halkyon/deploy/home-jellyfin/wg0.conf.example

# The home end of the tunnel to the instance's server (ADR 0032), copied to
# wireguard/wg_confs/wg0.conf (git-ignored) with its two keys filled in. Setting it up:
# ../sidecars/README.md, *Jellyfin at home*.

[Interface]
Address = 10.61.96.2/32
PrivateKey = <the home end's private key>

[Peer]
PublicKey = <the instance's public key>
Endpoint = learn.halkyon.eu:51820
# The instance's end alone, through which Caddy's requests come (masqueraded by Docker
# on the instance's server): nothing else of the internet goes through the tunnel.
AllowedIPs = 10.61.96.1/32
# Dialling out keeps the way open through the router and brings the tunnel back within
# 25 s after the machine wakes (D10).
PersistentKeepalive = 25
feat(deploy): Jellyfin at home, published through WireGuard (ADR 0032) The instance serves jellyfin.halkyon.eu and its Caddy proxies through a WireGuard tunnel to a Jellyfin on the operator's own machine, which dials out, so nothing names the home network's address and its router opens no port. compose.jellyfin-home.yaml takes the sidecar's place, with its site's rules unchanged (jellyfin.caddy's upstream is now a setting), and leaves JELLYFIN_URL unset, so the instance suggests it only while it answers. On the instance's server the tunnel reaches Jellyfin from Caddy alone and nothing of the host (wg-jellyfin-rules.sh, set and removed with the tunnel); the CI runner's unit denies it, and CI's Sandbox step fails if a job reaches it. The home end keeps Jellyfin in WireGuard's network namespace, its port on the loopback alone. The steps are in deploy/sidecars/README.md, the rules held by test/deploy/jellyfin_home_test.dart. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me> 2026-10-30 22:49:47 +01:00			`# The home end of the tunnel to the instance's server (ADR 0032), copied to`
			`# wireguard/wg_confs/wg0.conf (git-ignored) with its two keys filled in. Setting it up:`
			`# ../sidecars/README.md, Jellyfin at home.`

			`[Interface]`
			`Address = 10.61.96.2/32`
			`PrivateKey = <the home end's private key>`

			`[Peer]`
			`PublicKey = <the instance's public key>`
			`Endpoint = learn.halkyon.eu:51820`
			`# The instance's end alone, through which Caddy's requests come (masqueraded by Docker`
			`# on the instance's server): nothing else of the internet goes through the tunnel.`
			`AllowedIPs = 10.61.96.1/32`
			`# Dialling out keeps the way open through the router and brings the tunnel back within`
			`# 25 s after the machine wakes (D10).`
			`PersistentKeepalive = 25`