Add example WireGuard server and client configs

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

wireguard/README.md

@@ -0,0 +1,30 @@
+# WireGuard example configs
+
+Example server and client configs for a point-to-point WireGuard tunnel. The keys are samples only; do not use them in production.
+
+| File | Role | Tunnel address |
+| --- | --- | --- |
+| `server.conf` | Server, listens on UDP 51820 | `192.168.200.1/24` |
+| `client.conf` | Client, routes all traffic (`0.0.0.0/0`) through the server | `192.168.200.2/24` |
+
+## Usage
+
+1. Replace the keys with your own (`wg genkey | tee private.key | wg pubkey`), and set the client's `Endpoint` to the server's address.
+2. On the server, bring up the interface and register the client as a peer:
+
+   ```sh
+   wg-quick up wg0
+   sudo wg set wg0 peer <client-public-key> allowed-ips 192.168.200.2/32
+   sudo systemctl enable wg-quick@wg0.service
+   ```
+
+3. To let the client reach the outside through the server, enable forwarding and NAT:
+
+   ```sh
+   sudo sysctl net.ipv4.ip_forward=1
+   sudo nft add table ip nat
+   sudo nft -- add chain ip nat POSTROUTING { type nat hook postrouting priority srcnat \; }
+   sudo nft add rule ip nat POSTROUTING ip saddr 192.168.200.0/24 masquerade
+   ```
+
+4. On the client: `wg-quick up client` (the file name is the interface name).

wireguard/client.conf

@@ -0,0 +1,11 @@
+[Interface]
+PrivateKey = wMy0gixHHH1D8HOI9CaUXMLJTCW9+34sVGuocWDz328=
+Address = 192.168.200.2/24
+
+[Peer]
+PublicKey = UNZuRQxGmTSe7LkRJKfBlA/02RxPaNgl4qu/+ePYqwo=
+Endpoint = 10.15.108.21:51820
+AllowedIPs = 0.0.0.0/0
+PersistentKeepalive = 25
+
+# wg-quick up wg0

wireguard/server.conf

@@ -0,0 +1,11 @@
+[Interface]
+PrivateKey = sFQmh6nRt3MrZc0v4KHNMH16ngj4ndgmdGKlXZ5uG3k=
+Address = 192.168.200.1/24
+ListenPort = 51820
+
+# sudo wg set wg0 peer MvdYtQy6ran5wrKt4OMUiDqYQERg9/JaLZ89LsFTGg8= allowed-ips 192.168.200.2/32
+# sudo systemctl enable wg-quick@wg0.service
+# sudo nft add table ip nat
+# sudo nft -- add chain ip nat POSTROUTING { type nat hook postrouting priority srcnat \; }
+# sudo nft add rule ip nat POSTROUTING ip saddr 192.168.200.0/24 masquerade
+# sudo sysctl net.ipv4.ip_forward=1