TOKEN="your_auth_token_here"
API="https://config.doxx.net/v1/"

# Step 1: List available servers
curl -s -X POST $API -d "servers=1" | jq '.servers[] | {server_name, location, description}'

# Step 2: Create a tunnel
curl -s -X POST $API -d "create_tunnel=1&token=$TOKEN&name=My+Laptop&server=wireguard.mia.us.doxx.net" | jq .

# Step 3: List your tunnels (get tunnel_token)
curl -s -X POST $API -d "list_tunnels=1&token=$TOKEN" | jq '.tunnels[] | {tunnel_token, name, assigned_ip, server}'

# Step 4: Get WireGuard config
curl -s -X POST $API -d "wireguard=1&token=$TOKEN&tunnel_token=TUNNEL_TOKEN_HERE" | jq .config

# Step 1: Register domain
curl -s -X POST $API -d "create_domain=1&token=$TOKEN&domain=mysite.doxx" | jq .

# Step 2: Add an A record
curl -s -X POST $API -d "create_dns_record=1&token=$TOKEN&domain=mysite.doxx&name=mysite.doxx&type=A&content=1.2.3.4&ttl=300" | jq .

# Step 3: Add a wildcard
curl -s -X POST $API -d "create_dns_record=1&token=$TOKEN&domain=mysite.doxx&name=*.mysite.doxx&type=A&content=1.2.3.4&ttl=300" | jq .

# Step 4: Sign a TLS certificate
openssl ecparam -genkey -name prime256v1 -out mysite.key
openssl req -new -key mysite.key -out mysite.csr -subj "/CN=mysite.doxx"
curl -s -X POST $API -d "sign_certificate=1&token=$TOKEN&domain=mysite.doxx" --data-urlencode "csr=$(cat mysite.csr)" -o mysite.crt

# Step 5: Verify DNS is live
dig A mysite.doxx @a.root-dx.net +short

# Step 1: See available blocklists
curl -s -X POST $API -d "dns_get_options=1" | jq '.options[] | {name, display_name, category, domain_count}'

# Step 2: Enable a blocklist on your tunnel
curl -s -X POST $API -d "dns_set_subscription=1&token=$TOKEN&tunnel_token=TUNNEL_TOKEN&subscription=ads&enabled=1" | jq .

# Step 3: Check tunnel DNS config
curl -s -X POST $API -d "dns_get_tunnel_config=1&token=$TOKEN&tunnel_token=TUNNEL_TOKEN" | jq .

# Step 4: Add a custom whitelist entry
curl -s -X POST $API -d "dns_add_whitelist=1&token=$TOKEN&tunnel_token=TUNNEL_TOKEN&domain=example.com" | jq .

# Real-time events via WebSocket
websocat "wss://secure-wss.doxx.net/ws?token=$TOKEN"

# Historical bandwidth (last hour)
curl -s "https://secure-wss.doxx.net/api/stats/bandwidth?token=$TOKEN&start=$(date -u -v-1H +%Y-%m-%dT%H:%M:%SZ)&end=$(date -u +%Y-%m-%dT%H:%M:%SZ)" | jq .

# Security alerts (last 24h)
curl -s "https://secure-wss.doxx.net/api/stats/alerts?token=$TOKEN&last=1d" | jq '.totals'

TOKEN="your_auth_token_here"
API="https://config.doxx.net/v1/"

# Step 1: Create a tunnel on a server near you
curl -s -X POST $API -d "servers=1" | jq '.servers[] | {server_name, location}'
curl -s -X POST $API -d "create_tunnel=1&token=$TOKEN&name=My+Server&server=wireguard.mia.us.doxx.net"

# Step 2: Get tunnel_token from list
TUNNEL=$(curl -s -X POST $API -d "list_tunnels=1&token=$TOKEN" | jq -r '.tunnels[-1].tunnel_token')

