new notesHEADmaster

1 files changed, 105 insertions, 0 deletions

diff --git a/WireGuard.md b/WireGuard.md
new file mode 100644
index 0000000..324c31b
--- /dev/null
+++ b/WireGuard.md
@@ -0,0 +1,105 @@
+The report is public. To restrict access, add basic authentication in httpd.conf
+or place the report behind your VPN (see WireGuard guide).
+text
+
+
+---
+
+### 2. WireGuard VPN – Secure administrative access
+
+```markdown
+# WireGuard VPN on OpenBSD (server + client)
+
+This guide creates a private tunnel so that SSH, Git, and other
+administrative services are accessible only through the VPN.
+
+Replace `your_server_pubkey`, `your_client_pubkey`, `your_server_ip` and
+`your_client_ip_range` accordingly.
+
+## Server side (OpenBSD)
+
+### 1. Install WireGuard
+
+```bash
+doas pkg_add wireguard-tools
+
+2. Generate keys
+bash
+
+doas mkdir -m 700 /etc/wireguard
+doas wg genkey | doas tee /etc/wireguard/server.key | doas wg pubkey > /etc/wireguard/server.pub
+doas chmod 600 /etc/wireguard/server.key
+
+3. Create /etc/wireguard/wg0.conf
+ini
+
+[Interface]
+PrivateKey = <contents of /etc/wireguard/server.key>
+ListenPort = 51820
+
+[Peer]
+PublicKey = <your_client_pubkey>
+AllowedIPs = 10.77.77.2/32
+
+4. Start the interface
+bash
+
+doas ifconfig wg0 create
+doas ifconfig wg0 10.77.77.1/24
+doas wg setconf wg0 /etc/wireguard/wg0.conf
+doas ifconfig wg0 up
+
+5. Make it permanent
+
+Add to /etc/rc.local (create if missing):
+bash
+
+doas tee -a /etc/rc.local << 'EOF'
+#!/bin/sh
+ifconfig wg0 create 2>/dev/null
+ifconfig wg0 10.77.77.1/24
+wg setconf wg0 /etc/wireguard/wg0.conf
+ifconfig wg0 up
+EOF
+doas chmod +x /etc/rc.local
+
+Client side (Linux / Gentoo)
+1. Install WireGuard
+bash
+
+doas emerge --ask net-vpn/wireguard-tools   # Gentoo
+sudo apt install wireguard-tools            # Debian/Ubuntu
+
+2. Generate client keys
+bash
+
+wg genkey > client.key
+wg pubkey < client.key > client.pub
+chmod 600 client.key
+
+3. Create /etc/wireguard/wg0.conf (client)
+ini
+
+[Interface]
+Address = 10.77.77.2/24
+PrivateKey = <contents of client.key>
+
+[Peer]
+PublicKey = <your_server_pubkey>
+Endpoint = your_server_ip:51820
+AllowedIPs = 10.77.77.0/24
+PersistentKeepalive = 25
+
+4. Start the tunnel
+bash
+
+doas wg-quick up wg0   # or sudo wg-quick up wg0
+ping 10.77.77.1
+
+Now all sensitive services can listen on 10.77.77.1 only.
+text
+
+
+---
+
+