---
# ===========================================================================
# Site A. Everything that differs between sites lives in this file.
#
#   ansible-playbook wg-relay.yml -e @vars/site-a.yml
#
# Site B's file is the mirror image: swap the two tunnel addresses, point
# the targets at its own service, and list Site A as the peer.
# ===========================================================================

# --- which box to configure ------------------------------------------------
# Set to the relay VM's address to configure it over SSH, or leave as
# localhost to configure the machine you're running this on.
relay_host: 192.168.1.10
relay_user: admin

# --- this side of the tunnel -----------------------------------------------
wg_address: 10.99.0.1/32
wg_listen_port: 51820

# --- the other side --------------------------------------------------------
wg_peers:
  - name: site-b
    public_key: "PASTE_SITE_B_PUBLIC_KEY_HERE"
    # Omit endpoint on whichever side isn't reachable from outside; the
    # other side dials in and keepalives hold the path open.
    endpoint: site-b.example.com:51820
    allowed_ips: 10.99.0.2/32
    keepalive: 25

# --- what is reachable, in each direction ----------------------------------
relays:
  # Site B reaching the service on Site A's LAN.
  - name: in-site-b
    direction: inbound
    listen_address: 10.99.0.1        # this box's tunnel address
    listen_port: 9000
    target: 192.168.1.50:9000        # the one host:port Site B may reach
    source_allow: 10.99.0.2/32       # Site B's tunnel address only

  # Site A reaching the service on Site B's LAN. Local clients point at
  # this box's LAN address and never need to know a tunnel exists.
  - name: out-site-b
    direction: outbound
    listen_address: 192.168.1.10     # this box's LAN address
    listen_port: 9001
    target: 10.99.0.2:9000           # Site B's inbound relay
    source_allow: 192.168.1.50/32    # the one local client allowed to use it