# Step 3: Get WireGuard config
CONFIG=$(curl -s -X POST $API -d "wireguard=1&token=$TOKEN&tunnel_token=$TUNNEL")

# Step 4: Build the .conf file
PRIVATE_KEY=$(echo $CONFIG | jq -r '.config.interface.private_key')
ADDRESS=$(echo $CONFIG | jq -r '.config.interface.address')
DNS=$(echo $CONFIG | jq -r '.config.interface.dns')
PEER_KEY=$(echo $CONFIG | jq -r '.config.peer.public_key')
ENDPOINT=$(echo $CONFIG | jq -r '.config.peer.endpoint')
ALLOWED_IPS=$(echo $CONFIG | jq -r '.config.peer.allowed_ips')

cat > /etc/wireguard/doxx.conf << EOF
[Interface]
PrivateKey = $PRIVATE_KEY
Address = $ADDRESS
DNS = $DNS

[Peer]
PublicKey = $PEER_KEY
AllowedIPs = $ALLOWED_IPS
Endpoint = $ENDPOINT
PersistentKeepalive = 25
EOF

# Step 5: Connect
sudo wg-quick up doxx

# Step 6: Verify - you should now resolve .doxx domains
dig A doxx.net @10.10.10.10 +short

TOKEN="your_auth_token_here"
API="https://config.doxx.net/v1/"

# Option A: Link ALL tunnels (easiest)
# Every tunnel can reach every other tunnel on your account
curl -s -X POST $API -d "firewall_link_all_toggle=1&token=$TOKEN&enabled=1" | jq .

# Check status
curl -s -X POST $API -d "firewall_link_all_status=1&token=$TOKEN" | jq .

# Option B: Link specific tunnels (1:1 rules)
# Get your tunnel IPs
curl -s -X POST $API -d "list_tunnels=1&token=$TOKEN" | jq '.tunnels[] | {name, tunnel_token, assigned_ip, assigned_v6}'

# Allow Laptop (10.1.0.227) to reach Server (10.1.2.101) on all ports
curl -s -X POST $API -d "firewall_rule_add=1&token=$TOKEN&tunnel_token=SERVER_TUNNEL_TOKEN&protocol=ALL&src_ip=10.1.0.227/32&src_port=ALL&dst_ip=10.1.2.101&dst_port=ALL" | jq .

# Allow Server to reach Laptop (bidirectional)
curl -s -X POST $API -d "firewall_rule_add=1&token=$TOKEN&tunnel_token=LAPTOP_TUNNEL_TOKEN&protocol=ALL&src_ip=10.1.2.101/32&src_port=ALL&dst_ip=10.1.0.227&dst_port=ALL" | jq .

# Now you can SSH from laptop to server via their doxx.net tunnel IPs:
# ssh user@10.1.2.101

TOKEN="your_auth_token_here"
API="https://config.doxx.net/v1/"
DOMAIN="myapp.crypto"

# Step 1: Register the domain
curl -s -X POST $API -d "create_domain=1&token=$TOKEN&domain=$DOMAIN" | jq .

# Step 2: Point it to your server
curl -s -X POST $API -d "create_dns_record=1&token=$TOKEN&domain=$DOMAIN&name=$DOMAIN&type=A&content=YOUR_SERVER_IP&ttl=300" | jq .
curl -s -X POST $API -d "create_dns_record=1&token=$TOKEN&domain=$DOMAIN&name=*.$DOMAIN&type=A&content=YOUR_SERVER_IP&ttl=300" | jq .

# Step 3: Generate key + CSR
openssl ecparam -genkey -name prime256v1 -out $DOMAIN.key 2>/dev/null
openssl req -new -key $DOMAIN.key -out $DOMAIN.csr -subj "/CN=$DOMAIN" 2>/dev/null

# Step 4: Sign the certificate (auto-wildcarded to *.domain + domain)
curl -s -X POST $API \
  -d "sign_certificate=1&token=$TOKEN&domain=$DOMAIN" \
  --data-urlencode "csr=$(cat $DOMAIN.csr)" \
  -o $DOMAIN.crt

