# /etc/wireguard/wg0.conf — RackNerd hub end of the three-way mesh.
# host/setup.sh installs this with a freshly generated private key; you
# paste in each site's public key afterwards.

[Interface]
Address = 172.31.255.1/24
ListenPort = 51820
PrivateKey = <RACKNERD_WG_PRIVATE_KEY>
# wg-quick auto-adds routes for each peer's AllowedIPs — that is exactly
# the routing we want, so no PostUp needed. No MASQUERADE: client traffic
# is routed, DCs see real 172.31.8.x source IPs.

# ── Trochalakis (AHDC01 / AHDC03 behind this peer) ──
[Peer]
PublicKey = <TROCHALAKIS_WG_PUBLIC_KEY>
AllowedIPs = 172.31.255.2/32, 192.168.20.0/24
# No Endpoint: the site initiates to our static IP and holds the tunnel
# open with PersistentKeepalive = 25 on its side (see docs/SITE-SIDE.md).

# ── Oswald (AH-OSWLDC behind this peer) ──
[Peer]
PublicKey = <OSWALD_WG_PUBLIC_KEY>
AllowedIPs = 172.31.255.3/32, 192.168.7.0/24

# Deliberately NOT listing the other site's LAN under either peer:
# Oswald<->Trochalakis traffic must stay on their direct tunnel, never
# hairpin through this box.