Mirrored page
Mirrored 2026-07-12 from inva-infrastructure — that repository is authoritative
for live engineering state; update it first, then refresh this mirror.
WireGuard Peer Inventory¶
The authoritative list of planned and active WireGuard peers on the 10.30.0.0/24 overlay
(hub inva-network-01 at 10.30.0.1). This page is a register, not a key store: it must
never contain private keys, full client configurations, or passwords (runbook §26).
Peer-creation policy (runbook §16, §5.3): a peer is created only when its specific device is approved and present to receive the config. Creating a peer generates a private key; human device configs are never generated in advance or "for everyone". Reserved peers below have a fixed address allocation only — no key exists until activation. This is why "add all clients" is done as a reservation table, and each activation is a separate approved step.
Deployment state (2026-07-12): hub live on
inva-network-01(wg-easy v15). Three peers created. wg-easy manages all keypairs itself (it ignores externally-supplied public keys and re-adds a per-peer preshared key), so every client uses a wg-easy-generated keypair. Theinva-engineering-01peer is connected; the other two are created and awaiting install on their devices.
Infrastructure peers¶
| Address | Peer | Purpose | State | AllowedIPs (on hub for this peer) |
|---|---|---|---|---|
10.30.0.1 |
inva-network-01 |
WireGuard hub (wg-easy) | Live — hub itself | n/a |
10.30.0.2 |
inva-platform-01 |
Authentik, Infisical, Emma Core | Reserved | 10.30.0.2/32 |
10.30.0.3 |
inva-gateway-01 |
OpenClaw / channel gateway | Reserved | 10.30.0.3/32 |
10.30.0.4 |
inva-local-01 |
Local RTX 3080 AI server (physical) | Created — config staged for on-site install; overlay-only or +VPC per need | 10.30.0.4/32 |
10.30.0.5 |
inva-engineering-01 |
Primary control plane | ACTIVE — wg0 up, handshake confirmed; AllowedIPs overlay-only (10.30.0.0/24) since it's already on the VPC |
10.30.0.5/32 |
10.30.0.6 |
inva-monitoring-01 |
Future monitoring | Reserved | 10.30.0.6/32 |
10.30.0.7 |
inva-ci-runner-01 |
Future CI runner | Reserved | 10.30.0.7/32 |
Human peers¶
| Address | Peer | Operator | State |
|---|---|---|---|
10.30.0.10 |
eythor-mac-primary |
Eyþór Dan Sigurðsson | Activate first (with device present) |
10.30.0.11 |
aron-primary-device |
Aron Heiðar Steinsson | Reserved — activate on device approval |
10.30.0.12 |
agnar-primary-device |
Agnar Þór Bjartmarz | Reserved — activate on device approval |
10.30.0.13 |
hilmar-primary-device |
Hilmar Þór Pétursson | Reserved — activate on device approval |
10.30.0.14 |
johannes-primary-device |
Jóhannes Bergur Gunnarsson | Reserved — activate on device approval |
10.30.0.15 |
engineer-spare-01 |
Future engineer | Reserved |
10.30.0.16 |
engineer-spare-02 |
Future engineer | Reserved |
10.30.0.20 |
breakglass-device |
Offline emergency device | Later |
Temporary peers use 10.30.0.100–119 and must record an owner, purpose, and expiry date
(e.g. test-revocation-01 at 10.30.0.100 for the revocation drill, runbook §21).
Default AllowedIPs (split tunnel)¶
- Human devices:
10.30.0.0/24, 10.20.0.0/24(overlay + VPC only — never0.0.0.0/0). - Infrastructure peers: only the specific networks each needs.
Per-peer record fields (fill on activation)¶
For each activated peer, record here: name · address · owner · device type · status · created / reviewed / expiry dates · public-key reference (fingerprint only) · last validation date. Private material stays on the device and in an approved encrypted backup only.
Revocation¶
Disable/delete the peer in wg-easy, confirm access fails, update this register, and record an audit entry. Never re-enable a compromised key — create a replacement identity with a new key (runbook §21).