WireGuard

WireGuard is how the machines, the offices and the laptops talk to each other: one flat encrypted network, with public keys as the entire identity model.

Why we still choose it

Because the security property that matters most in a VPN is not which ciphers it supports — it is whether anyone has read it. The previous generation of VPN software runs to hundreds of thousands of lines with decades of accumulated negotiation machinery. WireGuard is small enough that reviewing it is a realistic exercise, and it has been reviewed.

One fixed cipher suite means nothing to misconfigure and no downgrade attack. Peers are public keys, like SSH, so revoking a device is deleting a stanza rather than operating a certificate authority. And because it is connectionless and in the kernel, a laptop moving from office wifi to a train keeps its tunnel — which is the thing staff actually notice.

How we run it

Declared in NixOS alongside everything else, with keys held outside the repository. Topology is designed rather than accreted: hub-and-spoke where the peer count justifies it, full mesh where it does not. Services that need a second factor get it at the service, not at the tunnel.

The honest limit

WireGuard is a tunnel and nothing else. There is no user management, no portal, no built-in multi-factor authentication, and key distribution is your problem. Those are all smaller problems than running a certificate authority, but they are not zero, and the operational layer around it is most of what we are actually paid for.