ducoterra
3cdbb405ab
When SSH to a Pi targets a WireGuard tunnel address, reachability depends on three things that each fail independently: the unit starting at boot, the NAT mapping staying open, and the peer hostname still resolving. Rebooting onto a network with no route to the endpoint previously meant no way back in. - wg-quick@wg0.service.d/10-boot-resilience.conf: retry a failed boot-time up forever (Restart=on-failure, RestartSec=15, StartLimitIntervalSec=0) and cap endpoint resolution (WG_ENDPOINT_RESOLUTION_RETRIES=60, TimeoutStartSec=120) instead of hanging on the stock infinity. - wg0-watchdog: POSIX sh healer, oldest symptom first - missing interface or peer restarts the unit, a missing PersistentKeepalive is set directly, a stale handshake re-points the peer at a freshly resolved endpoint, and a very stale one restarts. Restarts are gap-limited so a broken network cannot make the unit flap, endpoint resolution falls back to the kernel endpoint and then to a last-known-good cache (tunnel DNS may only be reachable through the tunnel), and nothing it did not create is ever removed. Supports --dry-run. - wg0-watchdog.service/.timer: oneshot on a 60s timer, first check 30s after boot, Persistent=true to catch up after downtime, TimeoutStartSec=120 and Nice=10 so a restart cannot wedge the watchdog. - wg0.conf.template: documents /etc/wireguard/wg0.conf with placeholders only. Deliberately omits the DNS key so name resolution does not depend on the tunnel (Debian wg-quick has no `DNS = none`), and sets PersistentKeepalive 25 to hold the NAT mapping for inbound SSH. - wireguard.md: runbook for the placeholder table, failure modes, deploy, and verification. The real wg0.conf and key material never enter the repo. LLM-Generated: true
21 lines
902 B
Plaintext
21 lines
902 B
Plaintext
# wg0.conf template — /etc/wireguard/wg0.conf on the host, mode 0600 root:root.
|
|
# Never commit a real copy: this file holds the tunnel private key.
|
|
# Generate the key with `umask 077; wg genkey | tee privatekey | wg pubkey`.
|
|
|
|
[Interface]
|
|
PrivateKey = <tunnel private key>
|
|
Address = <TUNNEL_ADDR>
|
|
# Deliberately no `DNS` key: any resolver listed here is pushed as a system
|
|
# upstream while the tunnel is up, which makes all name resolution depend on the
|
|
# tunnel. Omitting it keeps the LAN's DHCP resolvers. Debian's wg-quick has no
|
|
# `DNS = none` - a non-IP value becomes a search domain.
|
|
|
|
[Peer]
|
|
PublicKey = <PEER_PUBKEY>
|
|
AllowedIPs = <PEER_NETWORK>
|
|
Endpoint = <WG_SERVER_HOST:PORT>
|
|
# Required when the client is behind NAT and must be reachable inbound (SSH):
|
|
# without it the mapping expires and the server cannot initiate. 25s survives
|
|
# typical 30-60s NAT UDP timeouts.
|
|
PersistentKeepalive = 25
|