refactor(deployment): Remove WireGuard VPN dependency and restore public service access

Remove WireGuard integration from production deployment to simplify infrastructure: - Remove docker-compose-direct-access.yml (VPN-bound services) - Remove VPN-only middlewares from Grafana, Prometheus, Portainer - Remove WireGuard middleware definitions from Traefik - Remove WireGuard IPs (10.8.0.0/24) from Traefik forwarded headers All monitoring services now publicly accessible via subdomains: - grafana.michaelschiemer.de (with Grafana native auth) - prometheus.michaelschiemer.de (with Basic Auth) - portainer.michaelschiemer.de (with Portainer native auth) All services use Let's Encrypt SSL certificates via Traefik.
2025-11-05 12:48:25 +01:00
parent 7c52065aae
commit 95147ff23e
215 changed files with 29490 additions and 368 deletions
--- a/deployment/wireguard/CLIENT-IMPORT-GUIDE.md
+++ b/deployment/wireguard/CLIENT-IMPORT-GUIDE.md
@@ -0,0 +1,370 @@
+# WireGuard Client Import & Connection Guide
+
+Anleitung zum Importieren und Verbinden der generierten WireGuard Client-Konfiguration.
+
+## Generierte Konfiguration
+
+**Client Name**: michael-pc
+**Config File**: `/home/michael/dev/michaelschiemer/deployment/ansible/wireguard/configs/michael-pc.conf`
+**Client IP**: 10.8.0.2/32
+**Server Endpoint**: 94.16.110.151:51820
+**VPN Network**: 10.8.0.0/24
+
+---
+
+## Import auf verschiedenen Plattformen
+
+### Linux (Ubuntu/Debian)
+
+```bash
+# 1. Konfiguration nach /etc/wireguard/ kopieren
+sudo cp /home/michael/dev/michaelschiemer/deployment/ansible/wireguard/configs/michael-pc.conf /etc/wireguard/
+
+# 2. Berechtigungen setzen
+sudo chmod 600 /etc/wireguard/michael-pc.conf
+
+# 3. VPN-Verbindung starten
+sudo wg-quick up michael-pc
+
+# 4. Status prüfen
+sudo wg show michael-pc
+
+# 5. Bei Boot automatisch starten (optional)
+sudo systemctl enable wg-quick@michael-pc
+```
+
+**Verbindung trennen**:
+```bash
+sudo wg-quick down michael-pc
+```
+
+---
+
+### macOS
+
+```bash
+# 1. WireGuard installieren (falls nicht vorhanden)
+brew install wireguard-tools
+
+# 2. Konfiguration importieren
+sudo cp /home/michael/dev/michaelschiemer/deployment/ansible/wireguard/configs/michael-pc.conf /etc/wireguard/
+
+# 3. VPN starten
+sudo wg-quick up michael-pc
+
+# 4. Status prüfen
+sudo wg show michael-pc
+```
+
+**Alternative**: WireGuard GUI App für macOS verwenden
+- Download: https://apps.apple.com/app/wireguard/id1451685025
+- "Add Tunnel from File" → `michael-pc.conf` auswählen
+- Verbindung aktivieren
+
+---
+
+### Windows
+
+**Via WireGuard GUI** (empfohlen):
+
+1. **WireGuard GUI installieren**:
+   - Download: https://www.wireguard.com/install/
+   - Installer ausführen
+
+2. **Konfiguration importieren**:
+   - WireGuard GUI öffnen
+   - "Import tunnel(s) from file"
+   - `michael-pc.conf` auswählen
+
+3. **Verbindung aktivieren**:
+   - Tunnel "michael-pc" in der Liste anklicken
+   - "Activate" Button drücken
+
+4. **Status prüfen**:
+   - Status sollte "Active" zeigen
+   - Transfer-Statistiken werden angezeigt
+
+---
+
+### Android
+
+**Via WireGuard App**:
+
+1. **WireGuard App installieren**:
+   - Google Play Store: "WireGuard"
+
+2. **Konfiguration importieren**:
+   - Option 1: `michael-pc.conf` auf Gerät übertragen und importieren
+   - Option 2: QR Code scannen (falls generiert)
+
+3. **Verbindung aktivieren**:
+   - Tunnel antippen
+   - Toggle aktivieren
+
+---
+
+### iOS
+
+**Via WireGuard App**:
+
+1. **WireGuard App installieren**:
+   - App Store: "WireGuard"
+
+2. **Konfiguration importieren**:
+   - Option 1: `michael-pc.conf` via AirDrop/iCloud übertragen
+   - Option 2: QR Code scannen (falls generiert)
+
+3. **Verbindung aktivieren**:
+   - Tunnel antippen
+   - Toggle aktivieren
+
+---
+
+## Konnektivitätstest
+
+Nach erfolgreicher Verbindung:
+
+### 1. VPN Gateway Ping
+
+```bash
+ping 10.8.0.1
+```
+
+**Erwartete Ausgabe**:
+```
+PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
+64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=1.23 ms
+64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=1.15 ms
+```
+
+✅ **Erfolg**: VPN-Verbindung funktioniert
+
+---
+
+### 2. Admin Services Zugriff
+
+**Traefik Dashboard** (HTTPS):
+```bash
+curl -k https://10.8.0.1:8080
+```
+
+**Prometheus** (HTTP):
+```bash
+curl http://10.8.0.1:9090
+```
+
+**Grafana** (HTTPS):
+```bash
+curl -k https://10.8.0.1:3001
+```
+
+**Portainer** (HTTP):
+```bash
+curl http://10.8.0.1:9000
+```
+
+**Redis Insight** (HTTP):
+```bash
+curl http://10.8.0.1:8001
+```
+
+**Browser-Zugriff**:
+- Traefik: https://10.8.0.1:8080
+- Prometheus: http://10.8.0.1:9090
+- Grafana: https://10.8.0.1:3001
+- Portainer: http://10.8.0.1:9000
+- Redis Insight: http://10.8.0.1:8001
+
+---
+
+## Troubleshooting
+
