Security · checked 2026-10-20

Can I vibecode Surfshark?

NOT REALLY· don't bother

The tunnel itself is an hour's work: WireGuard on a rented server, a script that creates peers, and the official WireGuard apps on each device, with an ad-blocking DNS resolver as a bonus. What Surfshark rents out is the pool, with 4,500+ servers in 100 countries whose addresses are shared by many customers, plus a no-logs promise you take on trust or from audit reports. A server of your own has one fixed datacenter address tied to your hosting account, often blocked by streaming sites. It covers safe café Wi-Fi and a stable IP, not choosing a country or blending into a crowd.

$16.45/moprice

$197it costs you a year

one sittingbuild time

—people replaced it

Before you start

What you need on hand.

DifficultyIntermediate · Some system setup or keys.

TimeAbout an hour for the first server; most of it is the hosting account

Claude Code, Codex or CursorAny of them can run the prompt.
Node.js 22
A VPS you can SSH intoAny provider with a Debian 12 or Ubuntu 24.04 image; one per country you want.
The WireGuard app on each deviceOfficial and free for phones and laptops.

Before you buildSurfshark has no free plan, and its low monthly prices are first-term rates. Compare the renewal price (about $6.58 a month for Starter after the first term) with a small server before you decide.

1. Install one agent: Claude Code, Codex, Cursor.
2. Make an empty folder and open it in the agent.
3. Paste the prompt below, press enter, and answer its questions as it builds.

The prompt

Build me a personal multi-server WireGuard setup with ad-blocking DNS to replace Surfshark's VPN. Requirements:

- Node.js 22 + TypeScript CLI called `tunnel` (`commander`, `ssh2`, `qrcode`), installed with
  `npm link`. Servers are listed in tunnel.yaml (name, SSH host, user, key path, public IP); any
  Debian 12 or Ubuntu 24.04 VPS I can reach over SSH works, with no cloud API involved.
- `tunnel server add <name>` installs wireguard and unbound over SSH, turns on IPv4 and IPv6
  forwarding, opens only UDP 51820 and SSH in nftables, and enables unattended upgrades. Running
  it twice must change nothing.
- DNS: unbound answers tunnel clients only and forwards over TLS to the resolver named in
  tunnel.yaml. It loads a blocklist built from StevenBlack/hosts into a local-zone file that a
  systemd timer refreshes weekly. `tunnel dns allow <domain>` exempts a site.
- `tunnel peer add <name> --server <server>` makes keys locally with `wg genkey`, registers the
  peer with `wg set` (no restart), writes ./data/peers/<name>-<server>.conf routing 0.0.0.0/0 and
  ::/0 with the server as DNS, and prints a QR code for the official WireGuard app.
- Storage: ./data/state.json with servers, peers and tunnel addresses; private keys stay in ./data
  with mode 600 and appear only inside that peer's config.
- `tunnel check <server>` runs with the tunnel up and verifies the public IPv4 and IPv6 from
  IP_ECHO_URL (tunnel.yaml) equal the server's, DNS resolves over the tunnel, and a domain from the
  blocklist returns 0.0.0.0. Exit 1 on any miss. `tunnel status` shows handshake age and traffic.
- No accounts, no telemetry, local-first: outbound calls are SSH, the blocklist download and the
  one echo request, all named in the README.
- Out of scope: client apps (use the official WireGuard apps), multi-hop, obfuscation, streaming
  unblocking, a dashboard.
- README: monthly cost per server and three plain warnings: sites see a datacenter address tied to
  my hosting account; streaming services often block those ranges; the host can see traffic
  metadata, so this swaps trust in Surfshark for trust in the host.

Opens your agent with the prompt filled in, you press enter. Or copy it and paste it into an empty folder.

Share on X

Max MiskowSponsoredAI agents, automations and MVPs, built for your company.Visit site ›

Then keep going

Next prompts, same folder.

The first prompt builds the core. Run these one at a time in the same folder to grow it into your own Surfshark.

Add per-peer routing profiles to the WireGuard setup in this folder. Requirements:

- A peer can have a profile in tunnel.yaml: full (all traffic), split (only the listed CIDRs and domains go through the tunnel) or dns-only (only DNS goes through the server).
- Regenerate that peer's config for the profile and rewrite its AllowedIPs; for domains in a split profile, resolve them at generation time and print a warning that addresses change.
- `tunnel peer profile <name> <profile>` updates the server's allowed IPs with `wg set` without a restart.
- Add a test that the generated AllowedIPs match each profile.
- Update the README.

Add a health report to the WireGuard setup in this folder. Requirements:

- `tunnel report` connects to every server over SSH and records disk use, uptime, `wg show` handshake ages, pending security updates and the blocklist's age.
- Write ./data/report-YYYY-MM-DD.md with a table and a line per problem.
- Exit 1 when a server is unreachable or a handshake is older than 7 days for a peer marked active.
- Print a ready-made cron line that runs it weekly and mails the report with the system mail command.
- Update the README.

Add key rotation to the WireGuard setup in this folder. Requirements:

- `tunnel peer rotate <name>` makes a new key pair, registers it on the server, writes the new config and QR code, and removes the old public key after I confirm the new tunnel connects.
- Keep the previous config in ./data/peers/old/ for 7 days so a half-finished switch can be undone.
- `tunnel peer ls` shows the age of each key and flags any older than 180 days.
- Add a test with a mocked SSH layer for the order of the steps.
- Update the README.

