# Home's end of the tunnel through which ramiel publishes halkyon.li (ADR 0039, D8), as
# /etc/wireguard/wg-halkyon.conf on the instance's host at home (root, 0600), brought
# up by wg-quick@wg-halkyon before Docker (wg-quick-before-docker.conf). Its private key
# is a file of its own beside it, never here. Setting it up: host/README.md.

[Interface]
Address = 10.61.97.2/30
PostUp = wg set %i private-key /etc/wireguard/wg-halkyon.key
# From ramiel only Caddy's 443 and sshd's 22, nothing towards it (D9, D17).
PostUp = nft -f /etc/wireguard/wg-halkyon.nft
PreDown = nft delete table inet halkyon_tunnel

# ramiel, dialled by its address: home opens nothing on the FRITZ!Box, and a new home
# address needs no change anywhere. The keepalive keeps the way back open through the
# router's NAT.
[Peer]
PublicKey = <ramiel's public key>
Endpoint = 45.129.181.128:51820
AllowedIPs = 10.61.97.1/32
PersistentKeepalive = 25