Build the gateway to be replaced

A gateway that carries VPN, DNS, and overlay traffic looks like the machine that must never fail.

That instinct leads to a familiar kind of infrastructure: a long-lived host, years of careful edits, a directory of precious configuration, and a recovery plan that begins with remembering everything special about it.

RS Platform takes the opposite position. The gateway is important enough that it should be replaceable.

Preserve state, not the machine

The compute image contains pinned software, service units, validation logic, and no durable identity. Terraform can create the instance and its envelope. Provider-local secret storage supplies the keys it is authorized to read. Desired peer state arrives separately.

This turns replacement into a defined operation:

1. create known compute from a reviewed image;
2. retrieve the minimum provider-local identity;
3. render one complete desired interface;
4. validate routes and permissions;
5. swap it into place atomically; and
6. prove peers and health have converged.

Nothing in that sequence asks an operator to reconstruct yesterday’s host.

Reconcile complete generations

Peer management is deceptively dangerous. Adding one WireGuard peer also changes routes, forwarding policy, and sometimes masquerade rules. Applying those fragments independently creates intermediate states the design never intended.

The gateway therefore treats an interface as one generation. It validates the whole document, builds the complete peer and policy set under one lock, then either advances together or retains the last-known-good state.

That is more than configuration hygiene. It is a small transaction across several kernel subsystems.

The local apply mechanism also refuses routes outside an interface’s declared address bounds. A compromised delivery service cannot grant itself a private network merely by writing a more ambitious AllowedIPs.

Let transport be replaceable too

The permanent contract is intentionally boring: one validated desired-state file on the host.

Today, a provider management channel can deliver it. Later, an agent can hold an outbound connection to a control plane and receive versioned updates. A cloud migration should replace the transport, not the local convergence model.

This separation creates a useful failure mode. If the control plane or transport disappears, the file becomes stale and existing tunnels continue to work. Control-plane availability is not inserted into the packet path.

Availability is not the same as continuity

One small gateway is still a single failure domain. The design does not hide that. Instead it asks how quickly and confidently a new instance can assume the same role.

For a personal platform, tested replacement can be more valuable than a second idle gateway with its own synchronization protocol. High availability adds machinery; replaceability removes memory.

The transferable rule is simple:

If a machine is too important to lose, make its identity reproducible and its state reconcilable.