+### Problem: Keine Verbindung zum Server
+
+**Symptome**:
+- `ping 10.8.0.1` timeout
+- WireGuard Status zeigt "Handshake failed"
+
+**Lösungen**:
+
+1. **Server Endpoint prüfen**:
+   ```bash
+   # Prüfe ob Server erreichbar ist
+   ping 94.16.110.151
+
+   # Prüfe ob Port 51820 offen ist
+   nc -zvu 94.16.110.151 51820
+   ```
+
+2. **Firewall auf Server prüfen**:
+   ```bash
+   # Auf Server ausführen
+   sudo nft list ruleset | grep 51820
+   ```
+
+3. **WireGuard Server Status prüfen**:
+   ```bash
+   # Auf Server ausführen
+   sudo systemctl status wg-quick@wg0
+   sudo wg show wg0
+   ```
+
+---
+
+### Problem: VPN verbindet, aber kein Zugriff auf Admin Services
+
+**Symptome**:
+- `ping 10.8.0.1` funktioniert
+- `curl http://10.8.0.1:9090` timeout
+
+**Lösungen**:
+
+1. **Routing prüfen**:
+   ```bash
+   # Auf Client
+   ip route | grep 10.8.0
+   ```
+
+2. **Firewall-Rules auf Server prüfen**:
+   ```bash
+   # Auf Server
+   sudo nft list table inet wireguard_firewall
+   ```
+
+3. **Service-Status prüfen**:
+   ```bash
+   # Auf Server - Services sollten laufen
+   docker ps | grep prometheus
+   docker ps | grep grafana
+   ```
+
+---
+
+### Problem: DNS funktioniert nicht
+
+**Symptome**:
+- Kann keine Domains auflösen
+
+**Lösung**:
+```bash
+# DNS-Server in Client-Config prüfen
+grep DNS /etc/wireguard/michael-pc.conf
+# Sollte sein: DNS = 1.1.1.1, 8.8.8.8
+
+# DNS-Resolver testen
+nslookup google.com 1.1.1.1
+```
+
+---
+
+### Problem: Verbindung bricht ständig ab
+
+**Symptome**:
+- Verbindung disconnected nach einigen Minuten
+
+**Lösungen**:
+
+1. **PersistentKeepalive prüfen**:
+   ```bash
+   grep PersistentKeepalive /etc/wireguard/michael-pc.conf
+   # Sollte sein: PersistentKeepalive = 25
+   ```
+
+2. **NAT/Router-Timeout**:
+   - PersistentKeepalive verhindert NAT-Timeout
+   - Wert auf 25 Sekunden gesetzt
+
+---
+
+## Firewall-Validierung
+
+### Public Access sollte blockiert sein
+
+**Von außerhalb des VPNs testen** (z.B. vom Internet):
+
+```bash
+# Diese Requests sollten FEHLSCHLAGEN (timeout oder connection refused):
+curl --max-time 5 http://94.16.110.151:9090  # Prometheus
+curl --max-time 5 http://94.16.110.151:8080  # Traefik Dashboard
+curl --max-time 5 http://94.16.110.151:9000  # Portainer
+
+# Nur Public Services sollten erreichbar sein:
+curl http://94.16.110.151:80                  # HTTP (funktioniert)
+curl https://94.16.110.151:443                # HTTPS (funktioniert)
+```
+
+**Erwartetes Ergebnis**:
+- ❌ Admin-Ports (8080, 9090, 3001, 9000, 8001): Timeout oder Connection Refused
+- ✅ Public-Ports (80, 443): Erreichbar
+
+### Firewall-Logs prüfen
+
+**Auf Server**:
+```bash
+# Geblockte Zugriffe auf Admin-Services loggen
+sudo journalctl -k | grep "BLOCKED_ADMIN_SERVICE"
+
+# Beispiel-Ausgabe:
+# [  123.456] BLOCKED_ADMIN_SERVICE: IN=eth0 OUT= SRC=203.0.113.42 DST=94.16.110.151 PROTO=TCP DPT=8080
+```
+
+---
+
+## Sicherheitshinweise
+
+### ✅ Best Practices
+
+1. **Private Keys schützen**:
+   - Niemals Private Keys committen oder teilen
+   - Berechtigungen: `chmod 600` für .conf Dateien
+
+2. **Regelmäßige Key-Rotation**:
+   - Empfohlen: Jährlich neue Keys generieren
+   - Bei Kompromittierung: Sofort neue Keys erstellen
+
+3. **Client-Zugriff widerrufen**:
+   ```bash
+   # Auf Server: Peer aus Konfiguration entfernen
+   sudo nano /etc/wireguard/wg0.conf
+   # [Peer]-Block für michael-pc entfernen
+
+   # WireGuard neu laden
+   sudo wg syncconf wg0 <(wg-quick strip wg0)
+   ```
+
+4. **VPN-Monitoring**:
+   ```bash
+   # Aktive Verbindungen prüfen
+   sudo wg show wg0
+
+   # Letzte Handshake-Zeit prüfen
+   sudo wg show wg0 latest-handshakes
+   ```
+
+---
+
+## Nächste Schritte
+
+Nach erfolgreicher VPN-Verbindung:
+
+1. ✅ **VPN-Zugriff verifizieren**: Gateway ping + Admin Services Zugriff
+2. ✅ **Firewall-Rules validieren**: Public Access blockiert, VPN Access erlaubt
+3. ⏭️ **Weitere Clients hinzufügen** (optional):
+   ```bash
+   ansible-playbook playbooks/generate-wireguard-client.yml -e "client_name=laptop"
+   ansible-playbook playbooks/generate-wireguard-client.yml -e "client_name=phone"
+   ```
+
+4. ⏭️ **Backup der Client-Configs**:
+   ```bash
+   # Configs sind in .gitignore - manuelles Backup notwendig
+   tar -czf wireguard-client-configs-backup-$(date +%Y%m%d).tar.gz \
+     /home/michael/dev/michaelschiemer/deployment/ansible/wireguard/configs/
+   ```
+
+---
+
+**Erstellt**: 2025-11-05
+**Client Config**: michael-pc (10.8.0.2/32)
+**Server Endpoint**: 94.16.110.151:51820
+**VPN Network**: 10.8.0.0/24
--- a/deployment/wireguard/INDEX.md
+++ b/deployment/wireguard/INDEX.md
@@ -0,0 +1,259 @@
+# WireGuard Setup - Dokumentations-Index
+
+Kompletter Index aller Dokumentation und Scripts für das minimalistic WireGuard Setup.
