Question: wireguard-tunnel not used in production?

[hacklschorsch]

Question: wireguard-tunnel not used in production?

[Ma27]

A management VPN that supports mutual authentication could be handy indeed - any experience on this? Is it reliable?

We're not using TLS for encryption for promtail, but a dedicated WireGuard tunnel for to make sure the traffic is still encrypted.

So basically each node that's sends logs via promtail to loki has the loki-node as peer and the IP of the loki-node in the tunnel is used to send logs. Perhaps we'll publish the code at some point, but that's not our highest priority these days. Closing for now, but let us know if you have further questions :)

[hacklschorsch]

Thanks for your reply! I ended up implementing a Wireguard VPN for monitoring traffic and use it the same way as you describe. Has been working flawless so far, turned out to be a great choice.

Here's our code: NixOs modules for client and server (we use a simple star topology so far) and per-host config to include in morph.