The decision
Record peers, allowed addresses, key owner, service binding and a safe revocation path before adding a private route.
A bounded example
A tunnel is a network route; it does not replace application accounts, permissions, updates or a separate recovery login.
Illustrative peer register
| Peer role | Allowed route | Owner | Revocation action |
|---|---|---|---|
| Primary maintainer device | Private admin range | Named maintainer | Remove its peer after replacement |
| Cover maintainer device | Private admin range | Backup maintainer | Disable peer when cover ends |
This is a planning register, not a configuration file or production command. Check the WireGuard Quick Start for peer, key, endpoint and allowed-IP concepts, then use the version and network design you actually operate.
Checks before change
Keep a recovery route, work on an isolated copy when data is affected, and record observations rather than assumptions. Stop if an acceptance check fails.
Limits
Hoszen does not preinstall or operate applications, hold secrets, verify backups, promise capacity or confirm a payment or VPS delivery.