Databases don't belong on a public IP
Why WireGuard
WireGuard is small, fast and easy to configure. Each server gets a private address, for example in 10.200.0.0/24.
- Encryption between nodes by default
- Internal ports stay closed from the outside
- Postgres on 5432–5434
- Redis on 6379–6381
- A single open UDP port
The steps
- Generate keys on every node.
- Add the peers to
wg0.conf. - Allow only the private subnet in the firewall.
If a port doesn't need to be public, don't publish it.
The result: the app talks to its databases only through the tunnel.
Published: