# Wireguard hub

The Wireguard hub on `edge-host-1` is the only way into the shelf from a
laptop. Each device gets one peer entry and one allowed-IPs line.

- Listen port 51820/udp, one peer per device.
- Allowed IPs are per-device /32s; the hub does not advertise the LAN.
- Persistent keepalive is 25 seconds for the roaming peers.
- Key rotation is a manual ceremony: generate, swap the peer file, reload.
- The hub hands out addresses from 10.66.0.0/24, one /32 per peer.

A peer that roams between the mobile network and wifi must keep the same
endpoint or the hub drops the stale mapping after the keepalive window.
The routing table is re-read on a reload, so a swapped peer file needs no
reboot of the host.