RFC-WG-0002                                                     Section 0
Category: Architecture                                     Index

0. Index

Status of This Memo

This document specifies a standards-track architecture for WireGuard-based private networking across VPS hosts. Distribution of this memo is unlimited within the organization and to authorized external reviewers.

This document is a DRAFT and is subject to change based on review feedback.

Abstract

This RFC defines the architecture for a WireGuard-based private network used to interconnect services across multiple VPS hosts. The design establishes trust boundaries, authority domains, and connectivity rules so that services communicate over a private encrypted fabric while minimizing exposure on public/LAN interfaces. The architecture is intentionally simple, host-centric, and compatible with containerized deployments.

Changelog

Intended Audience

This document is written for:

• Platform & Infrastructure Engineers
• Security & Compliance Reviewers
• Service Owners deploying on VPS infrastructure

No prior knowledge of the internal system is assumed.

Conventions and Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 (RFC 2119, RFC 8174).

Table of Contents

Part 1: Foundation

1. Introduction

   • 1.1 Problem Statement
   • 1.2 Motivation and Goals
   • 1.3 Scope and Boundaries

2. Requirements and Invariants

   • 2.1 Design Goals
   • 2.2 Non-Goals
   • 2.3 Invariants
   • 2.4 Success Criteria

Part 2: Architecture

3. Core Architecture

   • 3.1 System Overview
   • 3.2 Authority Domains
   • 3.3 Trust Boundaries
   • 3.4 Data Flow

4. Components

   • 4.1 Component List
   • 4.2 Responsibilities and Interfaces

5. Network Topology

   • 5.1 Addressing Model
   • 5.2 Peer Connectivity Model

6. Security Boundaries

   • 6.1 Boundary Definitions
   • 6.2 Enforcement Principles

7. Operations Model

   • 7.1 Ownership and Change Control
   • 7.2 Validation Responsibilities

8. Service Access Model

   • 8.1 WG-Only Access Rules
   • 8.2 Public Exposure Exceptions

Part 3: Decisions

9. Rationale
10. Evolution

Appendices

A. Glossary B. References

End of Index — RFC-WG-0002