{
  "wireguard": {
    "client_allowed_ips": [
      "10.200.0.0/24"
    ],
    "concerns": {
      "backup": {
        "kind": "disabled",
        "reason": "stateless: peer keys + config in git/SOPS; runtime state is connection metadata only"
      },
      "certs": {
        "kind": "disabled",
        "reason": "no ACME issuer required"
      },
      "dns": {
        "kind": "disabled",
        "reason": "no DNS records owned by this component"
      },
      "observability": {
        "backlog_ref": "OBS-001",
        "kind": "pending",
        "reason": "ObservabilityImpl iteration deferred — surface stub only"
      },
      "security": {
        "backlog_ref": "SEC-001",
        "kind": "pending",
        "reason": "SecurityImpl iteration deferred — surface stub only"
      },
      "tls": {
        "kind": "disabled",
        "reason": "WireGuard uses its own Noise-protocol mTLS; no x509 termination"
      }
    },
    "credential_generators": {
      "PASSWORD_HASH": {
        "kind": "bcrypt_password",
        "source": "WGUI_PASSWORD"
      },
      "WGUI_PASSWORD": {
        "kind": "random_password",
        "length": 32
      },
      "WG_PRIVATE_KEY": {
        "kind": "wg_privkey"
      },
      "WG_PUBLIC_KEY": {
        "kind": "wg_pubkey",
        "source": "WG_PRIVATE_KEY"
      }
    },
    "dns": [
      "1.1.1.1",
      "8.8.8.8"
    ],
    "fip_name": "",
    "image": "ghcr.io/wg-easy/wg-easy:15",
    "keepalive": 25,
    "lb_ipam_ip": "",
    "listen_port": 51820,
    "live_check": {
      "scope": "cp_only",
      "strategy": "k8s_pods"
    },
    "mode": "cluster",
    "mtu": 1420,
    "name": "wireguard",
    "namespace": "vpn",
    "node": "",
    "operations": {
      "delete": true,
      "health": true,
      "install": true,
      "restart": true,
      "update": true
    },
    "provides": {
      "ports": [
        51820
      ],
      "service": "wireguard"
    },
    "requires": {
      "credentials": [
        "WGUI_PASSWORD",
        "PASSWORD_HASH",
        "WG_PRIVATE_KEY",
        "WG_PUBLIC_KEY"
      ],
      "ports": [
        {
          "exposure": "public",
          "port": 51820,
          "protocol": "UDP"
        },
        {
          "exposure": "internal",
          "port": 51821,
          "protocol": "TCP"
        }
      ],
      "storage": {
        "persistent": true,
        "size": "1Gi"
      },
      "storage_class": "hcloud-volumes"
    },
    "server_ip": "10.200.0.1",
    "ui_port": 51821,
    "version": "15",
    "vpn_subnet": "10.200.0.0/24"
  }
}