the mesh, explained
The two data centres behave like one machine because of a single, deliberate piece of engineering: an encrypted WireGuard tunnel. This page explains how it works — properly, but in plain language. Tunnel addresses shown are illustrative.
The two servers sit in different data centres, 100 miles apart, each with its own connection to the internet. WireGuard gives them a second, private network layered on top: each server gets a tunnel address on a network that exists nowhere else in the world. Addresses on this page are illustrative — call them 10.0.0.1 (Coventry) and 10.0.0.2 (Maidenhead).
interface: wg0
address: 10.0.0.1 # coventry
peer: 10.0.0.2 # maidenheadEach server holds a private key that never leaves the machine, and knows the other’s public key. A peer is its keypair: if a packet isn’t sealed by the expected private key, it does not exist as far as WireGuard is concerned — there is no login prompt to attack, no password to guess. To the rest of the internet the tunnel port is silent; unsolicited probes get no reply at all.
peer: srv02
public key: (pinned)
allowed ips: 10.0.0.2/32Roughly every two minutes the peers perform a fresh cryptographic handshake and derive brand-new session keys. This gives the tunnel forward secrecy: even if a key were somehow compromised in the future, previously recorded traffic could not be decrypted. A recent handshake is also the health signal — it means the artery is alive right now.
$ wg show wg0 latest-handshakes
peer srv02 · handshake 47s ago · okEvery packet crossing between the sites is encrypted with ChaCha20-Poly1305 — modern authenticated encryption that both scrambles the data and proves it wasn\u2019t tampered with in transit. The public internet carries the packets, but sees only opaque ciphertext between two endpoints.
transport: chacha20-poly1305
visible to the internet: ciphertext onlyThree kinds of traffic, and only these: the nightly backup pull (Maidenhead reaches across and takes an encrypted copy of the primary), the uptime probes (Maidenhead checks the primary\u2019s health every minute — including the mesh itself), and administration. Management interfaces bind to the tunnel and loopback only; they are simply not present on the public internet.
The mesh isn\u2019t a diagram, it\u2019s a live thing — the monitoring site pings the primary through the tunnel every minute, and that reading is published. The WireGuard Mesh row on the status page is that probe, in real time.
probe: srv02 -> tunnel -> srv01
published: status page · live