What you lose

Servers in 100 countries; your own setup has one location per VPS you rent
Shared addresses that many customers use, so a site can't tie the IP to you
Access to streaming libraries that block datacenter address ranges
Polished apps with a kill switch and one-tap server switching on every platform
The extras on higher plans: antivirus, breach alerts and, on One+, Incogni

Why people still pay

People rent a VPN to look like someone else, not only to encrypt: an address in another country is what opens a foreign catalogue, a local price or a blocked site. The apps work on any device with one tap, and the intro price is lower than a server plus the evenings spent when it breaks. A self-hosted tunnel only moves your trust from Surfshark to your hosting company.

Moatinfrastructure scale brand & trust execution polish

Do the math

Surfshark or your own copy?

Over

Your usage

Count my time3h ×$/h

Surfshark, 1 yr$197

Your own copy, 1 yr$101running + build session

You keep$96pays for itself in the first month

Estimate · A one-core VPS at a budget host costs a few dollars a month and includes plenty of traffic; each extra country is another server at the same price. The build is token usage on your agent plan.

Leaving Surfshark

Take your data, then cancel.

1 · Take your data out of Surfshark

1There is no data to export: Surfshark says it keeps no records of your online activity.
2Note the account email and the devices you use, and save any custom settings, such as whitelisted apps or sites, by screenshot.
3Install the replacement (a self-hosted WireGuard or another provider) and test it before you cancel.

2 · Cancel Surfshark

1Log in on Surfshark's site, click your account at the top right and open the Subscription tab, which shows the cancellation steps.
2Or open live chat from the support page and say you want to cancel; you are given a cancellation link.
3Cancelling keeps the plan until the end of the period you paid for.
4If you subscribed through Google Play, the App Store or Amazon, cancel there instead: Surfshark can't do it for you.

Refunds are requested separately from cancelling. The 30-day money-back guarantee runs from the first purchase; third-party guides say renewals are not refundable.
Turn auto-renewal off right after you buy a multi-year deal if you only want one term; the renewal price is higher than the sale price.
On One+, Incogni comes with the plan and its dashboard goes when the plan does, so note what it shows first.
Remove the Surfshark app and its saved connections from every device after the plan ends.

Checked 2026-10-20 against Surfshark's docs: 1, 2, 3, 4, 5

The escape hatch

Don't feel like building it? These are already free.

wg-easyOpen sourceAGPL-3.0 Docker image that runs WireGuard with a web page for adding peers and scanning their QR codes.★ 27k · active Oct 2026 · docker to self-host
WebVisit ↗Algo VPNOpen sourceAGPL-3.0 Ansible scripts that set up a personal WireGuard and IPsec VPN on a cloud server and produce client configs; built for privacy, not for streaming or evading censorship.★ 30k · active Oct 2026 · self-host, real ops
WebVisit ↗PiVPNOpen sourceMIT installer that turns a Raspberry Pi or other Debian box into a WireGuard or OpenVPN server with a command to add clients.★ 8.1k · active Aug 2026 · self-host, real ops
WebVisit ↗

All 4 free alternatives to Surfshark ›

The numbers

Surfshark pricing

Plan	Monthly	Annual, per month	What you get
Starter	$16.45	$3.39	The VPN on unlimited devices plus the Alternative ID tool.
One	$18.95	$3.39	Everything in Starter plus antivirus, Surfshark Search, identity tools and scam, message and call protection.
One+	$21.85	$6.99	Everything in One plus Incogni data removal and identity-theft coverage.

Billing: Monthly, 1-year (billed every 12 months, with 3 extra months) or 2-year (billed once, with 3 extra months, then yearly). 30-day money-back guarantee on all plans. Prices are shown in your local currency; the USD figures come from the plans data the pricing page itself loads.
Hidden costs: The low per-month prices are first-term sale prices. Renewal is $79 a year for Starter, which is about $6.58 a month. The monthly price is about five times the one-year rate per month.
Source: surfshark.com

Also on the list

NordVPN$14.99/mo · SecurityNOT REALLY

Incogni$15.98/mo · SecurityNOT REALLY

1Password$4.99/mo · SecurityKINDA

Questions

Surfshark, briefly

Not answered here? Tell us and we'll add it.

Ask a question ›

Not really. People rent a VPN to look like someone else, not only to encrypt: an address in another country is what opens a foreign catalogue, a local price or a blocked site. The apps work on any device with one tap, and the intro price is lower than a server plus the evenings spent when it breaks. A self-hosted tunnel only moves your trust from Surfshark to your hosting company. The prompt on this page builds the closest honest substitute.

About $16.45 a month on the Starter plan, $197.40 a year (checked 2026-10-20).

Servers in 100 countries; your own setup has one location per VPS you rent; Shared addresses that many customers use, so a site can't tie the IP to you; Access to streaming libraries that block datacenter address ranges; Polished apps with a kill switch and one-tap server switching on every platform; The extras on higher plans: antivirus, breach alerts and, on One+, Incogni. If any of those matter to you, keep paying.