+
+## 📚 Dokumentation
+
+### Haupt-Dokumentation
+
+| Datei | Zweck | Zielgruppe |
+|-------|-------|------------|
+| **README.md** | Vollständige Dokumentation mit Architektur, Setup, Troubleshooting | Alle Nutzer |
+| **QUICKSTART.md** | 5-Minuten Quick Start Guide | Neue Nutzer |
+| **INSTALLATION-LOG.md** | Schritt-für-Schritt Installations-Log | Systemadministratoren |
+| **INDEX.md** (diese Datei) | Übersicht aller Dateien | Navigation |
+
+### Client-Dokumentation
+
+| Datei | Zweck |
+|-------|-------|
+| **configs/README.md** | Client Config Verzeichnis Dokumentation und Sicherheitshinweise |
+| **configs/.gitignore** | Verhindert Commit von sensitiven Client Configs |
+
+## 🛠️ Scripts
+
+### Setup Scripts
+
+| Script | Zweck | Ausführung |
+|--------|-------|------------|
+| **scripts/manual-wireguard-setup.sh** | Manuelles Setup-Script für Host-Installation | `sudo ./manual-wireguard-setup.sh` |
+| **scripts/generate-client-config.sh** | Client Config Generator mit QR Codes | `sudo ./generate-client-config.sh <client-name>` |
+| **scripts/cleanup-old-wireguard.sh** | Cleanup des alten Docker-basierten Setups | `sudo ./cleanup-old-wireguard.sh` |
+
+### Ansible Automation
+
+| Datei | Zweck |
+|-------|-------|
+| **ansible/playbooks/setup-wireguard-host.yml** | Vollständiges Ansible Playbook für automatisches Deployment |
+| **ansible/templates/wg0.conf.j2** | WireGuard Server Config Template |
+| **ansible/templates/wireguard-host-firewall.nft.j2** | nftables Firewall Rules Template |
+
+## 🚀 Quick Start - Welche Datei nutzen?
+
+### Für Anfänger: QUICKSTART.md
+```bash
+cat deployment/wireguard/QUICKSTART.md
+```
+- 5-Minuten Setup
+- Einfache Schritt-für-Schritt Anleitung
+- Für Linux, Windows, macOS, iOS, Android
+
+### Für Erfahrene: README.md
+```bash
+cat deployment/wireguard/README.md
+```
+- Vollständige Architektur-Übersicht
+- Detaillierte Konfigurationsoptionen
+- Troubleshooting-Guide
+- Sicherheits-Best-Practices
+
+### Für Automatisierung: Ansible
+```bash
+cd deployment/ansible
+ansible-playbook playbooks/setup-wireguard-host.yml
+```
+- Vollautomatisches Deployment
+- Idempotent und wiederholbar
+- Backup und Rollback-Support
+
+### Für manuelle Installation: manual-wireguard-setup.sh
+```bash
+cd deployment/scripts
+sudo ./manual-wireguard-setup.sh
+```
+- Interaktives Setup
+- Zeigt alle Schritte
+- Verifikation nach jedem Schritt
+
+## 📋 Installations-Workflow
+
+### Methode 1: Automatisiert (Empfohlen)
+
+```bash
+# 1. Cleanup altes Setup (falls vorhanden)
+cd deployment/scripts
+sudo ./cleanup-old-wireguard.sh
+
+# 2. Automatisches Deployment
+cd ../ansible
+ansible-playbook playbooks/setup-wireguard-host.yml
+
+# 3. Client Config generieren
+cd ../scripts
+sudo ./generate-client-config.sh michael-laptop
+
+# 4. Client verbinden und testen
+# (Siehe QUICKSTART.md)
+```
+
+### Methode 2: Manuell
+
+```bash
+# 1. Setup-Script ausführen
+cd deployment/scripts
+sudo ./manual-wireguard-setup.sh
+
+# 2. INSTALLATION-LOG.md durchgehen
+cat ../wireguard/INSTALLATION-LOG.md
+
+# 3. Client Config generieren
+sudo ./generate-client-config.sh michael-laptop
+
+# 4. Client verbinden und testen
+# (Siehe QUICKSTART.md)
+```
+
+## 🔍 Nach Installation
+
+### Verifikation
+
+```bash
+# WireGuard Status
+sudo wg show wg0
+
+# Service Status
+sudo systemctl status wg-quick@wg0
+
+# Firewall Rules
+sudo nft list table inet wireguard_firewall
+
+# IP Forwarding
+cat /proc/sys/net/ipv4/ip_forward
+```
+
+### Client Zugriff testen
+
+Nach VPN-Verbindung:
+
+```bash
+# VPN-Gateway ping
+ping 10.8.0.1
+
+# Admin Services
+curl -k https://10.8.0.1:8080  # Traefik Dashboard
+curl http://10.8.0.1:9090      # Prometheus
+curl https://10.8.0.1:3001     # Grafana
+curl http://10.8.0.1:9000      # Portainer
+curl http://10.8.0.1:8001      # Redis Insight
+```
+
+## 🛡️ Sicherheit
+
+### Vor Deployment lesen
+
+1. **README.md → Security Architecture**
+   - Defense in Depth Strategie
+   - Zero Trust Network Prinzipien
+   - Moderne Kryptographie
+
+2. **README.md → Security Best Practices**
+   - Key Rotation
+   - Client Config Sicherung
+   - Firewall Monitoring
+
+3. **configs/.gitignore**
+   - Client Configs NIEMALS committen
+   - Private Keys schützen
+
+## 📊 Monitoring & Troubleshooting
+
+### Logs überwachen
+
+```bash
+# WireGuard Service Logs
+sudo journalctl -u wg-quick@wg0 -f
+
+# Firewall Block Logs
+sudo journalctl -k | grep "BLOCKED"
+
+# System Logs
+sudo dmesg | grep wireguard
+```
+
+### Häufige Probleme
+
+Siehe **README.md → Troubleshooting Section** für:
+- Connection refused
+- Firewall blockiert Zugriff
+- Routing-Probleme
+- Performance-Issues
+
+## 🔄 Wartung
+
+### Regelmäßige Tasks
+
+```bash
+# Client Config generieren (neue Geräte)
+cd deployment/scripts
+sudo ./generate-client-config.sh <device-name>
+
+# Client revoken
+# (Siehe README.md → Revoke Client Access)
+
+# Backup durchführen
