This chapter explores one of the most important steps in the entire infrastructure: the moment when all individual machines — Edge, Home, laptops, mobile devices — were merged into a single private network.

That network became the backbone of the entire architecture. It made everything secure, structured, predictable and future-proof.

At the heart of that design is WireGuard.

1. Why a private backbone was needed

As the number of services grew, several problems became clear:

This led to one principle:

Build a private overlay network.

Route everything through it.

Expose nothing.

WireGuard was the perfect tool.

2. The backbone topology

To keep everything anonymized, this chapter uses alias networks:

The topology:

┌────────────────────┐ │ Public Internet │ └───────────┬────────┘ │ (public IP) Edge VPS WireGuard: 10.A.A.1 │ ┌──────────────┴──────────────┐ │ │ Home Server (10.A.A.3) Clients (10.A.A.x) LAN: 192.B.B.13 Laptop / Phone / Remote

All internal traffic flows through this encrypted mesh.

3. The Edge VPS as the central hub

The Edge VPS — already acting as a secure gateway — became the WireGuard hub.

Why hub-and-spoke?

All peers connect directly to the Edge. The Edge forwards packets only where they belong.

This created a clean design:

Client → Edge → Home Home → Edge → Internet Internet → Edge → Home (through Traefik)

Simple. Elegant. Secure.

4. Routing: how packets flow

The backbone relies on strict routing rules:

🠒 All internal traffic uses WireGuard

🠒 Edge is the forwarding point

🠒 HOME sees clients as local overlay nodes

For example:

Client IP: 10.A.A.4 Home IP: 10.A.A.3 Edge gateway:10.A.A.1

This isolates all flows while keeping the system extremely flexible.

5. Firewall design

The firewall was simplified drastically by using WireGuard:

On EDGE:

On HOME:

On clients:

This created a zero-trust environment with minimal attack surface.

6. Why WireGuard was the right choice

WireGuard delivered exactly what the infrastructure needed:

✔ Lightweight

Runs on VPS, HOME, mobile devices, routers.

✔ Extremely fast

Near-native throughput.

✔ Cryptographically modern

Short key exchange, minimal overhead.

✔ Simple configs

Clear AllowedIPs = clear routing.

✔ Perfect for “overlay architecture”

Internal services stay offline. The tunnel becomes the only path in.

WireGuard became the backbone not by preference, but by necessity.

7. What the backbone enabled

Once the private network was in place, everything else became possible:

The infrastructure became a living organism — linked by a clean, minimal WireGuard spine.

Conclusion

The private backbone transformed the architecture from “collection of servers” into a coherent system.

WireGuard provided:

This is the layer that holds everything together.