VPN

Remote access uses WireGuard. Profiles are generated from the infra/vpn repository on GitLab.

Every newcomer receives their profile on their first day (see onboarding). A profile is revoked the day someone leaves (see offboarding).

Troubleshooting

• The tunnel is up but nothing answers: check that the profile still has AllowedIPs for the server VLAN (10.10.0.0/24, see VLANs).
• Connected at home, not at a hotel: some networks block UDP. Use the TCP fallback profile.
• Lost laptop: revoke the profile at once, as for an offboarding.