Public HTTPS
This route brings public name, TLS path and application login. Record who accepts that work and how recovery is checked.
Private WireGuard route
This route brings peer management and private addressing. Record its conditions and the person who reviews them.
Four decision axes
| Axis | Question to answer |
|---|---|
| Reachability | Public endpoint or named peer route |
| Authentication | Application roles remain separate |
| Certificate path | Public TLS management or private route design |
| Revocation | Remove a peer or review exposed login |
Illustrative decision record
Illustrative choice: a small internal notes service has named peers and no public-reader requirement. It chooses a private route, assigns peer review to the maintainer and reviews every time a device is replaced.
Conditional outcome
Use the stated trade-off for this choice, assign the named owner and review on the condition described above. It is a planning example, not a service guarantee.