+tar -czf wireguard-backup-$(date +%Y%m%d).tar.gz /etc/wireguard/
+
+# Firewall Rules updaten
+# (Siehe README.md → Firewall Configuration)
+```
+
+### Updates
+
+```bash
+# WireGuard Update
+sudo apt update && sudo apt upgrade wireguard wireguard-tools
+
+# Konfiguration reload
+sudo systemctl reload wg-quick@wg0
+
+# Oder restart
+sudo systemctl restart wg-quick@wg0
+```
+
+## 📖 Weitere Ressourcen
+
+### Externe Dokumentation
+
+- [WireGuard Official Docs](https://www.wireguard.com/)
+- [nftables Wiki](https://wiki.nftables.org/)
+- [systemd Documentation](https://www.freedesktop.org/software/systemd/man/)
+
+### Framework Integration
+
+- **Event System**: WireGuard-Events können über Framework Event System geloggt werden
+- **Monitoring**: Integration mit Framework Performance Monitoring
+- **Alerts**: Benachrichtigungen bei VPN-Problemen über Framework Alert System
+
+## 🎯 Nächste Schritte (Phase 2 - Optional)
+
+Falls DNS gewünscht:
+
+1. **CoreDNS Minimal Setup**
+   - Siehe User's CoreDNS Konfigurationsbeispiel
+   - Integration mit WireGuard
+   - `.internal` Domain für Services
+
+2. **Service Discovery**
+   - Automatische DNS-Einträge für Docker Services
+   - Load Balancing über DNS
+
+3. **Monitoring**
+   - DNS Query Logs
+   - Performance Metriken
+
+---
+
+**Erstellt**: 2025-11-05
+**Framework Version**: 2.x
+**WireGuard Version**: 1.0.20210914
+**Zielplattform**: Debian/Ubuntu Linux mit systemd
--- a/deployment/wireguard/INSTALLATION-LOG.md
+++ b/deployment/wireguard/INSTALLATION-LOG.md
@@ -0,0 +1,275 @@
+# WireGuard Installation Log
+
+Dokumentation der manuellen WireGuard Installation auf dem Host-System.
+
+## Systemumgebung
+
+```bash
+# System prüfen
+uname -a
+# Linux hostname 6.6.87.2-microsoft-standard-WSL2 #1 SMP ...
+
+# WireGuard Version
+wg --version
+# wireguard-tools v1.0.20210914
+
+# Netzwerk Interface
+ip addr show
+# Haupt-Interface für WAN: eth0
+```
+
+## Installation durchgeführt am
+
+**Datum**: [WIRD BEIM AUSFÜHREN GESETZT]
+**Benutzer**: root (via sudo)
+**Methode**: Manual Setup Script
+
+## Installationsschritte
+
+### ✅ Schritt 1: Verzeichnis erstellen
+
+```bash
+sudo mkdir -p /etc/wireguard
+sudo chmod 700 /etc/wireguard
+```
+
+**Status**: Bereit für Ausführung
+**Zweck**: Sicheres Verzeichnis für WireGuard-Konfiguration
+
+### ✅ Schritt 2: Server Keys generieren
+
+```bash
+cd /etc/wireguard
+sudo wg genkey | sudo tee server_private.key | sudo wg pubkey | sudo tee server_public.key
+sudo chmod 600 server_private.key
+sudo chmod 644 server_public.key
+```
+
+**Status**: Bereit für Ausführung
+**Zweck**: Kryptographische Schlüssel für Server generieren
+**Ausgabe**:
+- `server_private.key` - Privater Schlüssel (geheim!)
+- `server_public.key` - Öffentlicher Schlüssel (für Clients)
+
+### ✅ Schritt 3: WireGuard Konfiguration erstellen
+
+**Datei**: `/etc/wireguard/wg0.conf`
+
+```ini
+[Interface]
+# Server Configuration
+PrivateKey = [GENERATED_SERVER_PRIVATE_KEY]
+Address = 10.8.0.1/24
+ListenPort = 51820
+
+# Enable IP forwarding
+PostUp = sysctl -w net.ipv4.ip_forward=1
+
+# NAT Configuration with nftables
+PostUp = nft add table inet wireguard
+PostUp = nft add chain inet wireguard postrouting { type nat hook postrouting priority srcnat\; }
+PostUp = nft add rule inet wireguard postrouting oifname "eth0" ip saddr 10.8.0.0/24 masquerade
+
+# Cleanup on shutdown
+PostDown = nft delete table inet wireguard
+
+# Peers will be added here via generate-client-config.sh
+```
+
+**Status**: Template erstellt
+**Permissions**: `chmod 600 /etc/wireguard/wg0.conf`
+
+### ✅ Schritt 4: nftables Firewall Rules
+
+**Datei**: `/etc/nftables.d/wireguard.nft`
+
+Features:
+- VPN Network Set: `10.8.0.0/24`
+- Admin Service Ports: `8080, 9090, 3001, 9000, 8001`
+- Public Service Ports: `80, 443, 22`
+- Rate Limiting für SSH: `10/minute`
+- Logging für blockierte Zugriffe
+
+**Status**: Template erstellt
+**Anwendung**: `sudo nft -f /etc/nftables.d/wireguard.nft`
+
+### ✅ Schritt 5: IP Forwarding aktivieren
+
+```bash
+echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-wireguard.conf
+sudo sysctl -p /etc/sysctl.d/99-wireguard.conf
+```
+
+**Status**: Bereit für Ausführung
+**Zweck**: Ermöglicht Paket-Weiterleitung zwischen VPN und Host-Netzwerk
+
+### ✅ Schritt 6: WireGuard Service aktivieren
+
+```bash
+sudo systemctl enable wg-quick@wg0
+sudo systemctl start wg-quick@wg0
+```
+
+**Status**: Bereit für Ausführung
+**Zweck**: WireGuard als systemd Service starten und bei Boot aktivieren
+
+## Verifikation
+
+### WireGuard Status prüfen
+
+```bash
+sudo wg show wg0
+# Erwartete Ausgabe:
+# interface: wg0
+#   public key: [SERVER_PUBLIC_KEY]
+#   private key: (hidden)
+#   listening port: 51820
+```
+
+### Service Status prüfen
+
+```bash
+sudo systemctl status wg-quick@wg0
+# Erwartete Ausgabe:
+# ● wg-quick@wg0.service - WireGuard via wg-quick(8) for wg0
+#    Loaded: loaded
+#    Active: active (exited) since ...
