# WireGuard VPN Server

Configures Talos as a WireGuard VPN server providing access to home network (192.168.178.0/24).

## Configuration

Clients are defined in `vault/wireguard.yml`:

```yaml
wireguard_server:
  private_key: "..."
  public_key: "..."

wireguard_clients:
  - name: masser
    private_key: "..."
    public_key: "..."
    ip_address: "10.8.0.2/24"
    description: "Masser phone"
```

## Adding a Client

1. Generate vanity key:
   ```bash
   timeout 120 wireguard-vanity-address --in 4 newc 2>&1 | grep "^private" | head -1
   ```

2. Edit vault:
   ```bash
   ansible-vault edit vault/wireguard.yml
   ```

3. Add to `wireguard_clients` list:
   ```yaml
   - name: newclient
     private_key: "paste_from_step_1"
     public_key: "paste_from_step_1"
     ip_address: "10.8.0.X/24"
     description: "Description"
   ```

4. Deploy:
   ```bash
   ansible-playbook -i inventory.yml playbook.yml --limit talos --tags leaf
   ```

5. Get client config from server:
   ```bash
   ssh nerevar@192.168.178.64 'sudo cat /etc/wireguard/clients/newclient.qr.txt'
   ```

## Network Details

- WireGuard network: 10.8.0.0/24
- Server IP: 10.8.0.1
- Server endpoint: home.hoekveen.net:51820
- Server public key stored in vault
- Port forwarding required: UDP 51820 -> 192.168.178.64