28 lines
1.1 KiB
Plaintext
28 lines
1.1 KiB
Plaintext
# /etc/wireguard/wg0.conf — RackNerd hub end of the three-way mesh.
|
|
# host/setup.sh installs this with a freshly generated private key; you
|
|
# paste in each site's public key afterwards.
|
|
|
|
[Interface]
|
|
Address = 172.31.255.1/24
|
|
ListenPort = 51820
|
|
PrivateKey = <RACKNERD_WG_PRIVATE_KEY>
|
|
# wg-quick auto-adds routes for each peer's AllowedIPs — that is exactly
|
|
# the routing we want, so no PostUp needed. No MASQUERADE: client traffic
|
|
# is routed, DCs see real 172.31.8.x source IPs.
|
|
|
|
# ── Trochalakis (AHDC01 / AHDC03 behind this peer) ──
|
|
[Peer]
|
|
PublicKey = <TROCHALAKIS_WG_PUBLIC_KEY>
|
|
AllowedIPs = 172.31.255.2/32, 192.168.20.0/24
|
|
# No Endpoint: the site initiates to our static IP and holds the tunnel
|
|
# open with PersistentKeepalive = 25 on its side (see docs/SITE-SIDE.md).
|
|
|
|
# ── Oswald (AH-OSWLDC behind this peer) ──
|
|
[Peer]
|
|
PublicKey = <OSWALD_WG_PUBLIC_KEY>
|
|
AllowedIPs = 172.31.255.3/32, 192.168.7.0/24
|
|
|
|
# Deliberately NOT listing the other site's LAN under either peer:
|
|
# Oswald<->Trochalakis traffic must stay on their direct tunnel, never
|
|
# hairpin through this box.
|