Private networks and Partner POPs
Private WireGuard networks
Private networks reach origins without exposing them publicly.
#Overview
Private networks reach origins without exposing them publicly.
#WireGuard lifecycle
A network has a private CIDR, routes, peers, and POP profiles. A short cpn_… key enrolls a connector, admin_device, or origin; the private key is generated locally and never uploaded.
The returned profile contains addressing and available peers. network:profile writes without activation; network:enroll --install can run wg-quick when wireguard-tools is installed.
#Create access
Create a network with a CIDR that does not overlap existing networks.
Attach ready POPs and define ACLs.
Create a short enrollment key.
Generate the profile, test routes, and activate it with appropriate privileges.
#Permissions by role
| Action | owner | admin | member | viewer |
|---|---|---|---|---|
| View networks, peers, ACLs, origins, and POPs | Read | Read | Read | Read |
| Create, edit, or delete a network | Allowed | Allowed | Allowed | No |
| Manage peers, enrollment keys, and ACLs | Allowed | Allowed | Allowed | No |
| Link zones, private origins, and POPs | Allowed | Allowed | Allowed | No |
#Verifiable example
cdn-pizza network:create -n backoffice --cidr 10.42.0.0/24
cdn-pizza network:key NETWORK_ID --name first-device --uses 1 --hours 1