# ramiel's end of the tunnel to halkyon.li at home (ADR 0039, D8), as
# /etc/wireguard/wg-halkyon.conf on ramiel (root, 0600), brought up by
# wg-quick@wg-halkyon. Its private key is a file of its own beside it, never here.
# Setting it up: forward/README.md.

[Interface]
Address = 10.61.97.1/30
ListenPort = 51820
PostUp = wg set %i private-key /etc/wireguard/wg-halkyon.key
# HAProxy's 443 and the jump's 22 into the tunnel, nothing from it (D9, D17).
PostUp = nft -f /etc/wireguard/wg-halkyon.nft
PreDown = nft delete table inet halkyon_tunnel

# Home, which dials in: no endpoint, so ramiel never names its address.
[Peer]
PublicKey = <home's public key>
AllowedIPs = 10.61.97.2/32