Mirrored page

Mirrored 2026-07-12 from inva-infrastructure — that repository is authoritative for live engineering state; update it first, then refresh this mirror.

inva-network-01 — WireGuard hub

Dedicated WireGuard hub. Runs wg-easy and nothing else of substance: no Authentik, Infisical, databases, Claude Code, owner credentials, or application workloads (runbook A3).

Facts (verified 2026-07-11)

Property	Value
Zone / type	europe-west4-c / e2-micro
VPC IP	10.20.0.2 (reserved external 34.6.75.87)
WireGuard IP	10.30.0.1 (hub)
OS / boot disk	Ubuntu 24.04 / 20 GB pd-standard
canIpForward	true ✓
Tags	inva-iap-ssh, inva-wireguard (needs inva-managed-ssh added)
Service account	none attached (blocks Ops Agent monitoring — R5)
Docker	not installed (deployed by host_prep)
Reachability	Engineering→Network SSH over VPC works (user inva); IAP recovery available

Deployment

Managed by Ansible from the Engineering VM:

bash cd /srv/inva/repositories/inva-infrastructure/ansible ansible-playbook playbooks/wireguard-preflight.yml # read-only ansible-playbook playbooks/wireguard-deploy.yml --check --diff # preview (P2) ansible-playbook playbooks/wireguard-deploy.yml # apply (P3, approved) ansible-playbook playbooks/wireguard-verify.yml # confirm

The host_prep role installs Docker + base hardening; the wg_easy role deploys ghcr.io/wg-easy/wg-easy:15 (pinned), binds the UI to 10.20.0.2:51821 (private), and installs a per-minute health timer.

Open items

• Attach a least-privilege service account (logging.logWriter + monitoring.metricWriter) — requires a stop/start (brief downtime); then set host_prep_install_ops_agent: true.
• Add tag inva-managed-ssh and the two Engineering-scoped firewall rules (scripts/plan-wireguard-firewall.sh).
• Delete the world-open SSH/RDP rules after IAP is confirmed.

Recovery

Independent of WireGuard — always available:

bash gcloud compute ssh inva-network-01 --zone=europe-west4-c \ --project=wired-torus-499015-u7 --tunnel-through-iap

Never remove IAP because the VPN works.