claude generated first pass

host/wg0.conf.example

@@ -0,0 +1,27 @@
+# /etc/wireguard/wg0.conf — RackNerd hub end of the three-way mesh.
+# host/setup.sh installs this with a freshly generated private key; you
+# paste in each site's public key afterwards.
+
+[Interface]
+Address = 172.31.255.1/24
+ListenPort = 51820
+PrivateKey = <RACKNERD_WG_PRIVATE_KEY>
+# wg-quick auto-adds routes for each peer's AllowedIPs — that is exactly
+# the routing we want, so no PostUp needed. No MASQUERADE: client traffic
+# is routed, DCs see real 172.31.8.x source IPs.
+
+# ── Trochalakis (AHDC01 / AHDC03 behind this peer) ──
+[Peer]
+PublicKey = <TROCHALAKIS_WG_PUBLIC_KEY>
+AllowedIPs = 172.31.255.2/32, 192.168.20.0/24
+# No Endpoint: the site initiates to our static IP and holds the tunnel
+# open with PersistentKeepalive = 25 on its side (see docs/SITE-SIDE.md).
+
+# ── Oswald (AH-OSWLDC behind this peer) ──
+[Peer]
+PublicKey = <OSWALD_WG_PUBLIC_KEY>
+AllowedIPs = 172.31.255.3/32, 192.168.7.0/24
+
+# Deliberately NOT listing the other site's LAN under either peer:
+# Oswald<->Trochalakis traffic must stay on their direct tunnel, never
+# hairpin through this box.