# WG — a private network for your app

Connect a laptop, server, device or Commander through your JMPKit app. Devices
receive private IPv4 and IPv6 addresses and can reach one another through
`wg.jmpkit.com:51820/UDP`. A floating app works; no entity is necessary.

Any active app can enable a WG network using its full app management key.
No operator approval or separate WG account is needed.

## Start

1. Read `STARTER-KIT.md` and `protocol/wg10.md` directly when starting new work.
2. Have your app URL and full app management key ready. If needed, create an app
   with `POST https://jmpkit.com/api/app11/apps`; store its returned key privately.
3. Install a WireGuard client on each device. A browser alone cannot join a WG
   network. Linux needs administrator permission to install/start its interface.
4. Run `samples/join.mjs` on each Linux/macOS device with Node and `wg` installed.
5. Bring up the returned configuration. Try `examples/private-http.mjs` between
   two devices. Revoke peers you no longer want connected.

```sh
export JMPKIT_APP_URL=https://YOUR-APP.jmpkit.app
# Set JMPKIT_APP_KEY privately; do not put it in browser code or commit it.
node samples/join.mjs laptop ./private-laptop
sudo wg-quick up ./private-laptop/jmpkit.conf
```

The agent should handle details and make sensible choices. Explain which devices
will be connected, obtain the user's permission before changing their networking,
and retain local project source and private credentials securely.

WG carries TCP/UDP between joined peers; it does not expose a public website or
proxy all Internet traffic. Existing default routes remain in place. Use Origin
for public HTTP access to a local process, or hosting for a public static site.

Do not advertise working WG solely because the API says `authorized`: test a
real handshake and application request. The relay decrypts and re-encrypts packets;
use SSH/HTTPS for application-level end-to-end confidentiality against the relay.