diff options
Diffstat (limited to 'assets/wireguard-config/README.org')
| -rw-r--r-- | assets/wireguard-config/README.org | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/assets/wireguard-config/README.org b/assets/wireguard-config/README.org new file mode 100644 index 0000000..3bcf327 --- /dev/null +++ b/assets/wireguard-config/README.org @@ -0,0 +1,19 @@ +#+TITLE: WireGuard configs — encrypted only +#+AUTHOR: Craig Jennings + +This directory holds WireGuard VPN configs for the installer's +=import-wireguard-configs.sh=. + +*This repo is public* (cgit at git.cjennings.net serves it over +unauthenticated HTTPS). Plaintext =*.conf= files carry live Proton +=PrivateKey= material and MUST NOT be committed — they are gitignored here. + +Workflow: +- Store configs gpg-encrypted only: =gpg -e --default-recipient-self wg-XX.conf= + produces =wg-XX.conf.gpg=, safe to track in a public repo. +- The installer decrypts =*.conf.gpg= to a private temp dir at import time, + imports, then wipes the plaintext. (Re-architecture tracked in todo.org.) + +History note: three plaintext configs were committed 2026-07-05 (c7b7d16) and +were publicly exposed until 2026-07-20, when the keys were rotated at Proton +and the files were purged from history. |