Nine servers on one private network. Forty-three seconds.

Open the VPN tool on any server — from its card under Setup Packages while the box has no WireGuard yet — and it becomes the first member. Name the network, keep or change the subnet — 10.99.0.0/24 unless you already use it — and check the public address the others will dial. Then drag servers from the tree: one, several, a whole group. Each takes a row and is read as it lands — a box with no shell open is connected with its saved login, or its connect form opens — so you know before anything is written whether a box already has the WireGuard tools or Vigia will install them from its distribution.

There is no peer list to type, no keys to paste between terminals, no file to keep in sync by hand. Eight boxes on the list and nothing has been touched yet: nothing is written until you press Save and build.

One job runs on every box at the same time. A key pair is made on each box and the private half never leaves it — Vigia does not read it, and it is not inside the configuration file either. The public halves are filed, and from then on a box whose key changes stops the job instead of being trusted. Then the interface, lens0, is written with every other member as a peer, brought up and enabled at boot; the firewall lets the members reach each other on 51820/udp; and every tunnel is pinged from both ends. "Done" means every one of them answered.

These nine boxes already had the WireGuard tools. A box that lacks them gets them installed from its own distribution by the same job, which adds the time its package manager takes. Every line the job said is kept, and can be copied or downloaded. Close Vigia halfway and it stops between boxes; the same button goes on from there.

A private network is only worth having if the public doors get closed behind it. The Private only tab lists every port something is listening on, judged against the firewall: what it is, which service holds it, and who can reach it today — anyone on the internet, a list of addresses, or nobody.

One button per port. Vigia lets the port in from the private subnet and takes away the rule that let everyone in, in a single change, so the port is never open wider in between. The service is not touched and nothing restarts: it keeps listening where it listens, and the firewall decides who arrives. Undoing it is one press. The SSH row is guarded — that is the door the console is standing in.

An MTU larger than the path can carry is the one WireGuard fault that looks healthy from everywhere else. The interface comes up, every ping answers, the matrix is green — and then anything with a full-size packet in it stalls: a replication stream, a backup, a dump. Small packets cross, so nothing that only pings ever notices.

Measure the wires sends real packets down every pair and reports what each path takes and what the tunnel can carry inside it. The narrowest wire sets the number, and one button uses it. The same tab holds the keepalive — 25 seconds unless you say otherwise, under every common NAT timeout — and preshared keys, one per pair rather than one for the network, so taking one box does not hand over the rest. Nothing here touches a box on its own: filed settings reach every lens0.conf the next time the filing is applied, all the boxes at once.

Rotating a WireGuard key by hand means one command on the box and then an edit on every other member, in the right order, without a typo. In Vigia it is one press on the member's row. The old private key is thrown away — that is what rotating is — a new pair is made on the box, and every other member is rewritten to expect the new public half. That box's tunnels are down from the moment the key changes until the job finishes, which is seconds.