# Site A of a routed WireGuard site-to-site VPN.
#
#   Site A LAN 192.168.10.0/24, tunnel address 10.77.0.1
#   Site B LAN 192.168.20.0/24, tunnel address 10.77.0.2
#
# Site B uses the mirror image of this file (see docs/wireguard.md).
# Create the key first:  pebble vpn genkey wg0
version: 1

system:
  hostname: site-a
  timezone: Europe/London

network:
  wan:
    device: igb0
    ipv4:
      mode: dhcp
  lan:
    device: igb1
    ipv4:
      address: 192.168.10.1/24
  ipv6:
    mode: disabled

dhcp:
  enabled: true
  authoritative: true
  start: 192.168.10.100
  end: 192.168.10.199
  lease_duration: 12h
  domain: site-a.home.arpa
  reservations:
    - name: fileserver
      mac: "02:00:00:00:10:05"
      address: 192.168.10.5
      hostname: files

dns:
  enabled: true
  recursive: true
  dnssec: true
  cache_mb: 32
  # Site B's own resolver answers for its local domain over the tunnel.
  # Queries leave this router from its tunnel address (10.77.0.1), so site
  # B must accept DNS from 10.77.0.1 (see docs/wireguard.md).
  forwards:
    - domain: site-b.home.arpa
      servers: [192.168.20.1]
  blocking:
    enabled: false

wireguard:
  interfaces:
    - name: wg0
      description: Site-to-site
      address: 10.77.0.1/24
      listen_port: 51820
      private_key_file: /usr/local/etc/pebble/keys/wg0.key
      peers:
        - name: site-b
          # Replace with the output of 'pebble vpn genkey wg0' on site B.
          public_key: "xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg="
          endpoint: site-b.example.net:51820
          persistent_keepalive: 25
          allowed_ips:
            - 10.77.0.2/32
            - 192.168.20.0/24
          routes:
            - 192.168.20.0/24

firewall:
  default_inbound: deny
  default_forward: deny
  default_outbound: allow
  nat:
    enabled: true
    outbound: wan
  rules:
    - description: Site A LAN may reach all of site B
      action: pass
      interface: lan
      source: lan
      destination: peer:site-b
    - description: Site B may reach the file server over SMB only
      action: pass
      interface: wg0
      protocol: tcp
      source: peer:site-b
      destination: 192.168.10.5
      ports: ["445"]

management:
  ssh:
    enabled: true
    allow_from:
      - 192.168.10.0/24

updates:
  automatic_install: false

recovery:
  rollback_timeout: 120s
  keep_generations: 5