rego-tunnel: replace build folder with vpn_scripts

- Remove build folder (no longer building custom image)
- Add vpn_scripts folder with organized setup scripts
- Prefix setup scripts with numbers for execution order
- Add setup-all.bat for automated Windows setup
- Add dynamic vpn-startup.lnk shortcut (uses %USERNAME%)
- Include start.sh for container networking

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/rego-tunnel/vpn_scripts/start.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+# Startup hook - runs after container starts
+# Dynamically detects Windows VM IP and sets up networking
+
+get_windows_ip() {
+  # Method 1: DHCP leases (hostname is "Windows")
+  local ip=$(awk '/Windows/ {print $3}' /var/lib/misc/dnsmasq.leases 2>/dev/null | head -1)
+  if [[ -n "$ip" ]]; then echo "$ip"; return; fi
+
+  # Method 2: ip neigh (ARP table) - look for 172.30.x.x on docker interface
+  ip=$(ip neigh show dev docker 2>/dev/null | grep -oE '172\.30\.[0-9]+\.[0-9]+' | head -1)
+  if [[ -n "$ip" ]]; then echo "$ip"; return; fi
+
+  # Method 3: qemu.ip file (if available)
+  cat /run/shm/qemu.ip 2>/dev/null || true
+}
+
+get_container_ip() {
+  # Get container's external IP (tipi_main_network - eth1)
+  ip -4 addr show eth1 2>/dev/null | awk '/inet / {print $2}' | cut -d/ -f1
+}
+
+(
+  # Wait for Windows VM to boot and get IP
+  echo "[rego-tunnel] Waiting for Windows VM..."
+  WINDOWS_IP=""
+  for i in {1..120}; do
+    WINDOWS_IP=$(get_windows_ip)
+    if [[ -n "$WINDOWS_IP" ]]; then
+      echo "[rego-tunnel] Windows VM IP: $WINDOWS_IP"
+      break
+    fi
+    sleep 2
+  done
+
+  if [[ -z "$WINDOWS_IP" ]]; then
+    echo "[rego-tunnel] ERROR: Could not detect Windows VM IP"
+    exit 1
+  fi
+
+  # Wait for SSH to be available on Windows
+  echo "[rego-tunnel] Waiting for SSH on Windows..."
+  for i in {1..60}; do
+    if nc -z "$WINDOWS_IP" 22 2>/dev/null; then
+      echo "[rego-tunnel] SSH is available"
+      break
+    fi
+    sleep 2
+  done
+
+  CONTAINER_IP=$(get_container_ip)
+  echo "[rego-tunnel] Container IP: $CONTAINER_IP"
+
+  # Add MASQUERADE for docker bridge
+  iptables -t nat -C POSTROUTING -o docker -j MASQUERADE 2>/dev/null || \
+  iptables -t nat -A POSTROUTING -o docker -j MASQUERADE
+
+  # Allow forwarding to Windows VM
+  iptables -C FORWARD -d "$WINDOWS_IP" -j ACCEPT 2>/dev/null || \
+  iptables -A FORWARD -d "$WINDOWS_IP" -j ACCEPT
+
+  # Start socat to forward SOCKS5 proxy from Windows VM
+  pkill -f "socat.*1080" 2>/dev/null || true
+  socat TCP-LISTEN:1080,fork,reuseaddr TCP:"$WINDOWS_IP":1080 &
+  echo "[rego-tunnel] socat SOCKS5 forwarder started on port 1080"
+
+  # Add DNAT rules for port forwarding
+  add_dnat() {
+    local port=$1
+    iptables -t nat -C PREROUTING -d "$CONTAINER_IP" -p tcp --dport "$port" -j DNAT --to-destination "$WINDOWS_IP:$port" 2>/dev/null || \
+    iptables -t nat -A PREROUTING -d "$CONTAINER_IP" -p tcp --dport "$port" -j DNAT --to-destination "$WINDOWS_IP:$port"
+  }
+
+  # SSH access
+  add_dnat 22
+
+  # IBM i standard ports
+  add_dnat 23
+  add_dnat 446
+  add_dnat 448
+  add_dnat 449
+
+  # IBM i data ports
+  for port in $(seq 8470 8476); do add_dnat $port; done
+
+  # Additional port ranges
+  for port in $(seq 2000 2020); do add_dnat $port; done
+  for port in $(seq 3000 3020); do add_dnat $port; done
+  for port in $(seq 10000 10020); do add_dnat $port; done
+  for port in $(seq 36000 36010); do add_dnat $port; done
+
+  echo "[rego-tunnel] iptables DNAT rules configured"
+  echo "[rego-tunnel] SOCKS5 proxy available at $CONTAINER_IP:1080"
+) &
+
+exit 0