+```
+
+### nftables Rules prüfen
+
+```bash
+sudo nft list table inet wireguard_firewall
+# Sollte alle Rules anzeigen
+```
+
+### Netzwerk-Konnektivität prüfen
+
+```bash
+# Interface prüfen
+ip addr show wg0
+# Sollte 10.8.0.1/24 zeigen
+
+# Routing prüfen
+ip route | grep wg0
+# Sollte Route für 10.8.0.0/24 zeigen
+
+# Firewall prüfen
+sudo nft list ruleset | grep wireguard
+```
+
+## Nächste Schritte
+
+### 1. Client-Konfiguration generieren
+
+```bash
+cd /home/michael/dev/michaelschiemer/deployment/scripts
+sudo ./generate-client-config.sh michael-laptop
+```
+
+### 2. Client-Config importieren
+
+- **Linux/macOS**: Copy `.conf` file to `/etc/wireguard/`
+- **Windows**: Import via WireGuard GUI
+- **iOS/Android**: Scan QR code
+
+### 3. Verbindung testen
+
+```bash
+# Vom Client aus:
+ping 10.8.0.1
+
+# Admin-Services testen:
+curl -k https://10.8.0.1:8080  # Traefik Dashboard
+curl http://10.8.0.1:9090      # Prometheus
+```
+
+## Troubleshooting
+
+### WireGuard startet nicht
+
+```bash
+# Logs prüfen
+sudo journalctl -u wg-quick@wg0 -f
+
+# Konfiguration prüfen
+sudo wg-quick up wg0
+```
+
+### Keine Verbindung möglich
+
+```bash
+# Port prüfen
+sudo ss -ulnp | grep 51820
+
+# Firewall prüfen
+sudo nft list ruleset | grep 51820
+
+# IP Forwarding prüfen
+cat /proc/sys/net/ipv4/ip_forward
+# Sollte "1" sein
+```
+
+### Client kann keine Admin-Services erreichen
+
+```bash
+# nftables Rules prüfen
+sudo nft list table inet wireguard_firewall
+
+# VPN-Routing prüfen
+ip route show table main | grep wg0
+
+# NAT prüfen
+sudo nft list chain inet wireguard postrouting
+```
+
+## Rollback-Prozedur
+
+Falls etwas schiefgeht:
+
+```bash
+# WireGuard stoppen
+sudo systemctl stop wg-quick@wg0
+sudo systemctl disable wg-quick@wg0
+
+# nftables Rules entfernen
+sudo nft delete table inet wireguard_firewall
+sudo nft delete table inet wireguard
+
+# Konfiguration entfernen
+sudo rm -rf /etc/wireguard/*
+sudo rm /etc/nftables.d/wireguard.nft
+
+# IP Forwarding zurücksetzen
+sudo rm /etc/sysctl.d/99-wireguard.conf
+sudo sysctl -p
+```
+
+## Sicherheitshinweise
+
+- ✅ Private Keys niemals committen oder teilen
+- ✅ Regelmäßige Key-Rotation (empfohlen: jährlich)
+- ✅ Client-Configs nach Generierung sicher speichern
+- ✅ Firewall-Logs regelmäßig überprüfen
+- ✅ VPN-Zugriffe monitoren
+
+## Performance-Metriken
+
+Nach Installation zu überwachen:
+
+- CPU-Auslastung: WireGuard ist sehr effizient (<5% bei normaler Last)
+- Netzwerk-Durchsatz: Nahezu Leitungsgeschwindigkeit
+- Latenz: Minimal (+1-2ms Overhead)
+- Speicher: ~10MB RAM für WireGuard-Prozess
+
+## Status
+
+**Installation Status**: ⏳ BEREIT FÜR AUSFÜHRUNG
+
+**Nächster Schritt**: Script ausführen mit:
+```bash
+cd /home/michael/dev/michaelschiemer/deployment/scripts
+sudo ./manual-wireguard-setup.sh
+```
+
+**Oder manuell durchführen**: Jeden Schritt einzeln wie oben dokumentiert ausführen.
--- a/deployment/wireguard/QUICKSTART.md
+++ b/deployment/wireguard/QUICKSTART.md
@@ -0,0 +1,194 @@
+# WireGuard VPN - Quick Start Guide
+
+Minimalistisches Host-based WireGuard Setup in 5 Minuten.
