mirror of
https://codeberg.org/cunicu/cunicu.git
synced 2025-12-24 06:18:40 +08:00
114 lines
4.2 KiB
YAML
114 lines
4.2 KiB
YAML
# SPDX-FileCopyrightText: 2023-2025 Steffen Vogel <post@steffenvogel.de>
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
# yaml-language-server: $schema=https://cunicu.li/schemas/config.yaml
|
|
---
|
|
|
|
# This is an example of a simple cunicu configuration file.
|
|
# For a full example please look at cunicu.advanced.yaml
|
|
|
|
|
|
## WireGuard interface settings
|
|
#
|
|
# These settings configure WireGuard specific settings
|
|
# of the interface.
|
|
#
|
|
# The following settings can be overwritten for each interface
|
|
# using the 'interfaces' settings (see below).
|
|
# The following settings will be used as default.
|
|
|
|
# A base64 private key generated by wg genkey.
|
|
# Will be automatically generated if not provided.
|
|
private_key: KLoqDLKgoqaUkwctTd+Ov3pfImOfadkkvTdPlXsuLWM=
|
|
|
|
# The remote WireGuard peers provided as a dictionary
|
|
# The keys of this dictionary are used as names for the peers
|
|
peers:
|
|
test:
|
|
# A base64 public key calculated by wg pubkey from a private key,
|
|
# and usually transmitted out of band
|
|
# to the author of the configuration file.
|
|
public_key: FlKHqqQQx+bTAq7+YhwEECwWRg2Ih7NQ48F/SeOYRH8=
|
|
|
|
# A base64 pre-shared key generated by wg genpsk.
|
|
# Optional, and may be omitted.
|
|
# This option adds an additional layer of symmetric-key
|
|
# cryptography to be mixed into the already existing
|
|
# public-key cryptography, for post-quantum resistance.
|
|
preshared_key: zu86NBVsWOU3cx4UKOQ6MgNj3gv8GXsV9ATzSemdqlI=
|
|
|
|
# An endpoint IP or hostname, followed by a colon,
|
|
# and then a port number. This endpoint will be updated
|
|
# automatically to the most recent source IP address and
|
|
# port of correctly authenticated packets from the peer.
|
|
# If provided, no endpoint discovery will be performed.
|
|
endpoint: vpn.example.com:51820
|
|
|
|
# A time duration, between 1 and 65535s inclusive, of how
|
|
# often to send an authenticated empty packet to the peer
|
|
# for the purpose of keeping a stateful firewall or NAT mapping
|
|
# valid persistently. For example, if the interface very rarely
|
|
# sends traffic, but it might at anytime receive traffic from a
|
|
# peer, and it is behind NAT, the interface might benefit from
|
|
# having a persistent keepalive interval of 25 seconds.
|
|
# If set to zero, this option is disabled.
|
|
# By default or when unspecified, this option is off.
|
|
# Most users will not need this. Optional.
|
|
persistent_keepalive: 120s
|
|
|
|
# A comma-separated list of IP (v4 or v6) addresses with
|
|
# CIDR masks from which incoming traffic for this peer is
|
|
# allowed and to which outgoing traffic for this peer is directed.
|
|
# The catch-all 0.0.0.0/0 may be specified for matching
|
|
# all IPv4 addresses, and ::/0 may be specified for matching
|
|
# all IPv6 addresses. May be specified multiple times.
|
|
allowed_ips:
|
|
- 192.168.5.0/24
|
|
|
|
## Basic interface settings
|
|
#
|
|
|
|
# The Maximum Transfer Unit of the WireGuard interface.
|
|
# If not specified, the MTU is automatically determined from
|
|
# the endpoint addresses or the system default route,
|
|
# which is usually a sane choice.
|
|
# However, to manually specify an MTU to override this
|
|
# automatic discovery, this value may be specified explicitly.
|
|
mtu: 1420
|
|
|
|
# A list of IP (v4 or v6) addresses (optionally with CIDR masks)
|
|
# to be assigned to the interface.
|
|
# May be specified multiple times.
|
|
addresses:
|
|
- 10.10.0.1/24
|
|
|
|
# A list of prefixes which cunicu uses to derive local addresses
|
|
# from the interfaces public key
|
|
prefixes:
|
|
- fc2f:9a4d::/32
|
|
- 10.237.0.0/16
|
|
|
|
## Peer discovery
|
|
#
|
|
# Peer discovery finds new peers within the same community and adds them to the respective interface
|
|
discover_peers: true
|
|
|
|
# The hostname which gets advertised to remote peers
|
|
hostname: my-node
|
|
|
|
# A passphrase shared among all peers of the same community
|
|
community: "some-common-password"
|
|
|
|
# Networks which are reachable via this peer and get advertised to remote peers
|
|
# These will be part of this interfaces AllowedIPs at the remote peers.
|
|
networks:
|
|
- 192.168.1.0/24
|
|
- 10.2.0.0/24
|
|
|
|
|
|
## Endpoint discovery
|
|
#
|
|
# Endpoint discovery uses Interactive Connectivity Establishment (ICE) as used by WebRTC to
|
|
# gather a list of candidate endpoints and performs connectivity checks to find a suitable
|
|
# endpoint address which can be used by WireGuard
|
|
discover_endpoints: true
|