# Hybrid Networking — SNS Digital

**Entity:** SNS Digital · **Status:** Partially built (WireGuard/Tailscale active)

## What it is

The overlay network that connects on-prem Proxmox VMs to cloud providers securely.
Makes location transparent — a VM on Proxmox and a VPS on Linode appear on the same
private network.

## Stack

| Component | Software | FOSS | Role |
|-----------|----------|------|------|
| Mesh VPN | Tailscale | Partial (client FOSS, control plane proprietary) | Zero-config mesh for management access |
| Site-to-site | WireGuard | Yes | Persistent tunnels between sites (Proxmox ↔ Linode) |
| DNS | AdGuard Home (on-prem) + split horizon | Yes | Internal names resolve to private IPs |
| Bastion | Linode Nanode | N/A | Public SSH/WireGuard endpoint, ProxyJump target |

## Current Topology

```
┌──────────────┐         WireGuard          ┌──────────────────┐
│  Proxmox     │◄──────────────────────────►│  Linode Bastion  │
│  192.168.122.x│         (always-on)        │  172.238.163.85  │
└──────┬───────┘                            └────────┬─────────┘
       │                                             │
       │ Tailscale mesh (management)                 │ Public IP
       │                                             │
┌──────┴───────┐                            ┌────────┴─────────┐
│  Workstation │                            │  Internet/SSH    │
│  (Sam's PC)  │                            │  clients         │
└──────────────┘                            └──────────────────┘

Racknerd boxes: WireGuard peer to Linode (hub-and-spoke)
AWS VPC: future — VPN Gateway or WireGuard on EC2 when needed
```

## Design Decisions

1. **WireGuard for infrastructure, Tailscale for people.** WireGuard tunnels are
   persistent, config-file driven, Ansible-managed. Tailscale is for ad-hoc
   management access from laptops/phones.
2. **Linode is the hub.** All WireGuard peers connect to Linode. On-prem and Racknerd
   boxes don't need public IPs — they reach each other through the hub.
3. **No split tunneling for services.** Only management traffic goes over the mesh.
   Service traffic (web, API) goes through the public reverse proxy path.
4. **ProxyJump, not port forwarding.** SSH to internal VMs uses `ProxyJump linode`
   (already in your SSH config). No ports exposed on the bastion beyond SSH + WireGuard.

## Build Steps (WireGuard hub-and-spoke)

1. **Linode (hub):**
   ```ini
   # /etc/wireguard/wg0.conf
   [Interface]
   Address = 10.10.0.1/24
   ListenPort = 51820
   PrivateKey = <hub-private-key>

   [Peer]  # Proxmox
   PublicKey = <proxmox-public-key>
   AllowedIPs = 10.10.0.2/32, 192.168.122.0/24

   [Peer]  # Racknerd1
   PublicKey = <rn1-public-key>
   AllowedIPs = 10.10.0.3/32
   ```

2. **Proxmox (spoke):**
   ```ini
   [Interface]
   Address = 10.10.0.2/24
   PrivateKey = <proxmox-private-key>

   [Peer]  # Linode hub
   PublicKey = <hub-public-key>
   Endpoint = 172.238.163.85:51820
   AllowedIPs = 10.10.0.0/24
   PersistentKeepalive = 25
   ```

3. **Enable IP forwarding** on Linode: `net.ipv4.ip_forward = 1`
4. **Firewall:** UFW on Linode allows UDP 51820 inbound. Forward rules for inter-spoke.
5. **DNS:** AdGuard on-prem resolves `*.wg.internal` to 10.10.0.x addresses.

## Security Posture

- **WireGuard:** Authenticated encryption (ChaCha20 + Poly1305). No pre-shared keys
  needed for this threat model, but can add for post-quantum hedge.
- **Bastion exposure:** Only SSH (22/tcp) + WireGuard (51820/udp) on public IP.
  Everything else is default-deny.
- **Key rotation:** WireGuard keys rotated annually (low urgency — Noise protocol
  provides forward secrecy per session).
- **No cloud provider VPN dependencies.** Pure WireGuard means portable across providers.

## Upgrade Path

- **Headscale:** Self-hosted Tailscale control plane if the proprietary coordination
  server becomes a concern.
- **AWS Site-to-Site VPN:** When a client VPC needs persistent connectivity and
  WireGuard-on-EC2 isn't enterprise-palatable.
- **Multi-hub:** Add a second WireGuard hub (Racknerd or second Linode) for redundancy
  if the single Linode becomes a SPOF.