# Edge

WireGuard tunnel from the VPS (`vps/`), reverse proxy routing public hostnames to cluster services.

Caddy on the VPS terminates TLS and forwards here; `default.conf` is the single source of truth for public hostnames.

One-off secret creation (WireGuard config with the cluster private key and
the VPS public key):

```bash
kubectl create secret generic wireguard-config \
  --namespace=edge \
  --from-file=wg0.conf=wg0.conf
```

One-off config creation (re-run after editing `default.conf`):

```bash
kubectl create configmap edge-config \
  --namespace=edge \
  --from-file=default.conf=default.conf \
  --dry-run=client -o yaml | kubectl apply -f -
```

Deploy:

```bash
kubectl apply -f apps/edge/
```