Certificate issuance is gated by apps/edge/default.conf: Caddy asks the cluster edge whether a hostname is allowed before requesting its certificate. Adding a public hostname needs only a line there plus a DNS record — no changes on the VPS.

Setup (one-time) #

Copy the directory to the VPS:

scp -r vps debian@54.39.230.156:~/

On the VPS, generate the two keypairs as named files:

cd ~/vps
docker run --rm -it --user "$(id -u):$(id -g)" -v "$PWD:/keys" \
  --entrypoint sh linuxserver/wireguard:1.0.20260223

Inside the container:

cd /keys
umask 077
wg genkey > vps.private
wg pubkey < vps.private > vps.public
wg genkey > cluster.private
wg pubkey < cluster.private > cluster.public
exit

Create the WireGuard config from the template, replacing <VPS PRIVATE KEY> with the contents of vps.private and <CLUSTER PUBLIC KEY> with the contents of cluster.public:

cp wg0.conf.example wg0.conf

Start both containers:

docker compose up -d

Bring the cluster half of the keys back to your machine and store them outside this repository:

scp debian@54.39.230.156:~/vps/cluster.private .
scp debian@54.39.230.156:~/vps/vps.public .

The cluster private key goes into the cluster wg0.conf used for the Kubernetes Secret, and the VPS public key goes into that same wg0.conf under [Peer] — see apps/edge/README.md.

Verify #

docker compose exec wireguard wg show
curl -H "Host: music.cuducos.me" http://10.0.0.136:8080/