Wings Installation

This addon requires a modified Wings binary (a fork with the /api/proxy/* routes added). Repeat these steps in Wings' source code before compiling, then distribute the resulting binary to each node, or compile it directly on each one.

Step 1: Copy the new files

Important: Wings is a compiled binary, not files Wings reads live. These .go files go into the source folder of your Wings fork (wherever you keep the code you later build with go build), normally on your computer or a build server, not directly on the node running the daemon.

Option A: drag and drop. Open your Wings source code in your file explorer (or VS Code) and drag the proxy folder from wings/new-files/ into your Wings' proxy folder, and the router folder into your router, merging, not replacing (your Wings already has other files in those same folders that need to be kept).

Option B: over terminal:

bash
cp -r wings/new-files/proxy/*   /path/to/wings-source/proxy/
cp -r wings/new-files/router/*  /path/to/wings-source/router/

Files that get copied (4 in total, all of them new files, none overwrite anything that already exists):

  • proxy/manager.go: core logic, writes /etc/nginx/conf.d/pawproxy/<domain>.conf, runs nginx -t and reloads
  • proxy/certbot.go: issuing (certbot certonly --nginx) and revoking Let's Encrypt certificates
  • proxy/validator.go: safe validation of domain names (anti path-traversal / anti-injection in the nginx config)
  • router/router_proxy.go: handlers postProxyDomain, deleteProxyDomain, getProxyDomains, getProxyHealth, postProxyCheckConfig

Step 2: Apply the injected fragment

wings/injected-code/router__router.go goes inside Configure(), in the router's protected group (right after the /api/deauthorize-user line):

go
protected.POST("/api/proxy/domain", postProxyDomain)
protected.DELETE("/api/proxy/domain/:domain", deleteProxyDomain)
protected.GET("/api/proxy/domains", getProxyDomains)
protected.GET("/api/proxy/health", getProxyHealth)
protected.POST("/api/proxy/check-config", postProxyCheckConfig)

These routes use the same auth middleware (the node's bearer token) that the rest of Wings already uses, so there's nothing extra to add for auth.

Step 3: Compile

bash
go build -o wings

Requires Go 1.24.x (toolchain 1.24.1).

Step 4: Prepare nginx on the node

bash
mkdir -p /etc/nginx/conf.d/pawproxy
mkdir -p /etc/nginx/ssl/pawproxy

And make sure nginx.conf (or the http {} block) includes the configs directory:

nginx
include /etc/nginx/conf.d/pawproxy/*.conf;

Step 5: Install certbot (optional, only if you're going to allow Let's Encrypt)

bash
apt install certbot python3-certbot-nginx

Step 6: Restart Wings

bash
systemctl restart wings

Step 7: Verify

bash
curl -H "Authorization: Bearer <node_token>" \
     http://localhost:<daemon_port>/api/proxy/health

Expected response:

json
{"status":"ok","module":"pawproxy"}

If this responds fine but the panel still shows "Could not reach the proxy module" in Admin → Nodes → (node) → Proxy, check that the panel is pointing at the correct daemon URL/port and that no firewall is blocking the panel-to-node connection.

Next: Node configuration →