Been in the business a while and business changes, as this happens, you can wind up with two VPS providers in Dallas and a massive AI server, NAS, and dev machine on prem in Austin. Here is a diagram:
The WireGuard domain is a private IP space, cryptographically trusted, much like a AWS Virtual Private Cloud. Than means that nodes in the domain can see the others, connect to them, but no-one outside can see or use them. This gives a single Internet surface, in a different IP space. There are two ports open to the Internet, 80 and 443. This cleans up a ton of system log chatter, as only those on the WireGuard IP space can ssh any other.
You may notice a rather busy list of connections, this is intentional. The two Dallas servers (know each other), so they can direct connect. The Linode does S3/Database, the RackNerd does web server and local cache. The system uses AI Agents, but they are backgrounded in Austin, as it would be insane expensive to run them close to the VM — like we would need to buy rack space and not VPS’s. At that stage, we would slide the whole thing into AWS. Everything is cloud native microservices — and I love me some Kubernetes, so we are ready architecturally, when the day comes.
We have three main benefits, for a few hours of weekend work:
1. Administrative: we really locked down our Internet surface to one IP and two ports — from every server being a surface.
2. Dev wise, the CI/CD and developers can access all of our architecture more easily, in a private IP space — easier and safer.
3. We should be good through our first 1000 concurrent users — and after that, we move to K8s (I cannot wait, it’s what I do in my “day job”).
I did not make this a WireGuard howto — there are plenty good ones around, I was just impressed how fast and cool this was — and it fully supports our next architecture phase. Highly recommend.