robonuka/cloak repository overview

⁠Cloak

⁠Cloak is a pluggable transport that enhances traditional proxy tools like OpenVPN to evade sophisticated censorship and data discrimination

Homepage of sources: https://github.com/cbeuw/Cloak⁠

⁠Run as Cloak server

MODE=SERVER

To make a permanent docker volume for storing Cloak settings please create the /opt/cloak folder on the host of your Cloak server/client, and put this docker-compose.yml file anywhere you want in this host:

services:
  cloak:
    container_name: cloak
    image: robonuka/cloak:latest
    restart: unless-stopped
    ports:
      - 443:443/tcp
    environment:
      - 'MODE=SERVER'
      - 'CK_SERVER_PORT=443'
      - 'TCP_BACKEND_ADDRESS=openvp.your.domain'
      - 'TCP_BACKEND_PORT=1194'
      - 'UDP_BACKEND_ADDRESS=wireguard.your.domain'
      - 'UDP_BACKEND_PORT=51820'
    volumes:
      - /etc/localtime:/etc/localtime
      - /opt/cloak:/etc/cloak
    networks:
      - cloak
networks:
  cloak:
    driver: 'bridge'

Then run docker container as usually:

sudo docker compose up -d -f /path/to/your/docker-compose.yml

See the log of docker container with command:

sudo docker logs -f cloak

⁠Important notes:

Cloak server generate ckserver.json and ckserver.pub files at the first run. Do not remove or modify them manually!

⁠Variable for selecting Cloak working MODE

⁠Cloak server environment variables

MODE='SERVER'

⁠Commands to simple manage Cloak server

⁠Re-create AdminUID

sudo docker exec cloak admin new [ProxyMethod]

ProxyMethod should be tcp or udp only!

⁠Get Cloak client config with AdminUID as UID

sudo docker exec cloak admin get [ProxyMethod]

ProxyMethod should be tcp or udp only! Put showed config to the ckclient.json file in a Cloak admin's host.

⁠Delete AdminUID

sudo docker exec cloak admin del

⁠List Cloak client's UIDs

sudo docker exec cloak list

ProxyMethod should be tcp or udp only!

⁠Add a new Cloak client UID

sudo docker exec cloak add <ProxyMethod>

ProxyMethod should be tcp or udp only! Put showed config to the ckclient.json file in a Cloak client's host.

⁠Get Cloak client config

sudo docker exec cloak get <UID> <ProxyMethod>

ProxyMethod should be tcp or udp only! Put showed config to the ckclient.json file in a Cloak client's host.

⁠Delete Cloak client UID

sudo docker exec cloak del <UID>

⁠Delete ALL Cloak client's UIDs

sudo docker exec cloak del KILLEMALL

⁠Run as Cloak client

MODE='CLIENT'

To make a permanent docker volume for storing Cloak client settings please create the /opt/cloak-client-openvpn and/or /opt/cloak-client-wireguard folder(s) with appropriate ckclient.json inside, and put this docker-compose.yml file anywhere you want in this host:

services:
  cloak-client-openvpn:
    container_name: cloak-client-openvpn
    image: robonuka/cloak:latest
    restart: unless-stopped
    ports:
      - 443:443/tcp
    environment:
      - 'MODE=CLIENT'
      - 'CK_CLIENT_PROTOCOL=tcp'
      - 'CK_CLIENT_LISTEN_ADDRESS=cloak-client-openvpn'
      - 'CK_CLIENT_LISTEN_PORT=443'
      - 'CK_SERVER_ADDRESS=your.cloak.server'
      - 'CK_SERVER_PORT=443'
    volumes:
      - /etc/localtime:/etc/localtime
      - /opt/cloak-client-openvpn:/etc/cloak
    networks:
      - cloak
  cloak-client-wireguard:
    container_name: cloak-client-wireguard
    image: robonuka/cloak:latest
    restart: unless-stopped
    ports:
      - 138:138/udp
    environment:
      - 'MODE=CLIENT'
      - 'CK_CLIENT_PROTOCOL=udp'
      - 'CK_CLIENT_LISTEN_ADDRESS=cloak-client-wireguard'
      - 'CK_CLIENT_LISTEN_PORT=138'
      - 'CK_SERVER_ADDRESS=your.cloak.server'
      - 'CK_SERVER_PORT=443'
    volumes:
      - /etc/localtime:/etc/localtime
      - /opt/cloak-client-wireguard:/etc/cloak
    networks:
      - cloak
networks:
  cloak:
    driver: 'bridge'

⁠Important notes:

Port number in the CK_SERVER_PORT should be the same for Cloak server and Cloak client!

⁠Cloak client environment variables

Then run docker container as usually:

sudo docker compose up -d -f /path/to/your/docker-compose.yml

See the log of docker container with command:

sudo docker logs -f cloak-client-openvpn

or

sudo docker logs -f cloak-client-wireguard

After Cloak session established you can configure your OpenVPN and/or Wireguard client(s) connect to 443/tcp or 138/udp ports of your Cloak client host. Your OpenVPN/Wireguard traffic will be catched and encapsulated by Cloak client into the classic HTTPS stream which will be decapsulated and routed by Cloak server to the appropriate VPN server further.