The report is public. To restrict access, add basic authentication in httpd.conf
or place the report behind your VPN (see WireGuard guide).
text


---

### 2. WireGuard VPN – Secure administrative access

```markdown
# WireGuard VPN on OpenBSD (server + client)

This guide creates a private tunnel so that SSH, Git, and other
administrative services are accessible only through the VPN.

Replace `your_server_pubkey`, `your_client_pubkey`, `your_server_ip` and
`your_client_ip_range` accordingly.

## Server side (OpenBSD)

### 1. Install WireGuard

```bash
doas pkg_add wireguard-tools

2. Generate keys
bash

doas mkdir -m 700 /etc/wireguard
doas wg genkey | doas tee /etc/wireguard/server.key | doas wg pubkey > /etc/wireguard/server.pub
doas chmod 600 /etc/wireguard/server.key

3. Create /etc/wireguard/wg0.conf
ini

[Interface]
PrivateKey = <contents of /etc/wireguard/server.key>
ListenPort = 51820

[Peer]
PublicKey = <your_client_pubkey>
AllowedIPs = 10.77.77.2/32

4. Start the interface
bash

doas ifconfig wg0 create
doas ifconfig wg0 10.77.77.1/24
doas wg setconf wg0 /etc/wireguard/wg0.conf
doas ifconfig wg0 up

5. Make it permanent

Add to /etc/rc.local (create if missing):
bash

doas tee -a /etc/rc.local << 'EOF'
#!/bin/sh
ifconfig wg0 create 2>/dev/null
ifconfig wg0 10.77.77.1/24
wg setconf wg0 /etc/wireguard/wg0.conf
ifconfig wg0 up
EOF
doas chmod +x /etc/rc.local

Client side (Linux / Gentoo)
1. Install WireGuard
bash

doas emerge --ask net-vpn/wireguard-tools   # Gentoo
sudo apt install wireguard-tools            # Debian/Ubuntu

2. Generate client keys
bash

wg genkey > client.key
wg pubkey < client.key > client.pub
chmod 600 client.key

3. Create /etc/wireguard/wg0.conf (client)
ini

[Interface]
Address = 10.77.77.2/24
PrivateKey = <contents of client.key>

[Peer]
PublicKey = <your_server_pubkey>
Endpoint = your_server_ip:51820
AllowedIPs = 10.77.77.0/24
PersistentKeepalive = 25

4. Start the tunnel
bash

doas wg-quick up wg0   # or sudo wg-quick up wg0
ping 10.77.77.1

Now all sensitive services can listen on 10.77.77.1 only.
text


---