# Vimify management VPN

This optional WireGuard network is for private site management. It does not replace Vimify Edge, carry voucher codes, or make the cloud RADIUS-dependent.

## Security model

- The VPN hub runs on a separate Ubuntu or Debian VPS with a public UDP endpoint.
- Every site generates and keeps its own private key locally.
- The hub stores only peer public keys and unique tunnel addresses.
- Sites receive a `/32` address and no default Internet route.
- The hub installs an explicit forwarding block between WireGuard peers, so sites cannot route to each other even if forwarding is enabled elsewhere on the VPS.
- Operators connect to the hub first and use it as a controlled bastion for site diagnostics.

## Install

1. Run `sudo ./install-hub.sh` on the hub VPS and record the public key.
2. Run `sudo /opt/vimify-edge/install-vpn-peer.sh` on a site Edge gateway with the hub endpoint, hub public key, and a unique tunnel `/32` address supplied as environment variables.
3. Copy the public key printed by the site installer.
4. Run `sudo ./add-site-peer.sh` on the hub with the site name, public key, and same `/32` address.

On a HestiaCP hub, the installer adds the UDP listener to Hestia's firewall and
registers the peer-isolation rule in Hestia's persistent custom firewall hook.
On other hosts, allow the configured WireGuard UDP port in the host firewall.

Keep the WireGuard UDP port restricted at the VPS firewall when the operator source range is known. Do not expose WinBox, SSH, WebFig, RADIUS, or database ports directly to the internet.
