Thore CimbalandClaude Opus 4.8
60aaf0e068
These files existed only on CFGMON, so rebuilding the host meant reconstructing them from AAR prose (management #0027, W4 point 4). Follows the maintenance-notify pattern: .example for anything carrying a secret, real files for the rest. The private key stays out of the repo by design — it lives on the host and nowhere else, and is reissued from the UDM if lost. The template carries the structural values from ADR-0004 and the zone set from ADR-0017, with the reasoning inline: why the direction is reversed, why AllowedIPs is narrow, why the port is 51841, and why ping is the wrong reachability check. Both files are derived from the ADRs rather than copied off the host, which the README says plainly along with the redacted dump command to reconcile them. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
14 lines
605 B
Plaintext
14 lines
605 B
Plaintext
# /etc/systemd/system/wg-quick@lab.service.d/10-after-docker.conf
|
|
#
|
|
# ⚠️ ABGELEITET, NICHT VOM HOST KOPIERT — vor Gebrauch gegen CFGMON abgleichen
|
|
# (siehe README, Abschnitt "Noch aus dem Live-Stand zu ergaenzen").
|
|
#
|
|
# Zweck: Der Tunnel muss NACH Docker starten. wg-quick traegt eine ACCEPT-Regel in
|
|
# die DOCKER-USER-Kette ein; startet Docker danach, baut es seine Ketten neu auf und
|
|
# die Regel ist weg — der Tunnel steht dann zwar, aber der Verkehr wird verworfen.
|
|
# Der Fehler ist unangenehm, weil `wg show` einen gesunden Handshake zeigt.
|
|
|
|
[Unit]
|
|
After=docker.service
|
|
Wants=docker.service
|