omarchy-vpn — VPS VPN bar widget + helper

Omarchy bar plugin for a self-hosted VPS VPN: WireGuard full-tunnel (vps-wg0) with an SSH SOCKS fallback (:51080). Live RX/TX, handshake age, exit IP, and an IPv6-leak guard in the panel.

Install

omarchy plugin add https://github.com/ishan-parihar/omarchy-vpn.git --enable
./install.sh   # from the cloned repo: links `vpn`, imports WireGuard, applies IPv6 fix

install.sh is idempotent. It links bin/vpn to ~/.local/bin/vpn, imports ~/.config/vpn/vps-wg0.conf via NetworkManager on first run (copy wireguard/vps-wg0.conf.example there and fill in keys first), and enforces the IPv6 fix below.

Usage

vpn status          # wireguard + socks overview
vpn toggle          # on/off (bar icon right-click does the same)
vpn wg on|off       # full-tunnel, all apps
vpn socks on|off    # per-app proxy, no root (port 51080, canonical)
vpn stats [--json]  # counters, handshake, exit IP, leak + killswitch state
vpn ip              # direct vs VPN exit comparison

Per-app wiring: export ALL_PROXY=socks5h://127.0.0.1:51080, or point the browser at SOCKS5 127.0.0.1:51080 with remote DNS. Verify cover with exit IP, not process state: curl -x socks5h://127.0.0.1:51080 -s --max-time 5 ifconfig.me.

IPv6-leak fix (v1.1.0)

The VPS is IPv4-only, so any IPv6 egress bypasses the tunnel. NetworkManager imports WireGuard profiles with ipv6.method disabled, which drops the ::/0 peer-route even though AllowedIPs includes it — ip -6 route get 2606:4700:4700::1111 went via Wi-Fi instead of vps-wg0. (ipv6.method auto is rejected on WireGuard connections.)

Fix: ipv6.method link-local on the vps-wg0 profile. The ::/0 route lands in policy table 52285 via the tunnel and IPv6 fails closed at the server (curl -6 ifconfig.me times out, vpn stats reports protected). vpn wg on and install.sh enforce this on every connect, so re-imports can't regress it. dispatcher/99-vpn-ipv6-killswitch remains as an optional firewall defense-in-depth layer.

Adapting to your VPS

Personal defaults live at the top of bin/vpn: SOCKS_PORT=51080, WG_ID=vps-wg0, VPS_SSH=racknerd (an ~/.ssh/config alias), and VPS_EXIT (expected exit IP, used only for verification). Fork and edit those four lines; the QML reads everything from vpn stats --json.

Layout

• manifest.json, BarWidget.qml — the plugin (repo root = plugin dir)
• bin/vpn — the control helper the widget shells out to
• dispatcher/99-vpn-ipv6-killswitch — optional NM dispatcher killswitch
• wireguard/vps-wg0.conf.example — client template (real keys never committed)

License

MIT — see LICENSE.