+
+## Prerequisites
+
+- Debian/Ubuntu Server mit Root-Zugriff
+- Public IP oder DynDNS
+- Ports 51820/udp offen in Firewall/Router
+
+## Installation (Server)
+
+### Option 1: Automated (Ansible) - Empfohlen
+
+```bash
+# 1. Cleanup altes Docker-Setup (falls vorhanden)
+cd /home/michael/dev/michaelschiemer/deployment/scripts
+sudo ./cleanup-old-wireguard.sh
+
+# 2. Deploy WireGuard Host-based
+cd /home/michael/dev/michaelschiemer/deployment/ansible
+ansible-playbook playbooks/setup-wireguard-host.yml
+
+# 3. Verify Installation
+sudo wg show wg0
+sudo systemctl status wg-quick@wg0
+```
+
+### Option 2: Manual Installation
+
+```bash
+# Install WireGuard
+sudo apt update
+sudo apt install wireguard wireguard-tools qrencode nftables
+
+# Generate Server Keys
+cd /etc/wireguard
+sudo wg genkey | sudo tee server_private.key | wg pubkey | sudo tee server_public.key
+
+# Create Config (replace YOUR_SERVER_IP)
+sudo tee /etc/wireguard/wg0.conf <<EOF
+[Interface]
+PrivateKey = $(sudo cat server_private.key)
+Address = 10.8.0.1/24
+ListenPort = 51820
+PostUp = sysctl -w net.ipv4.ip_forward=1
+EOF
+
+# Enable and Start
+sudo systemctl enable wg-quick@wg0
+sudo systemctl start wg-quick@wg0
+
+# Apply Firewall
+# See: deployment/ansible/templates/wireguard-host-firewall.nft.j2
+```
+
+## Client Setup
+
+### Generate Client Config
+
+```bash
+# On server
+cd /home/michael/dev/michaelschiemer/deployment/scripts
+sudo ./generate-client-config.sh michael-laptop
+
+# Script outputs:
+# - Config file: ../wireguard/configs/michael-laptop.conf
+# - QR code (text): ../wireguard/configs/michael-laptop.qr.txt
+# - QR code (PNG): ../wireguard/configs/michael-laptop.qr.png
+```
+
+### Import on Client
+
+**Linux/macOS:**
+```bash
+# Copy config to client
+scp server:/path/to/michael-laptop.conf /etc/wireguard/
+
+# Connect
+sudo wg-quick up michael-laptop
+
+# Verify
+ping 10.8.0.1
+curl -k https://10.8.0.1:8080  # Traefik Dashboard
+```
+
+**Windows:**
+1. Download WireGuard from https://www.wireguard.com/install/
+2. Open WireGuard GUI
+3. Click "Import tunnel(s) from file"
+4. Select `michael-laptop.conf`
+5. Click "Activate"
+
+**iOS/Android:**
+1. Install WireGuard app from App Store/Play Store
+2. Tap "+" → "Create from QR code"
+3. Scan QR code (shown in terminal or PNG file)
+4. Tap "Activate"
+
+## Service Access
+
+Nach VPN-Verbindung sind folgende Services erreichbar:
+
+| Service | URL | Purpose |
+|---------|-----|---------|
+| Traefik Dashboard | https://10.8.0.1:8080 | Reverse Proxy Management |
+| Prometheus | http://10.8.0.1:9090 | Metrics Collection |
+| Grafana | https://10.8.0.1:3001 | Monitoring Dashboards |
+| Portainer | http://10.8.0.1:9000 | Docker Management |
+| Redis Insight | http://10.8.0.1:8001 | Redis Debugging |
+
+## Verification
+
+```bash
+# On Client after connecting VPN
+
+# Test VPN connectivity
+ping 10.8.0.1
+
+# Test service access
+curl -k https://10.8.0.1:8080  # Traefik Dashboard (should return HTML)
+curl http://10.8.0.1:9090      # Prometheus (should return HTML)
+
+# Check routing
+ip route | grep 10.8.0.0
+
+# Verify WireGuard interface
+sudo wg show
+```
+
+## Troubleshooting
+
+### Cannot connect to VPN
+
+```bash
+# On Server
+sudo wg show wg0              # Check if interface exists
+sudo systemctl status wg-quick@wg0  # Check if service running
+sudo ss -ulnp | grep 51820    # Check if listening on port
+
+# Check firewall allows WireGuard port
+sudo nft list ruleset | grep 51820
+
+# View logs
+sudo journalctl -u wg-quick@wg0 -f
+```
+
+### VPN connected but cannot access services
+
+```bash
+# On Client
+ping 10.8.0.1  # Should work
+
+# On Server
+sudo nft list ruleset | grep "10.8.0.0"  # Check VPN network allowed
+
+# Check service is listening
+sudo ss -tlnp | grep 8080  # Traefik Dashboard
+sudo docker ps             # Check containers running
+```
+
+### Slow connection
+
+```bash
+# Check MTU settings (on client)
+sudo wg show michael-laptop
+
+# Try reducing MTU if packet loss
+# Edit config: MTU = 1420 (in [Interface] section)
+```
+
+## Security
+
+- ✅ All admin services **only** accessible via VPN
+- ✅ Public ports limited to 80, 443, 22
+- ✅ Modern crypto (ChaCha20, Poly1305)
+- ✅ Preshared keys for quantum resistance
+- ✅ nftables firewall with explicit rules
+
+## Next Steps
+
+- [ ] Add more clients: `sudo ./generate-client-config.sh <device-name>`
+- [ ] Setup monitoring alerts for VPN
+- [ ] Optional: Add minimal CoreDNS for `.internal` domains
+- [ ] Schedule key rotation (recommended: annually)
+
+## Support
+
+Full documentation: `deployment/wireguard/README.md`
+
+For issues, check:
+- `sudo journalctl -u wg-quick@wg0`
+- `sudo dmesg | grep wireguard`
+- `sudo nft list ruleset`
--- a/deployment/wireguard/README.md
+++ b/deployment/wireguard/README.md
@@ -0,0 +1,352 @@
+# Minimalistic WireGuard VPN Setup
+
+**Purpose**: Secure admin access to internal services (Traefik Dashboard, Prometheus, Grafana, etc.)
