blob: 3bcf3276a60d99eaf2ed06d38adb18fb50afeed3 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
|
#+TITLE: WireGuard configs — encrypted only
#+AUTHOR: Craig Jennings
This directory holds WireGuard VPN configs for the installer's
=import-wireguard-configs.sh=.
*This repo is public* (cgit at git.cjennings.net serves it over
unauthenticated HTTPS). Plaintext =*.conf= files carry live Proton
=PrivateKey= material and MUST NOT be committed — they are gitignored here.
Workflow:
- Store configs gpg-encrypted only: =gpg -e --default-recipient-self wg-XX.conf=
produces =wg-XX.conf.gpg=, safe to track in a public repo.
- The installer decrypts =*.conf.gpg= to a private temp dir at import time,
imports, then wipes the plaintext. (Re-architecture tracked in todo.org.)
History note: three plaintext configs were committed 2026-07-05 (c7b7d16) and
were publicly exposed until 2026-07-20, when the keys were rotated at Proton
and the files were purged from history.
|
