@startuml
skinparam shadowing false
title After: everything goes through the front

actor Player as player
node "Master\netmaster.net:27950" as master
actor "Admin tool\n(tunnel side)" as admin

node "Front (public IP)" {
  component "etrelay\n0.0.0.0:27960" as relay
  component "control API\n<front-wg>:8090" as control
}

node "Home" {
  component "ET server\n<et-server>:27960\n(own WireGuard peer)" as et
}

player <--> relay : game traffic
master <--> relay : heartbeat / getChallenge / getInfo
relay <--> et : WireGuard (wg0), direct:\none source port per client
admin --> control : WireGuard: sessions, bans\n(bearer token)
@enduml