+
+**Architecture**: Host-based WireGuard with IP-based service access (no DNS required)
+
+## Overview
+
+```
+Public Internet
+    ↓
+┌─────────────────────────────────────────┐
+│ Server (Public IP)                      │
+│                                         │
+│ Public Ports:                           │
+│   80/443  → Traefik (Public Apps)       │
+│   22      → SSH                         │
+│   51820   → WireGuard                   │
+│                                         │
+│ VPN Network (10.8.0.0/24):              │
+│   10.8.0.1 → Server (VPN Gateway)       │
+│                                         │
+│ Admin Services (VPN-only):              │
+│   https://10.8.0.1:8080  → Traefik      │
+│   http://10.8.0.1:9090   → Prometheus   │
+│   https://10.8.0.1:3001  → Grafana      │
+│   http://10.8.0.1:9000   → Portainer    │
+│   http://10.8.0.1:8001   → Redis Insight│
+│                                         │
+└─────────────────────────────────────────┘
+```
+
+## Components
+
+### 1. WireGuard (Host-based)
+- **Interface**: wg0
+- **Server IP**: 10.8.0.1/24
+- **Port**: 51820/udp
+- **Management**: systemd + wg-quick
+
+### 2. nftables Firewall
+- **VPN Access**: 10.8.0.0/24 → All admin services
+- **Public Access**: Only ports 80, 443, 22
+- **Default Policy**: DROP all other traffic
+
+### 3. Service Access (IP-based)
+
+| Service | URL | Purpose |
+|---------|-----|---------|
+| Traefik Dashboard | https://10.8.0.1:8080 | Reverse Proxy Management |
+| Prometheus | http://10.8.0.1:9090 | Metrics Collection |
+| Grafana | https://10.8.0.1:3001 | Monitoring Dashboards |
+| Portainer | http://10.8.0.1:9000 | Docker Management |
+| Redis Insight | http://10.8.0.1:8001 | Redis Debugging |
+
+## Quick Start
+
+### Server Setup (Automated)
+
+```bash
+# Deploy WireGuard + Firewall
+cd deployment/ansible
+ansible-playbook playbooks/setup-wireguard-host.yml
+```
+
+### Client Setup
+
+```bash
+# Generate new client config
+cd deployment/scripts
+./generate-client-config.sh michael-laptop
+
+# Import config (Linux/macOS)
+sudo wg-quick up ./configs/michael-laptop.conf
+
+# Import config (Windows)
+# 1. Open WireGuard GUI
+# 2. Import Tunnel from File
+# 3. Select ./configs/michael-laptop.conf
+
+# Import config (iOS/Android)
+# Scan QR code generated by script
+```
+
+### Verify Connection
+
+```bash
+# Check VPN connection
+ping 10.8.0.1
+
+# Access Traefik Dashboard
+curl -k https://10.8.0.1:8080
+```
+
+## Manual Server Setup
+
+If you prefer manual installation:
+
+### 1. Install WireGuard
+
+```bash
+# Ubuntu/Debian
+sudo apt update
+sudo apt install wireguard wireguard-tools qrencode
+
+# Check kernel module
+sudo modprobe wireguard
+lsmod | grep wireguard
+```
+
+### 2. Generate Server Keys
+
+```bash
+# Create config directory
+sudo mkdir -p /etc/wireguard
+cd /etc/wireguard
+
+# Generate keys
+umask 077
+wg genkey | tee server_private.key | wg pubkey > server_public.key
+
+# Save keys
+SERVER_PRIVATE_KEY=$(cat server_private.key)
+SERVER_PUBLIC_KEY=$(cat server_public.key)
+```
+
+### 3. Create Server Config
+
+```bash
+sudo tee /etc/wireguard/wg0.conf <<EOF
+[Interface]
+PrivateKey = $SERVER_PRIVATE_KEY
+Address = 10.8.0.1/24
+ListenPort = 51820
+
+# Firewall: Allow VPN traffic forwarding
+PostUp = nft add table inet wireguard
+PostUp = nft add chain inet wireguard postrouting { type nat hook postrouting priority srcnat\; }
+PostUp = nft add chain inet wireguard forward { type filter hook forward priority filter\; }
+PostUp = nft add rule inet wireguard postrouting oifname "eth0" ip saddr 10.8.0.0/24 masquerade
+PostUp = nft add rule inet wireguard forward iifname "wg0" accept
+PostUp = nft add rule inet wireguard forward oifname "wg0" ct state established,related accept
+
+PostDown = nft delete table inet wireguard
+
+# Peers will be added here
+EOF
+
+# Secure permissions
+sudo chmod 600 /etc/wireguard/wg0.conf
+```
+
+### 4. Enable WireGuard
+
+```bash
+# Enable IP forwarding
+echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.conf
+sudo sysctl -p
+
+# Start WireGuard
+sudo systemctl enable wg-quick@wg0
+sudo systemctl start wg-quick@wg0
+
+# Check status
+sudo wg show
+sudo systemctl status wg-quick@wg0
+```
+
+### 5. Apply Firewall Rules
+
+See `deployment/ansible/templates/wireguard-firewall.nft.j2` for complete firewall configuration.
