# A big dynamic VPN

dn42 is essentially what we want to setup, albeit much, much larger.

They use tunnels for the peering (OpenVPN, WireGuard, GRE, etc), BGP for routing, and private AS numbers.

We can cannibalize most of what they have; I'll summarize here.

# Requirements

* One router running 24/7. Any linux box can be turned into a router (even OpenWRT home routers!).
* Can establish a tunnel. Not too hard, but dn42 does not that that traffic may be filtered.
* Are generally knowledgable about networking (_right_, right, _yep_, definitely). They mainly say
you should have _heard of_ BGP/routing and are willing to set things up.

# Actually connecting

There's a [registry](https://git.dn42.dev/dn42/registry) that needs some "objects" in it. It's just a git repo! So we
can essentially just copy them or be inspired by them (don't need things to be automated that heavily just yet).

I didn't want to create an account to look at the repo just yet, but here's a summary from the page.

There are:
* **maintainer** objects, which are authenticated which only you can edit.
* **person** objects, which describe people or orgs (too much for us for now).
* **resource** objects, which are AS numbers, subnets, DNS zones, etc. The meat and potatoes of what we're doing.

Auth is done through SSH or PGP keys and it looks like it's checked on each commit. I guess resource objects are just
signed by a special key and that's it...? We can use our peering keys for this if we want (bad idea?).

So in order you:
* Create a **maintainer** object that has auth keys.
* Create a **person** object. I think we'd skip this.
* Choose and register an **AS number**. We should choose an empty range and just use values in there.
* Register an **IPv6** prefix.
* Create a **route** object which let's you announce your prefix to others. This is I believe more of an auth
step, so it may not be as necessary for us. (?)

Now you just need to peer!
* Just means you need to establish tunnels.

Then you gotta speak BGP with your peers. They have a [guide](https://wiki.dn42.us/howto/Bird) for bird
that we will probably heavily use. Doesn't look too bad... (right)

Then you just need to configure DNS. They recommend hosting your own for security and privacy reasons. We can think
about what we want to do. We could use anycast and have some DNS reliablity, that'd be pretty interesting.

# Conclusion

Seems pretty doable! Definitely should manually peer for now with a couple of us, then maybe spec out some way to 
automate peering and go from there.

Time to get a cheap linux box in some cloud now...