37 lines
1.5 KiB
Plaintext
37 lines
1.5 KiB
Plaintext
# /etc/wireguard/wg0.conf — RackNerd hub end of the three-way mesh.
|
|
# host/setup.sh installs this with a freshly generated private key; you
|
|
# paste in each site's public key afterwards.
|
|
|
|
[Interface]
|
|
# .255 = site transfer net, .9 = roaming WG peers (travel routers)
|
|
Address = 172.31.255.1/24, 172.31.9.1/24
|
|
ListenPort = 51820
|
|
PrivateKey = <RACKNERD_WG_PRIVATE_KEY>
|
|
# wg-quick auto-adds routes for each peer's AllowedIPs — that is exactly
|
|
# the routing we want, so no PostUp needed. No MASQUERADE: client traffic
|
|
# is routed, DCs see real 172.31.8.x source IPs.
|
|
|
|
# ── Trochalakis (AHDC01 / AHDC03 behind this peer) ──
|
|
[Peer]
|
|
PublicKey = <TROCHALAKIS_WG_PUBLIC_KEY>
|
|
AllowedIPs = 172.31.255.2/32, 192.168.20.0/24
|
|
# No Endpoint: the site initiates to our static IP and holds the tunnel
|
|
# open with PersistentKeepalive = 25 on its side (see docs/SITE-SIDE.md).
|
|
|
|
# ── Oswald (AH-OSWLDC behind this peer) ──
|
|
[Peer]
|
|
PublicKey = <OSWALD_WG_PUBLIC_KEY>
|
|
AllowedIPs = 172.31.255.3/32, 192.168.7.0/24
|
|
|
|
# Deliberately NOT listing the other site's LAN under either peer:
|
|
# Oswald<->Trochalakis traffic must stay on their direct tunnel, never
|
|
# hairpin through this box.
|
|
|
|
# ── Travel routers (roaming /32 peers from 172.31.9.0/24) ──
|
|
# The Ansible deploy appends these from the wg_travel_peers list in
|
|
# group_vars. For manual setups, copy this block per router:
|
|
#[Peer] # glinet-1
|
|
#PublicKey = <ROUTER_WG_PUBLIC_KEY>
|
|
#AllowedIPs = 172.31.9.11/32
|
|
# (no Endpoint — routers initiate and keep alive from behind NAT)
|