# Site-side configuration (manual steps at Trochalakis and Oswald)

Everything the RackNerd box needs from the two sites, the DCs, and the Duo
admin panel. Nothing here runs on the VPS.

## 1. WireGuard peers (both sites)

Add the RackNerd peer to each site's existing WG config. The sites
**initiate** (RackNerd has the static IP) and keep the tunnel alive:

```ini
# Trochalakis WG box — add:
[Peer]                       # RackNerd hub
PublicKey = <RACKNERD_WG_PUBLIC_KEY>       # printed by host/setup.sh
Endpoint = vpn.atlashorizon.net:51820
# .8 = OpenVPN clients, .9 = travel routers (docs/TRAVEL-ROUTERS.md)
AllowedIPs = 172.31.255.1/32, 172.31.8.0/24, 172.31.9.0/24
PersistentKeepalive = 25
```

Oswald: identical block. Site WG interface addresses on the new mesh links:
Trochalakis `172.31.255.2/32`, Oswald `172.31.255.3/32` (add to the site
[Interface] Address list if the WG box doesn't already carry an address in
this transfer net).

**Do NOT** add the other site's LAN to the RackNerd peer's AllowedIPs —
inter-site traffic stays on your existing direct tunnel. The mesh only adds
`172.31.8.0/24` (roaming clients) and `172.31.255.1` (the hub) via RackNerd.

## 2. Return-path routing (both sites)

Hosts at each site must route the client subnet back via the site WG box.
If the WG box is **not** the LAN default gateway, add static routes on the
LAN router (or directly on the DCs):

| Destination      | Via                    |
|------------------|------------------------|
| `172.31.8.0/24`  | site WireGuard box     |
| `172.31.9.0/24`  | site WireGuard box     |
| `172.31.255.1/32`| site WireGuard box     |

Verify no asymmetry: `tracert 172.31.8.10` from a DC must leave via the
local WG box → RackNerd, never via the other site.

## 3. Windows Firewall / segmentation on the DCs

Allow from **`172.31.8.0/24`** (OpenVPN clients, real source IPs) and
**`172.31.9.0/24`** (travel routers): standard AD client ports — DNS 53,
Kerberos 88/464, LDAP 389/636, SMB 445, RPC 135 + 49152-65535, NTP 123,
GC 3268/3269.

Allow from **`172.31.255.1/32`** (the RackNerd host itself):
- TCP/UDP 53 → AHDC01, AHDC03, AH-OSWLDC (Technitium forwarder queries)
- TCP 636 → AHDC01, AHDC03 (Duo Auth Proxy LDAPS)

## 4. Active Directory

- **Sites and Services**: create subnet `172.31.8.0/24` and assign it to the
  Trochalakis site (clients will then prefer AHDC01/AHDC03 for DC discovery).
- **Duo service account**: plain domain user, read-only, no interactive
  logon rights; goes in `.env` as `DUO_SVC_USER` / `DUO_SVC_PASSWORD`.
- Optional: a `VPN Users` security group if you want `security_group_dn`
  gating in the auth proxy.

## 5. LDAPS certificates

AHDC01 and AHDC03 need valid LDAPS certs (AD CS auto-enrollment or
manually issued). Export the issuing CA chain as PEM →
`duo-authproxy/certs/ad-ldaps-ca.pem` on the VPS
(see that directory's README).

## 6. Duo Admin Panel

Applications → Protect an Application → search **RADIUS** → Protect.
(Not the "OpenVPN" catalog entry — that one is for Duo's server-side
plugin, not the Auth Proxy `radius_server_auto` flow we use.) Copy the
integration key, secret key, and API hostname into `.env` /
`group_vars/vpnhub.yml`. Set username normalization to **Simple** so
`user`, `DOMAIN\user`, and `user@domain` all map to one Duo user.
Recommended policy: new-user policy deny (enrolled users only).

## 7. Public DNS

Create `vpn.atlashorizon.net` → RackNerd static IP (public registrar DNS,
not AD). Used by roaming clients and both site WG endpoints.