Snow Radar?

Problem Solution
Commercial VPNs log traffic Zero-knowledge architecture: no traffic logs, no bandwidth records, no connection timestamps
WireGuard blocked by DPI Built-in Stealth Mode (AmneziaWG) with junk packets, header obfuscation, handshake scrambling
Single jurisdiction risk Exit nodes in Singapore (Oracle ARM) + Germany (Hetzner) — two legal regimes, no single point of compromise
Vendor lock-in Open source (Apache 2.0 backend, MIT clients), self-hostable, standard protocols
Opaque infrastructure Full IaC (Terraform), documented ADRs, reproducible builds, public devlogs

Architecture at a Glance

┌─────────────┐     HTTPS      ┌──────────────────┐     wgctrl      ┌──────────────────┐
│   Client    │ ─────────────▶ │  Control Plane   │ ──────────────▶ │   Exit Node 1    │
│  (Flutter)  │  POST /connect │    (Go + Gin)    │  ConfigurePeer  │  Oracle ARM SGP  │
└─────────────┘                │  PostgreSQL +    │                 │  wg0 / awg0      │
                               │  Redis           │                 │  10.10.0.0/24    │
                               └──────────────────┘                 └──────────────────┘
                                        │
                                        │ wgctrl
                                        ▼
                               ┌──────────────────┐
                               │   Exit Node 2    │
                               │  Hetzner CX22    │
                               │  wg0 / awg0      │
                               │  10.11.0.0/24    │
                               └──────────────────┘

Three Repositories (Monorepo)

Repository Purpose Tech Stack
snowradar-infra IaC, docs, observability, ops Terraform, Ansible, Prometheus, Grafana
snowradar-api Control plane: auth, peer mgmt, IP allocation Go 1.22, Gin, pgx, Redis, wgctrl-go
snowradar-client Cross-platform VPN apps Flutter 3.22, Riverpod, wireguard_flutter

Features

  • Dual Protocol: WireGuard (performance) + AmneziaWG (censorship resistance)
  • Two Exit Nodes: Singapore (ARM, Always Free) + Falkenstein, DE (x86, €4.51/mo)
  • Dynamic Peer Management: Add/remove peers without WireGuard restart via wgctrl
  • Stealth Mode: One-tap toggle in app enables AmneziaWG obfuscation
  • Zero Logging: No traffic logs, no bandwidth accounting, no connection metadata
  • Kill Switch: Platform-native (Android VpnService, iOS NEVPNManager, desktop)
  • Split Tunneling: Per-app routing (planned)
  • Audit Ready: ADRs, threat model, security checklist, incident response plan

Quick Start

Prerequisites

  • GitHub account
  • Domain registrar (Cloudflare, Porkbun, Namecheap)
  • Oracle Cloud account (Always Free tier)
  • Hetzner Cloud account (~€5/mo)

1. Clone & Bootstrap

git clone https://github.com/Evil-Shown/Snow-Radar.git
cd Snow-Radar

2. Create GitHub Organization & Repos

# Create org: snow-radar
# Create 3 private repos:
#   snowradar-infra, snowradar-api, snowradar-client
# Enable branch protection on main

3. Register Domain & Configure DNS

# Buy snowradar.app (or .io/.network)
# Add A records after Terraform applies (see Phase 0)

4. Provision Infrastructure (Phase 0)

cd snowradar-infra/infra/terraform
cp terraform.tfvars.example terraform.tfvars
# Edit with your Oracle/Hetzner credentials + SSH public key
terraform init && terraform apply

Outputs: oracle_instance_public_ip, hetzner_server_public_ip

5. Harden Servers & Install VPN (Phase 1)

# SSH to both servers, run hardening script
# Install WireGuard + AmneziaWG
# Configure wg0 (51820/udp) + awg0 (51821/udp)
# Deploy Prometheus Node Exporter

6. Build & Deploy Control Plane (Phase 2)

cd snowradar-api
docker compose up -d postgres redis
go run ./cmd/api migrate up
go run ./cmd/api
# POST /api/v1/connect → returns peer config

7. Build Client Apps (Phase 3)

cd snowradar-client
flutter pub get
flutter build apk --release --split-per-abi
# Install on device, tap Connect

8. CI/CD & Stealth Mode (Phase 4)

# GitHub Actions: lint → build Docker → push to GHCR
# GitHub Actions: lint → build APK → upload artifact
# Integrate AmneziaWG in client + backend

9. Alpha Launch (Phase 5)

# Distribute APK to 20 testers across Dialog/SLT/Mobitel/Hutch
# Monitor Grafana, block abuse (port 25), publish devlog

Phase-by-Phase Roadmap

Phase Duration Goal Key Deliverables
0: Foundation Week 1 IaC, repos, ADRs, domain Terraform modules, GitHub org, docs
1: Bare-Metal VPN Week 2 Manual WireGuard/AmneziaWG, monitoring Hardened servers, wg0/awg0, Grafana
2: Control Plane Weeks 3-4 Dynamic peer management via API Go API, wgctrl integration, Postgres/Redis
3: Flutter MVP Weeks 5-6 Walking skeleton app Key gen, secure storage, tunnel activation
4: Stealth + CI/CD Week 7 AmneziaWG toggle, automated builds Stealth Mode, GH Actions, legal docs
5: Alpha Launch Week 8 20 real users, monitoring APK distribution, incident response, devlog

Documentation

Category Documents
Architecture ARCHITECTURE.md — System diagram, components, data flows
Implementation IMPLEMENTATION_GUIDE.md — Phase tasks, code structure, acceptance criteria
Setup SETUP.md — Step-by-step commands for all phases
ADRs adr/ — 000-template, 001-go-flutter, 002-wireguard-amneziawg, 003-oracle-hetzner
Operations GITHUB_SETUP.md, HARDENING_CHECKLIST.md
Development API_SPEC.md, CLIENT_ARCH.md
Legal PRIVACY_POLICY.md, AUP.md

Security

  • Threat Model: SECURITY.md
  • Server Hardening: Ansible playbooks, UFW, sysctl, fail2ban, auditd
  • Client Security: Keystore/Keychain, kill switch, no cleartext traffic
  • Supply Chain: govulncheck, dependabot, cosign, SLSA L3 target
  • Incident Response: Playbooks, runbooks, public postmortems
  • Reporting: security@snowradar.app (PGP: security.asc)

Contributing

We welcome contributions! Please read:

  1. Code of Conduct
  2. Contributing Guide — PR process, commit style, testing
  3. Security Policy — Vulnerability disclosure

Development Setup

# API
cd snowradar-api
docker compose up -d
go run ./cmd/api

# Client
cd snowradar-client
flutter pub get
flutter run -d chrome  # or device

Commit Convention

feat: add AmneziaWG peer configuration endpoint
fix: resolve IPv6 leak on Android kill switch
docs: update ADR-002 with benchmarks
refactor: extract IP allocator to separate package
test: add integration test for peer cleanup

License

Component License
Backend (snowradar-api) Apache 2.0 — prevents closed-source SaaS forks
Clients (snowradar-client) MIT — maximum adoption, app store friendly
Infrastructure (snowradar-infra) Apache 2.0
Documentation CC-BY-4.0

See LICENSE and LICENSE-CLIENT for full text.

Acknowledgments

Links

Built with ❤️ for privacy and censorship resistance.

About

No description, website, or topics provided.

Resources

Readme

Contributing

Contributing

Security policy

Security policy
Activity

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

Packages

Contributors

Languages