Edge #

WireGuard tunnel from the VPS (vps/), reverse proxy routing public hostnames to cluster services.

Caddy on the VPS terminates TLS and forwards here; default.conf is the single source of truth for public hostnames.

One-off secret creation (WireGuard config with the cluster private key and the VPS public key):

kubectl create secret generic wireguard-config \
  --namespace=edge \
  --from-file=wg0.conf=wg0.conf

One-off config creation (re-run after editing default.conf):

kubectl create configmap edge-config \
  --namespace=edge \
  --from-file=default.conf=default.conf \
  --dry-run=client -o yaml | kubectl apply -f -

Deploy:

kubectl apply -f apps/edge/