# wg0.conf template — /etc/wireguard/wg0.conf on the host, mode 0600 root:root.
# Never commit a real copy: this file holds the tunnel private key.
# Generate the key with `umask 077; wg genkey | tee privatekey | wg pubkey`.

[Interface]
PrivateKey = <tunnel private key>
Address = <TUNNEL_ADDR>
# Deliberately no `DNS` key: any resolver listed here is pushed as a system
# upstream while the tunnel is up, which makes all name resolution depend on the
# tunnel. Omitting it keeps the LAN's DHCP resolvers. Debian's wg-quick has no
# `DNS = none` - a non-IP value becomes a search domain.

[Peer]
PublicKey = <PEER_PUBKEY>
AllowedIPs = <PEER_NETWORK>
Endpoint = <WG_SERVER_HOST:PORT>
# Required when the client is behind NAT and must be reachable inbound (SSH):
# without it the mapping expires and the server cannot initiate. 25s survives
# typical 30-60s NAT UDP timeouts.
PersistentKeepalive = 25