3. Architecture
3. Architecture
← Requirements | Index | Next →
3.1 System Overview
The system is a host-level WireGuard mesh. Each host is assigned a WireGuard IP in a private subnet. Services bind to the host’s WireGuard interface for inter-host access. Public/LAN interfaces are restricted by host firewall policy.
3.2 Authority Domains
| Domain | Authority | Description |
|---|---|---|
| Host networking | Platform ops | WireGuard and firewall policies |
| Service configs | Service owners | Bindings, ports, and runtime settings |
3.3 Trust Boundaries
Traffic entering via public/LAN interfaces is treated as untrusted. Traffic entering via wg0 is trusted for internal services only. This boundary is enforced by host firewall policy and service bindings.
3.4 Data Flow
- Service on Host A connects to Host B using Host B’s WG IP.
- Traffic enters Host B via
wg0and is accepted by firewall policy. - Service on Host B receives traffic on a WG-bound port.
End of Architecture — RFC-WG-0002