Initial skills documentation — 25 categories, all SKILL.md + references + scripts

2026-07-15 17:42:20 -04:00
commit 1b4fcd4427
976 changed files with 188344 additions and 0 deletions
@@ -0,0 +1,36 @@
+# WireGuard Port Migration (Jul 9, 2026)
+
+During the Jul 9 WG tunnel rebuild, the server port was changed from 51820 to 51821.
+
+## Why
+
+The port was originally 51820. During troubleshooting, the router's WG public key was found to be stale (mismatched with what the server had configured). After fixing the key, the port was also changed because the original 51820 config on the server was a leftover from the Hetzner era that had never been cleanly migrated. Moving to 51821 served two purposes:
+
+1. A clean break from any stale state
+2. The router peer config had endpoint-port=51821 already from app1-bu's old config, so aligning the server to match meant both peers used the same port
+
+## The change
+
+In `/etc/wireguard/wg0.conf`:
+```
+ListenPort = 51821  # was 51820
+Endpoint = 76.195.7.60:13231  # added (router endpoint)
+PersistentKeepalive = 25  # added
+```
+
+UFW rule updated:
+```
+ufw delete allow 51820/udp
+ufw allow 51821/udp comment "WireGuard VPN"
+```
+
+Service restart:
+```
+systemctl restart wg-quick@wg0
+```
+
+The router's peer config endpoint-port was already 51821 (set during earlier troubleshooting).
+
+## Lesson
+
+Don't be afraid to change the WireGuard listen-port during tunnel debugging if there's any chance of stale state. The server's listen-port and the router's peer endpoint-port must match. Verify with `wg show` on server, `/interface/wireguard/peers/print detail` on router.