---
id: w1/m7/t004
title: Encrypt node-to-node (Cilium WireGuard)
worker: worker1
status: done
estimate: 25m
depends_on: []
---

## Objective

Nodes currently talk over public IPs unencrypted. Enable Cilium WireGuard (`encryption.enabled=true, type=wireguard`).

## Context

- Cilium is the CNI; toggle encryption in its config (`app-cluster.yml`).

## Files

- `.github/workflows/app-cluster.yml` (Cilium values)

## Acceptance criteria

- [ ] `cilium status` shows WireGuard encryption enabled; pod-to-pod traffic across nodes is encrypted.

## Out of scope

- Private network / LB IP (t005).
