---
# ===========================================================================
# Site B — the mirror image of vars/site-a.yml. Run this at Site B only:
#
#   ansible-playbook wg-relay.yml -e @vars/site-b.yml
#
# Note the LAN addresses here are Site B's own; they have no relationship to
# the ones in site-a.yml and the two sites may well use the same subnet.
# Only the 10.99.0.x tunnel addresses have to agree between the files.
# ===========================================================================

# --- which box to configure ------------------------------------------------
relay_host: localhost
#

# --- this side of the tunnel -----------------------------------------------
wg_address: 10.99.0.2/32
wg_listen_port: 51820

# --- the other side --------------------------------------------------------
wg_peers:
  - name: site-a
    public_key: "PASTE_SITE_A_PUBLIC_KEY_HERE"
    endpoint: site-a.example.com:51820
    allowed_ips: 10.99.0.1/32
    keepalive: 25

# --- what is reachable, in each direction ----------------------------------
relays:
  # Site A reaching the service on Site B's LAN.
  - name: in-site-a
    direction: inbound
    listen_address: 10.99.0.2        # this box's tunnel address
    listen_port: 9000
    target: 10.0.0.50:9000           # the one host:port Site A may reach
    source_allow: 10.99.0.1/32       # Site A's tunnel address only

  # Site B reaching the service on Site A's LAN.
  - name: out-site-a
    direction: outbound
    listen_address: 10.0.0.10        # this box's LAN address
    listen_port: 9001
    target: 10.99.0.1:9000           # Site A's inbound relay
    source_allow: 10.0.0.50/32       # the one local client allowed to use it