From b12e0fd163136ec5d9816ebf2e92d00f73ae8f9a Mon Sep 17 00:00:00 2001
From: Chris Zerafa <chris@zerafa.com>
Date: Tue, 21 Jul 2026 21:02:54 -0400
Subject: [PATCH] Add VPN documentation and WireGuard templates

---
 .gitignore                             | 11 ++++++++
 vpn/README.md                          | 24 +++++++++++++++++
 vpn/topology.md                        | 37 ++++++++++++++++++++++++++
 vpn/wireguard/edge01/wg0.conf.example  | 25 +++++++++++++++++
 vpn/wireguard/infra01/wg0.conf.example | 23 ++++++++++++++++
 5 files changed, 120 insertions(+)
 create mode 100644 .gitignore
 create mode 100644 vpn/README.md
 create mode 100644 vpn/topology.md
 create mode 100644 vpn/wireguard/edge01/wg0.conf.example
 create mode 100644 vpn/wireguard/infra01/wg0.conf.example

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..fc87922
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,11 @@
+
+# WireGuard secrets
+*.key
+*.psk
+wg0.conf
+privatekey
+presharedkey
+
+# Environment and credential files
+.env
+.env.*
diff --git a/vpn/README.md b/vpn/README.md
new file mode 100644
index 0000000..ca79a3d
--- /dev/null
+++ b/vpn/README.md
@@ -0,0 +1,24 @@
+# VPN Infrastructure
+
+This directory documents the WireGuard tunnel between:
+
+- `edge01` — DreamHost VPS
+- `infra01` — Home network tunnel endpoint
+
+## Goals
+
+- Secure bidirectional connectivity between edge01 and the home network
+- Allow selected services on the home network to be reached through edge01
+- Keep configuration reproducible
+- Never store private keys or pre-shared keys in Git
+
+## Security
+
+The following must never be committed:
+
+- WireGuard private keys
+- Pre-shared keys
+- Complete production configuration files containing secrets
+- Passwords, API tokens, or credentials
+
+Only sanitized configuration templates and public keys may be stored here.
diff --git a/vpn/topology.md b/vpn/topology.md
new file mode 100644
index 0000000..73694aa
--- /dev/null
+++ b/vpn/topology.md
@@ -0,0 +1,37 @@
+# VPN Topology
+
+## Systems
+
+### edge01
+
+- Provider: DreamHost
+- Role: Public VPS and WireGuard server
+- Public address: 208.113.210.193
+- WireGuard interface: wg0
+
+### infra01
+
+- Role: Home network WireGuard endpoint
+- LAN address: 192.168.161.10
+- Home gateway: 192.168.161.1
+- WireGuard interface: wg0
+
+## Traffic Flow
+
+Internet client
+    |
+    v
+edge01
+    |
+    | WireGuard tunnel
+    v
+infra01
+    |
+    v
+Home networks and selected internal services
+
+## Design Notes
+
+- infra01 initiates the tunnel because the home Internet connection does not require a static public IP.
+- edge01 provides the stable public endpoint.
+- Routing and firewall rules should expose only explicitly approved internal services.
diff --git a/vpn/wireguard/edge01/wg0.conf.example b/vpn/wireguard/edge01/wg0.conf.example
new file mode 100644
index 0000000..dc4e0c9
--- /dev/null
+++ b/vpn/wireguard/edge01/wg0.conf.example
@@ -0,0 +1,25 @@
+# Edge01 WireGuard Configuration (Template)
+#
+# Copy to:
+#   /etc/wireguard/wg0.conf
+#
+# Replace all placeholder values before use.
+
+[Interface]
+Address = 10.100.0.1/24
+ListenPort = 51820
+
+PrivateKey = <EDGE01_PRIVATE_KEY>
+
+# Optional:
+# MTU = 1420
+
+[Peer]
+# infra01
+
+PublicKey = <INFRA01_PUBLIC_KEY>
+PresharedKey = <PRESHARED_KEY>
+
+AllowedIPs = 10.100.0.2/32,192.168.161.0/24
+
+PersistentKeepalive = 25
diff --git a/vpn/wireguard/infra01/wg0.conf.example b/vpn/wireguard/infra01/wg0.conf.example
new file mode 100644
index 0000000..076aacf
--- /dev/null
+++ b/vpn/wireguard/infra01/wg0.conf.example
@@ -0,0 +1,23 @@
+# infra01 WireGuard Configuration (Template)
+#
+# Copy to:
+#   /etc/wireguard/wg0.conf
+#
+# Replace all placeholder values before use.
+
+[Interface]
+Address = 10.100.0.2/24
+
+PrivateKey = <INFRA01_PRIVATE_KEY>
+
+[Peer]
+# edge01
+
+PublicKey = <EDGE01_PUBLIC_KEY>
+PresharedKey = <PRESHARED_KEY>
+
+Endpoint = edge01.zerafa.com:51820
+
+AllowedIPs = 10.100.0.1/32
+
+PersistentKeepalive = 25