# Example WireGuard config for the VPS side of the VPS <-> Raspberry Pi
# storage link — see docs/PROJECT_PLAN.md §50. Copy to /etc/wireguard/wg0.conf
# on the VPS, fill in the real private key, and restrict permissions
# (chmod 600). The VPS is the listening peer; the Pi initiates the tunnel
# outbound so it works even behind CGNAT or a restrictive home router.
[Interface]
PrivateKey = <vps-private-key-from-generate-keys.sh>
Address = 10.8.0.1/24
ListenPort = 51820

[Peer]
# Raspberry Pi storage node
PublicKey = <pi-public-key>
AllowedIPs = 10.8.0.2/32