halkyon/deploy/host/wg-halkyon.conf

# Home's end of the tunnel through which ramiel publishes halkyon.li (ADR 0039, D8), as
# /etc/wireguard/wg-halkyon.conf on the instance's host at home (root, 0600), brought
# up by wg-quick@wg-halkyon before Docker (wg-quick-before-docker.conf). Its private key
# is a file of its own beside it, never here. Setting it up: host/README.md.

[Interface]
Address = 10.61.97.2/30
PostUp = wg set %i private-key /etc/wireguard/wg-halkyon.key
# From ramiel only Caddy's 443 and sshd's 22, nothing towards it (D9, D17).
PostUp = nft -f /etc/wireguard/wg-halkyon.nft
PreDown = nft delete table inet halkyon_tunnel

# ramiel, dialled by its address: home opens nothing on the FRITZ!Box, and a new home
# address needs no change anywhere. The keepalive keeps the way back open through the
# router's NAT.
[Peer]
PublicKey = <ramiel's public key>
Endpoint = 45.129.181.128:51820
AllowedIPs = 10.61.97.1/32
PersistentKeepalive = 25
feat(deploy): halkyon.li's forward through ramiel and its host at home (ADR 0039) ramiel's HAProxy passes halkyon.li's TLS connections, unopened, through a WireGuard tunnel to the instance at home, with the visitor's address in a PROXY header, and everything else to ramiel's own Caddy, moved to the loopback. Each end's nftables table lets the tunnel carry HAProxy's 443 and the SSH jump's 22 alone, and nothing from home to ramiel. The host at home: sshd with keys alone, the root disk unlocked over SSH at boot (dropbear-initramfs, D20), Docker's and containerd's data bind-mounted from the HDD, and home's end of the tunnel before Docker. An instance behind the forward (compose.forwarded.yaml) publishes 443 on the tunnel's address alone, trusts the PROXY header from ramiel alone, and gets its certificates through TLS-ALPN, without HTTP/3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me> 2026-11-08 19:05:47 +01:00			`# Home's end of the tunnel through which ramiel publishes halkyon.li (ADR 0039, D8), as`
			`# /etc/wireguard/wg-halkyon.conf on the instance's host at home (root, 0600), brought`
			`# up by wg-quick@wg-halkyon before Docker (wg-quick-before-docker.conf). Its private key`
			`# is a file of its own beside it, never here. Setting it up: host/README.md.`

			`[Interface]`
			`Address = 10.61.97.2/30`
			`PostUp = wg set %i private-key /etc/wireguard/wg-halkyon.key`
			`# From ramiel only Caddy's 443 and sshd's 22, nothing towards it (D9, D17).`
			`PostUp = nft -f /etc/wireguard/wg-halkyon.nft`
			`PreDown = nft delete table inet halkyon_tunnel`

			`# ramiel, dialled by its address: home opens nothing on the FRITZ!Box, and a new home`
			`# address needs no change anywhere. The keepalive keeps the way back open through the`
			`# router's NAT.`
			`[Peer]`
			`PublicKey = <ramiel's public key>`
			`Endpoint = 45.129.181.128:51820`
			`AllowedIPs = 10.61.97.1/32`
			`PersistentKeepalive = 25`