#+TITLE: WireGuard configs — encrypted only
#+AUTHOR: Craig Jennings

This directory holds WireGuard VPN configs for the installer's
=import-wireguard-configs.sh=.

*This repo is public* (cgit at git.cjennings.net serves it over
unauthenticated HTTPS). Plaintext =*.conf= files carry live Proton
=PrivateKey= material and MUST NOT be committed — they are gitignored here.

Workflow:
- Store configs gpg-encrypted only: =gpg -e --default-recipient-self wg-XX.conf=
  produces =wg-XX.conf.gpg=, safe to track in a public repo.
- The installer decrypts =*.conf.gpg= to a private temp dir at import time,
  imports, then wipes the plaintext. (Re-architecture tracked in todo.org.)

History note: three plaintext configs were committed 2026-07-05 (c7b7d16) and
were publicly exposed until 2026-07-20, when the keys were rotated at Proton
and the files were purged from history.