Add VPN documentation and WireGuard templates

.gitignore

@@ -0,0 +1,11 @@
+
+# WireGuard secrets
+*.key
+*.psk
+wg0.conf
+privatekey
+presharedkey
+
+# Environment and credential files
+.env
+.env.*

vpn/README.md

@@ -0,0 +1,24 @@
+# VPN Infrastructure
+
+This directory documents the WireGuard tunnel between:
+
+- `edge01` — DreamHost VPS
+- `infra01` — Home network tunnel endpoint
+
+## Goals
+
+- Secure bidirectional connectivity between edge01 and the home network
+- Allow selected services on the home network to be reached through edge01
+- Keep configuration reproducible
+- Never store private keys or pre-shared keys in Git
+
+## Security
+
+The following must never be committed:
+
+- WireGuard private keys
+- Pre-shared keys
+- Complete production configuration files containing secrets
+- Passwords, API tokens, or credentials
+
+Only sanitized configuration templates and public keys may be stored here.

vpn/topology.md

@@ -0,0 +1,37 @@
+# VPN Topology
+
+## Systems
+
+### edge01
+
+- Provider: DreamHost
+- Role: Public VPS and WireGuard server
+- Public address: 208.113.210.193
+- WireGuard interface: wg0
+
+### infra01
+
+- Role: Home network WireGuard endpoint
+- LAN address: 192.168.161.10
+- Home gateway: 192.168.161.1
+- WireGuard interface: wg0
+
+## Traffic Flow
+
+Internet client
+    |
+    v
+edge01
+    |
+    | WireGuard tunnel
+    v
+infra01
+    |
+    v
+Home networks and selected internal services
+
+## Design Notes
+
+- infra01 initiates the tunnel because the home Internet connection does not require a static public IP.
+- edge01 provides the stable public endpoint.
+- Routing and firewall rules should expose only explicitly approved internal services.

vpn/wireguard/edge01/wg0.conf.example

@@ -0,0 +1,25 @@
+# Edge01 WireGuard Configuration (Template)
+#
+# Copy to:
+#   /etc/wireguard/wg0.conf
+#
+# Replace all placeholder values before use.
+
+[Interface]
+Address = 10.100.0.1/24
+ListenPort = 51820
+
+PrivateKey = <EDGE01_PRIVATE_KEY>
+
+# Optional:
+# MTU = 1420
+
+[Peer]
+# infra01
+
+PublicKey = <INFRA01_PUBLIC_KEY>
+PresharedKey = <PRESHARED_KEY>
+
+AllowedIPs = 10.100.0.2/32,192.168.161.0/24
+
+PersistentKeepalive = 25

vpn/wireguard/infra01/wg0.conf.example

@@ -0,0 +1,23 @@
+# infra01 WireGuard Configuration (Template)
+#
+# Copy to:
+#   /etc/wireguard/wg0.conf
+#
+# Replace all placeholder values before use.
+
+[Interface]
+Address = 10.100.0.2/24
+
+PrivateKey = <INFRA01_PRIVATE_KEY>
+
+[Peer]
+# edge01
+
+PublicKey = <EDGE01_PUBLIC_KEY>
+PresharedKey = <PRESHARED_KEY>
+
+Endpoint = edge01.zerafa.com:51820
+
+AllowedIPs = 10.100.0.1/32
+
+PersistentKeepalive = 25