Add WireGuard tunnel

Bring up a WireGuard interface ({{NEXT_WG}} is allocated automatically). A server keypair is created in the secret store and referenced by name — the private key never leaves the router. After it is up, copy the server public key from the interface page to share with peers.

Creating a WireGuard tunnel also needs secret:*:write (it provisions a server key). Your account has interface write but not secret write.

Confirm WireGuard tunnel

{{PENDING_IFACE}} is live but routes management traffic, so it is awaiting confirmation and reverts automatically in {{PENDING_REMAINING}} seconds unless you keep it. If you lose connectivity, do nothing — the tunnel backs out by itself at the deadline.

Server key Generate a new keypair (recommended) — the private key is stored on the router; you share the public key.

Tunnel address

The address this router uses inside the tunnel, in CIDR form.

Peers

Each remote endpoint: its public key, the IPs it is allowed to send/receive through the tunnel, and (optionally) where to reach it. Peers are optional here — leave them blank to bring the interface up with just your key, copy your public key from the interface page, and add peers there once you have the remote's key.

{{#WAN_CONFIRM}} These allowed IPs route the management/default path over the tunnel — I understand this can cut off access to this router if the peer is wrong. The apply runs behind a self-revert window so it backs out automatically if it severs management. {{/WAN_CONFIRM}}