Step 2 of 3

Set up the gateway

The gateway is the only way out of the sandbox in the gateway profile.

What you will do: Start the gateway stack on a Docker host in your local network, and test that it allows only the listed domains.
Before you start: A machine on your local network that runs Docker, and a clone of the repository from Step 1.
What comes next: Step 3: run a tool through the gateway.

Warning: no client authentication

The gateway has no client authentication yet. Anyone who can reach port 8118 can use it. Run it only on a network you trust, and never publish port 8118 to the internet.

Planned Client authentication with mTLS (mutual TLS, where the client also proves its identity with a certificate) is tracked in issue #2.

The stack

The stack in deploy/pi/gateway runs on any Docker host on your local network. It has been tested on a Raspberry Pi 3B with Ubuntu 24.04 arm64. The images build from pinned sources on the host itself.

Gateway services
Service	Role
`warp-init`	Registers a WARP device on first start. The account stays in the `warp-data` volume.
`warp`	Runs wireproxy, the WARP WireGuard tunnel exposed as SOCKS5 on an internal network. SOCKS5 is a general-purpose proxy protocol. It also runs a watchdog that restarts the tunnel when it stops answering.
`privoxy`	Listens on port 8118, allows only the listed domains and answers `403` to everything else.

Configure, start and test

Go to the gateway directory in your clone of the repository:
```
cd deploy/pi/gateway
```
Before the first start, edit two files:
- privoxy/config: set permit-access to your local subnet. The example uses 192.168.0.0/24.
- privoxy/allowlist.action: list your tool's domains as .example.com:443. The default allows only .opencode.ai:443.
Start the stack:
```
docker compose up -d --build
```

Test it from a client. An allowlisted domain should print 200:

curl -sS -o /dev/null -w '%{http_code}\n' -x http://gateway.local:8118 https://opencode.ai/

Any other domain should print 403:

curl -s -o /dev/null -w '%{http_connect}\n' -x http://gateway.local:8118 https://example.com/

Protect the WARP key

Never copy, print or commit the contents of the warp-data volume. It holds the WARP private key.