WireGuard (Home1 <-> VIN)

Private link carrying replication, control-plane traffic and agent heartbeats.

Class

tier-0 Fleet-fatal: loss stops the estate or risks data. Everything else waits.

RTO (declared)

15m

RTO (achievable)

15m

RPO

—

State

none

Redundancy

single node

Failover

none

Failure domain

fd-mesh

Health check: handshake-age probe every 90s from both peers — proves the peers have completed a recent handshake. Observed independently of the service.
Blind spot: A recent handshake does not prove throughput. Replication can stall on a link that still handshakes.

Without it: The two domains are partitioned: replication stops, heartbeats stop, and a healthy home rack looks dead from VIN. Both sides keep serving their local clients. This is the failure most likely to be mistaken for a node outage.

• § Accepted risk: The class requires redundancy and there is none. wireguard-tunnel
  WireGuard (Home1 <-> VIN) is single-node but tier-0 requires a redundancy model.
  Accepted by homelab-operator, review 2027-02-15: One WAN path per side. A second path means a second circuit or an LTE failover device — recurring cost against a fleet policy of none. Mitigation is detection, not redundancy: the handshake probe exists so a partition is not misdiagnosed as a dead node.

Full classification and SLOs →