claude generated first pass

host/99-vpnhub-sysctl.conf

@@ -0,0 +1,2 @@
+# RackNerd VPN hub — route between tun0 (OpenVPN clients) and wg0 (sites)
+net.ipv4.ip_forward = 1

host/rules.v4.template

@@ -0,0 +1,54 @@
+# iptables ruleset for the RackNerd VPN hub.
+# ${PUBIF} is substituted by host/setup.sh with the detected public interface.
+# Installed to /etc/iptables/rules.v4 (iptables-persistent).
+#
+# NOTE: after any manual `netfilter-persistent reload`, run
+# `systemctl restart docker` — the reload flushes Docker's chains.
+
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+:DOCKER-USER - [0:0]
+
+# ── INPUT ──────────────────────────────────────────────────────────────
+-A INPUT -i lo -j ACCEPT
+-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+-A INPUT -m conntrack --ctstate INVALID -j DROP
+-A INPUT -p icmp -j ACCEPT
+
+# Public interface: SSH (key-only!), WireGuard, OpenVPN — nothing else.
+-A INPUT -i ${PUBIF} -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
+-A INPUT -i ${PUBIF} -p udp --dport 51820 -j ACCEPT
+-A INPUT -i ${PUBIF} -p udp --dport 1194 -j ACCEPT
+
+# OpenVPN clients: DNS to Unbound only (no SSH, no mgmt from clients)
+-A INPUT -i tun0 -d 172.31.8.1/32 -p udp --dport 53 -j ACCEPT
+-A INPUT -i tun0 -d 172.31.8.1/32 -p tcp --dport 53 -j ACCEPT
+
+# Site tunnels: allow DNS in case site hosts want to use Unbound
+-A INPUT -i wg0 -p udp --dport 53 -j ACCEPT
+-A INPUT -i wg0 -p tcp --dport 53 -j ACCEPT
+
+# ── FORWARD (routed, no NAT — DCs see real client IPs) ────────────────
+-A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+-A FORWARD -m conntrack --ctstate INVALID -j DROP
+
+# Roaming clients -> both sites + WG transfer net
+-A FORWARD -i tun0 -o wg0 -s 172.31.8.0/24 -d 192.168.20.0/24 -j ACCEPT
+-A FORWARD -i tun0 -o wg0 -s 172.31.8.0/24 -d 192.168.7.0/24 -j ACCEPT
+-A FORWARD -i tun0 -o wg0 -s 172.31.8.0/24 -d 172.31.255.0/24 -j ACCEPT
+
+# Site -> client NEW connections (e.g. RDP/RSAT from a DC to a roaming
+# laptop). Off by default; uncomment if you need it.
+#-A FORWARD -i wg0 -o tun0 -d 172.31.8.0/24 -j ACCEPT
+
+COMMIT
+
+# ── Fallback per project brief ─────────────────────────────────────────
+# If site-side return routing for 172.31.8.0/24 becomes a pain, NAT the
+# clients behind the wg0 address instead (DCs then see 172.31.255.1):
+#*nat
+#:POSTROUTING ACCEPT [0:0]
+#-A POSTROUTING -s 172.31.8.0/24 -o wg0 -j MASQUERADE
+#COMMIT

host/setup.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Host-side bootstrap for the RackNerd VPN hub (Ubuntu).
+# Run as root from the repo: sudo host/setup.sh
+# Idempotent: safe to re-run; never overwrites an existing wg0.conf.
+set -euo pipefail
+cd "$(dirname "$0")"
+
+[ "$(id -u)" -eq 0 ] || { echo "Run as root."; exit 1; }
+
+PUBIF=$(ip -4 route show default | awk '{print $5; exit}')
+echo "==> Public interface: ${PUBIF}"
+
+echo "==> Installing wireguard + iptables-persistent"
+apt-get update -qq
+DEBIAN_FRONTEND=noninteractive apt-get install -y wireguard iptables-persistent
+
+echo "==> sysctl (ip_forward)"
+install -m 0644 99-vpnhub-sysctl.conf /etc/sysctl.d/99-vpnhub.conf
+sysctl --system >/dev/null
+
+echo "==> Firewall (WARNING: INPUT policy DROP — port 22 stays open)"
+sed "s/\${PUBIF}/${PUBIF}/g" rules.v4.template > /etc/iptables/rules.v4
+netfilter-persistent reload
+# reload flushed Docker's chains; put them back if Docker is running
+if systemctl is-active --quiet docker; then
+  systemctl restart docker
+fi
+
+echo "==> WireGuard"
+if [ ! -f /etc/wireguard/wg0.conf ]; then
+  umask 077
+  PRIV=$(wg genkey)
+  sed "s|<RACKNERD_WG_PRIVATE_KEY>|${PRIV}|" wg0.conf.example > /etc/wireguard/wg0.conf
+  echo
+  echo "    RackNerd WG public key (add as a peer at BOTH sites):"
+  echo "    $(echo "${PRIV}" | wg pubkey)"
+  echo
+  echo "    >>> Now edit /etc/wireguard/wg0.conf and paste in the"
+  echo "    >>> Trochalakis and Oswald public keys, then:"
+  echo "    >>>   systemctl enable --now wg-quick@wg0"
+else
+  echo "    /etc/wireguard/wg0.conf exists — leaving it alone."
+  systemctl enable --now wg-quick@wg0
+fi
+
+echo "==> Done. Next: cp .env.example .env, fill it in, docker compose up -d --build"

host/wg0.conf.example

@@ -0,0 +1,27 @@
+# /etc/wireguard/wg0.conf — RackNerd hub end of the three-way mesh.
+# host/setup.sh installs this with a freshly generated private key; you
+# paste in each site's public key afterwards.
+
+[Interface]
+Address = 172.31.255.1/24
+ListenPort = 51820
+PrivateKey = <RACKNERD_WG_PRIVATE_KEY>
+# wg-quick auto-adds routes for each peer's AllowedIPs — that is exactly
+# the routing we want, so no PostUp needed. No MASQUERADE: client traffic
+# is routed, DCs see real 172.31.8.x source IPs.
+
+# ── Trochalakis (AHDC01 / AHDC03 behind this peer) ──
+[Peer]
+PublicKey = <TROCHALAKIS_WG_PUBLIC_KEY>
+AllowedIPs = 172.31.255.2/32, 192.168.20.0/24
+# No Endpoint: the site initiates to our static IP and holds the tunnel
+# open with PersistentKeepalive = 25 on its side (see docs/SITE-SIDE.md).
+
+# ── Oswald (AH-OSWLDC behind this peer) ──
+[Peer]
+PublicKey = <OSWALD_WG_PUBLIC_KEY>
+AllowedIPs = 172.31.255.3/32, 192.168.7.0/24
+
+# Deliberately NOT listing the other site's LAN under either peer:
+# Oswald<->Trochalakis traffic must stay on their direct tunnel, never
+# hairpin through this box.