+
+```bash
+# Allow WireGuard port
+sudo nft add rule inet filter input udp dport 51820 accept
+
+# Allow VPN network to access admin services
+sudo nft add rule inet filter input ip saddr 10.8.0.0/24 tcp dport { 8080, 9090, 3001, 9000, 8001 } accept
+
+# Block public access to admin services
+sudo nft add rule inet filter input tcp dport { 8080, 9090, 3001, 9000, 8001 } drop
+```
+
+## Client Configuration
+
+### Generate Client
+
+```bash
+# Generate client keys
+umask 077
+wg genkey | tee client_private.key | wg pubkey > client_public.key
+wg genpsk > client_preshared.key
+
+CLIENT_PRIVATE_KEY=$(cat client_private.key)
+CLIENT_PUBLIC_KEY=$(cat client_public.key)
+CLIENT_PSK=$(cat client_preshared.key)
+```
+
+### Add Client to Server
+
+```bash
+# Add peer to server config
+sudo tee -a /etc/wireguard/wg0.conf <<EOF
+
+[Peer]
+# michael-laptop
+PublicKey = $CLIENT_PUBLIC_KEY
+PresharedKey = $CLIENT_PSK
+AllowedIPs = 10.8.0.2/32
+EOF
+
+# Reload WireGuard
+sudo systemctl reload wg-quick@wg0
+```
+
+### Create Client Config File
+
+```bash
+# Create client config
+cat > michael-laptop.conf <<EOF
+[Interface]
+PrivateKey = $CLIENT_PRIVATE_KEY
+Address = 10.8.0.2/32
+DNS = 1.1.1.1, 9.9.9.9
+
+[Peer]
+PublicKey = $SERVER_PUBLIC_KEY
+PresharedKey = $CLIENT_PSK
+Endpoint = YOUR_SERVER_IP:51820
+AllowedIPs = 10.8.0.0/24
+PersistentKeepalive = 25
+EOF
+```
+
+## Troubleshooting
+
+### VPN Not Connecting
+
+```bash
+# Check WireGuard status
+sudo wg show
+
+# Check firewall
+sudo nft list ruleset | grep 51820
+
+# Check logs
+sudo journalctl -u wg-quick@wg0 -f
+
+# Test connectivity
+ping 10.8.0.1  # From client
+```
+
+### Cannot Access Services
+
+```bash
+# Verify firewall allows VPN network
+sudo nft list ruleset | grep "10.8.0.0"
+
+# Check service is listening
+sudo ss -tlnp | grep 8080  # Traefik Dashboard
+
+# Test from VPN
+curl -k https://10.8.0.1:8080  # From client
+```
+
+### Key Rotation
+
+Recommended: Rotate keys annually
+
+```bash
+# Generate new server keys
+cd /etc/wireguard
+wg genkey | tee server_private_new.key | wg pubkey > server_public_new.key
+
+# Update server config
+# ... update PrivateKey in wg0.conf
+
+# Regenerate all client configs with new server PublicKey
+# ... update clients
+
+# Restart WireGuard
+sudo systemctl restart wg-quick@wg0
+```
+
+## Security Best Practices
+
+### 1. Strong Cryptography
+- ✅ WireGuard uses modern crypto (ChaCha20, Poly1305, Curve25519)
+- ✅ Preshared keys for quantum resistance
+- ✅ Perfect forward secrecy
+
+### 2. Firewall Isolation
+- ✅ Admin services only accessible via VPN
+- ✅ Explicit ALLOW rules, default DROP
+- ✅ Rate limiting on VPN port (optional)
+
+### 3. Key Management
+- ✅ Private keys never leave server/client
+- ✅ Preshared keys for each peer
+- ✅ Annual key rotation recommended
+
+### 4. Monitoring
+- ✅ Log all VPN connections
+- ✅ Alert on unusual traffic patterns
+- ✅ Regular security audits
+
+## Performance
+
+- **Latency Overhead**: <1ms (kernel-native)
+- **Throughput**: Near-native (minimal encryption overhead)
+- **Concurrent Peers**: 10-20 recommended
+- **Keepalive**: 25 seconds (NAT traversal)
+
+## Maintenance
+
+### Add New Client
+
+```bash
+./deployment/scripts/generate-client-config.sh new-device-name
+```
+
+### Remove Client
+
+```bash
+# Edit server config
+sudo nano /etc/wireguard/wg0.conf
+# Remove [Peer] section
+
+# Reload
+sudo systemctl reload wg-quick@wg0
+```
+
+### Backup Configuration
+
+```bash
+# Backup keys and configs
+sudo tar -czf wireguard-backup-$(date +%Y%m%d).tar.gz /etc/wireguard/
+```
+
+## Next Steps
+
+- [ ] Deploy WireGuard on server
+- [ ] Generate client configs for all devices
+- [ ] Test VPN connectivity
+- [ ] Verify admin service access
+- [ ] Optional: Add minimal CoreDNS for `.internal` domains (Phase 2)
+
+## Support
+
+- **WireGuard Docs**: https://www.wireguard.com/quickstart/
+- **nftables Wiki**: https://wiki.nftables.org/
+- **Framework Issues**: https://github.com/your-repo/issues
--- a/deployment/wireguard/configs/.gitignore
+++ b/deployment/wireguard/configs/.gitignore
@@ -0,0 +1,11 @@
+# WireGuard Client Configurations
+# These contain private keys and should NEVER be committed!
+
+*.conf
+*.key
+*.qr.txt
+*.qr.png
+
+# Allow README
+!README.md
+!.gitignore
--- a/deployment/wireguard/configs/README.md
+++ b/deployment/wireguard/configs/README.md
@@ -0,0 +1,47 @@
+# WireGuard Client Configurations
+
+This directory stores generated client configuration files.
+
+## Security Notice
+
+⚠️ **NEVER commit client configs to Git!**
+
+Client configs contain:
+- Private keys
+- Preshared keys
+- Network topology information
+
+`.gitignore` is configured to exclude all `.conf`, `.key`, `.qr.txt`, and `.qr.png` files.
+
+## Generate New Client
+
+```bash
+cd ../../scripts
+sudo ./generate-client-config.sh <device-name>
+```
+
+Configs will be created here:
+- `<device-name>.conf` - WireGuard configuration
+- `<device-name>.qr.txt` - QR code (ASCII)
+- `<device-name>.qr.png` - QR code (PNG)
+
+## Backup Client Configs
+
+```bash
+# Securely backup configs (encrypted)
+tar -czf - *.conf | gpg --symmetric --cipher-algo AES256 -o wireguard-clients-backup-$(date +%Y%m%d).tar.gz.gpg
+```
+
+## Revoke Client Access
+
+```bash
+# On server
+sudo nano /etc/wireguard/wg0.conf
+# Remove [Peer] section for client
+
+# Reload WireGuard
+sudo systemctl reload wg-quick@wg0
+
+# Delete client config
+rm <device-name>.*
+```