# Step 5: Download the root CA (clients need to trust this)
curl -s -o doxx-root-ca.crt https://raw.githubusercontent.com/doxxcorp/style/main/logo-png/isotype-black/isotype-black-64.png
# Actually get the CA from your portal or the a0x13 assets:
# https://a0x13.doxx.net/assets/doxx-root-ca.crt

# Step 6: Install in nginx/caddy/etc
# nginx example:
#   ssl_certificate     /path/to/myapp.crypto.crt;
#   ssl_certificate_key /path/to/myapp.crypto.key;

# Step 7: Verify
openssl x509 -in $DOMAIN.crt -noout -subject -ext subjectAltName
# Subject: CN=myapp.crypto
# SAN: DNS:*.myapp.crypto, DNS:myapp.crypto

dig A $DOMAIN @a.root-dx.net +short
# YOUR_SERVER_IP

curl -o doxx-root-ca.crt https://a0x13.doxx.net/assets/doxx-root-ca.crt

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain doxx-root-ca.crt

sudo cp doxx-root-ca.crt /usr/local/share/ca-certificates/doxx-root-ca.crt
sudo update-ca-certificates

# Resolve a .doxx domain from anywhere on the internet (no VPN needed)
dig A mysite.doxx @207.207.200.200 +short

# Or use DoH
curl -s -H "accept: application/dns-json" "https://doxx.net/dns-query?name=mysite.doxx&type=A"

# Method 1: Direct DNS query
dig A mysite.doxx @207.207.200.200 +short

# Method 2: Configure your system resolver
# Add to /etc/resolv.conf (Linux) or System Preferences > Network > DNS (macOS):
# nameserver 207.207.200.200
# nameserver 207.207.201.201

# Method 3: Use Secure DNS (DoH) with your personalized blocking
# First create a Secure DNS hash via the API:
curl -s -X POST https://config.doxx.net/v1/ \
  -d "public_dns_create_hash=1&token=$TOKEN&tunnel_token=$TUNNEL" | jq .
# Returns: {"host_hash": "gl6nqcbyhsau", "doh_url": "https://gl6nqcbyhsau.sdns.doxx.net/dns-query"}

# Then configure your browser/OS to use that DoH URL
# This gives you your VPN's DNS blocking settings without being on the VPN

# Method 4: In your application code
# Just point DNS queries to 207.207.200.200 for any .doxx domain resolution

# Check if your domain is live on doxx.net authoritative DNS
dig A mysite.doxx @a.root-dx.net +short
dig A mysite.doxx @a.root-dx.com +short
dig A mysite.doxx @a.root-dx.org +short

# Check via public recursive DNS
dig A mysite.doxx @207.207.200.200 +short

# Check via VPN DNS (must be connected)
dig A mysite.doxx @10.10.10.10 +short

# Check SOA (zone exists?)
dig SOA mysite.doxx @a.root-dx.net +short

# Check all records
dig ANY mysite.doxx @a.root-dx.net

# Create a Secure DNS hash
curl -s -X POST $API -d "public_dns_create_hash=1&token=$TOKEN&tunnel_token=$TUNNEL" | jq .

curl -s -X POST $API -d "auth=1&token=$TOKEN"

curl -s -X POST $API -d "tos_status=1&token=$TOKEN"

curl -s -X POST $API -d "accept_tos=1&token=$TOKEN"

curl -s -X POST $API -d "get_profile=1&token=$TOKEN"

curl -s -X POST $API -d "create_account_recovery=1&token=$TOKEN"

curl -s -X POST $API -d "delete_account=1&token=$TOKEN"

curl -s -X POST $API -d "servers=1"

curl -s -X POST $API -d "list_tunnels=1&token=$TOKEN"

curl -s -X POST $API \
  -d "sign_certificate=1&token=$TOKEN&domain=mysite.doxx" \
  --data-urlencode "csr=$(cat mysite.csr)" -o mysite.crt

curl -s -X POST $API -d "generate_qr=1&data=hello&size=256" -o qr.png