Connecting Indefinitely Free

A. C. Applebee and A. D. Masters

---

The Problem

M4 Mac (macOS Tahoe) + Pop!_OS PC (Linux) need to talk to each other

From home and from anywhere

Behind CGNAT (no public IP, can't port forward)

$0 budget

No middleman if possible

---

The Pieces

1. WireGuard (the tunnel)

NOTE: BUILT. Configs at infrastructure/wireguard/ + Headscale at infra/headscale/. Also integrated into transport priority stack (services/transport/transport.go).

What it does: Encrypted tunnel between your devices. Once connected, they see each other like they're on the same network. SSH, file sharing, everything works through it.

Cost: Free. Built into Linux kernel. Free app on Mac/iOS/Android.

Depends on: Nothing — it's just two devices talking to each other. But they need to FIND each other first (that's the signaling problem below).

---

2. The Signaling Problem (how devices find each other behind CGNAT)

NOTE: SOLVED DIFFERENTLY. FRP (infrastructure/frp/) handles CGNAT bypass. Yggdrasil (infrastructure/ops/config/yggdrasil.conf) provides global IPv6 mesh with automatic LAN discovery. Headscale provides DERP relay (STUN port 3478). The signaling options below are still valid for ADDITIONAL use cases (notifications, canary, Nostr publishing) but NOT needed for basic device connectivity.

Both devices are behind CGNAT. Neither has a public IP. They can't find each other directly. They need a tiny coordination point — something that says "hey, Mac is currently at this address, Linux box is currently at that address." Once they know, WireGuard connects direct.

Options (pick any one):

| Method | How it works | Account needed | Self-hostable | Real-time |
| --- | --- | --- | --- | --- |
| Cloudflare DNS TXT | Update a TXT record