sns-network-solutions/infra/sns-digital/hybrid-networking.md

Hybrid Networking — SNS Digital

Entity: SNS Digital · Status: Partially built (WireGuard/Tailscale active)

What it is

The overlay network that connects on-prem Proxmox VMs to cloud providers securely. Makes location transparent — a VM on Proxmox and a VPS on Linode appear on the same private network.

Stack

Component	Software	FOSS	Role
Mesh VPN	Tailscale	Partial (client FOSS, control plane proprietary)	Zero-config mesh for management access
Site-to-site	WireGuard	Yes	Persistent tunnels between sites (Proxmox ↔ Linode)
DNS	AdGuard Home (on-prem) + split horizon	Yes	Internal names resolve to private IPs
Bastion	Linode Nanode	N/A	Public SSH/WireGuard endpoint, ProxyJump target

Current Topology

┌──────────────┐         WireGuard          ┌──────────────────┐
│  Proxmox     │◄──────────────────────────►│  Linode Bastion  │
│  192.168.122.x│         (always-on)        │  172.238.163.85  │
└──────┬───────┘                            └────────┬─────────┘
       │                                             │
       │ Tailscale mesh (management)                 │ Public IP
       │                                             │
┌──────┴───────┐                            ┌────────┴─────────┐
│  Workstation │                            │  Internet/SSH    │
│  (Sam's PC)  │                            │  clients         │
└──────────────┘                            └──────────────────┘

Racknerd boxes: WireGuard peer to Linode (hub-and-spoke)
AWS VPC: future — VPN Gateway or WireGuard on EC2 when needed

Design Decisions

1. WireGuard for infrastructure, Tailscale for people. WireGuard tunnels are persistent, config-file driven, Ansible-managed. Tailscale is for ad-hoc management access from laptops/phones.
2. Linode is the hub. All WireGuard peers connect to Linode. On-prem and Racknerd boxes don't need public IPs — they reach each other through the hub.
3. No split tunneling for services. Only management traffic goes over the mesh. Service traffic (web, API) goes through the public reverse proxy path.
4. ProxyJump, not port forwarding. SSH to internal VMs uses ProxyJump linode (already in your SSH config). No ports exposed on the bastion beyond SSH + WireGuard.

Build Steps (WireGuard hub-and-spoke)

1. Linode (hub):

   # /etc/wireguard/wg0.conf
   [Interface]
   Address = 10.10.0.1/24
   ListenPort = 51820
   PrivateKey = <hub-private-key>
   
   [Peer]  # Proxmox
   PublicKey = <proxmox-public-key>
   AllowedIPs = 10.10.0.2/32, 192.168.122.0/24
   
   [Peer]  # Racknerd1
   PublicKey = <rn1-public-key>
   AllowedIPs = 10.10.0.3/32
   

2. Proxmox (spoke):

   [Interface]
   Address = 10.10.0.2/24
   PrivateKey = <proxmox-private-key>
   
   [Peer]  # Linode hub
   PublicKey = <hub-public-key>
   Endpoint = 172.238.163.85:51820
   AllowedIPs = 10.10.0.0/24
   PersistentKeepalive = 25
   

3. Enable IP forwarding on Linode: net.ipv4.ip_forward = 1

4. Firewall: UFW on Linode allows UDP 51820 inbound. Forward rules for inter-spoke.

5. DNS: AdGuard on-prem resolves *.wg.internal to 10.10.0.x addresses.

Security Posture

• WireGuard: Authenticated encryption (ChaCha20 + Poly1305). No pre-shared keys needed for this threat model, but can add for post-quantum hedge.
• Bastion exposure: Only SSH (22/tcp) + WireGuard (51820/udp) on public IP. Everything else is default-deny.
• Key rotation: WireGuard keys rotated annually (low urgency — Noise protocol provides forward secrecy per session).
• No cloud provider VPN dependencies. Pure WireGuard means portable across providers.

Upgrade Path

• Headscale: Self-hosted Tailscale control plane if the proprietary coordination server becomes a concern.
• AWS Site-to-Site VPN: When a client VPC needs persistent connectivity and WireGuard-on-EC2 isn't enterprise-palatable.
• Multi-hub: Add a second WireGuard hub (Racknerd or second Linode) for redundancy if the single Linode becomes a SPOF.