VPN access

The VPN puts your laptop inside the cluster network: reach any service directly, no port publishing needed.

Why

Databases, dashboards, and internal APIs shouldn't be on the public internet. With the WireGuard tunnel up, db.shop.svc:5432 and every other ClusterIP service resolves and connects from your machine, DNS included.

Setting up a peer

jekyo vpn add-peer laptop

This creates the peer and writes laptop.conf. Import it into any WireGuard client (the official macOS/Windows/iOS/Android apps, or wg-quick up ./laptop.conf). Then:

psql -h db.shop.svc.cluster.local -U postgres    # straight to the database

Managing peers

jekyo vpn peers            # list, with last-handshake times
jekyo vpn config laptop    # re-download a config
jekyo vpn rm-peer laptop   # revoke access

One peer per person or device: revoking one never affects the others.

Under the hood

The server runs wg-easy on UDP 31820, pushed at install time. Peer management talks to its API through JEKYO. You never need its web UI (though it exists at vpn.<domain> on clusters with a domain; the password is in jekyo context show).