# Connect your devices

Install the official WireGuard client: https://www.wireguard.com/install/ .

## Linux

Use samples/join.mjs after installing Node and wireguard-tools. Review the returned
config; start `sudo wg-quick up ./private-wg/jmpkit.conf`. Inspect with
`sudo wg show jmpkit`; stop with `sudo wg-quick down ./private-wg/jmpkit.conf`.
The name must not conflict with an existing interface. Do not replace someone
else's VPN config. Kernel/module support and root or equivalent capability are
needed for the interface. Match routing/MTU to the returned template.

On one device run `node examples/private-http.mjs ASSIGNED_IPV4`. On the other:
`curl --noproxy '*' http://FIRST_DEVICE_PRIVATE_IPV4:8080/`.
For IPv6, start the server on its assigned IPv6 and use `http://[ADDRESS]:8080/`.
An OS firewall may need a narrow allow rule for the app subnet and service port.

## macOS

Import a completed configuration into the WireGuard application, or use the CLI
tools. Node sample requires the `wg` command. Let the OS request VPN permission.

## Windows / Android / iOS

Create an empty tunnel in the official WireGuard app to generate a local keypair.
Copy only its public key. From a trusted agent/terminal register it using
samples/register.py or the documented HTTP call. Fetch the config template and
combine its assigned addresses, relay peer and routes with that same local
private key. Save and activate the tunnel. Never paste private keys into public
chat, logs, webpages or this API. A QR-code configuration also contains the
private key: treat it as a secret if you choose to transfer one.

Client interface labels vary by version. Linux packet/API flow has been exercised;
these GUI paths describe the standard WireGuard import workflow, not a claim
that every device/OS was individually tested. Mobile background suspension and
local network restrictions can affect connectivity.

## Troubleshooting

Check your app is active; verify public DNS for wg.jmpkit.com and
outbound UDP 51820; inspect recent handshake and transfer counters. Keepalive is
25 seconds. Use assigned private addresses, not the app's public web hostname,
for peer-to-peer services. A browser may access an HTTP service after the OS has
joined WG, but cannot itself install or maintain the network.