# The instance's end of the tunnel to Jellyfin at home (ADR 0032, D4), as
# /etc/wireguard/wg-jellyfin.conf on the instance's server (root, 0600), brought up by
# wg-quick@wg-jellyfin. Its private key is a file of its own beside it, never here.
# Setting it up: sidecars/README.md, *Jellyfin at home*.

[Interface]
Address = 10.61.96.1/30
ListenPort = 51820
PostUp = wg set %i private-key /etc/wireguard/wg-jellyfin.key
# Caddy alone through the tunnel, nothing of the host from it (D5).
PostUp = /etc/wireguard/wg-jellyfin-rules.sh up %i
PreDown = /etc/wireguard/wg-jellyfin-rules.sh down %i

# The home end, which dials in: no endpoint, so this server never names its address.
[Peer]
PublicKey = <the home end's public key>
AllowedIPs = 10.61.96.2/32