Comments & Readme

README.md

@@ -29,7 +29,16 @@ Repository structure:
   Age-encrypted secrets managed and deployed via agenix.
 
 - **var/**
-  Shared constants and values used across the configuration.
+  Shared data used across the configuration. `hosts.nix` is the single source
+  of truth for per-host data (SSH keys, WireGuard config). Adding a new host
+  means adding an entry there and running `bin/gen-syncthing-cert`.
+
+## Network topology
+
+WireGuard overlay network (onet, 10.10.11.0/24). Roam is the
+hub and the only publicly reachable node; desktops peer with roam only.
+Roam also runs a Mullvad WireGuard tunnel used as an egress for the torrent
+container configured in table 1000.
 
 ## TODO