Probably works

defaults.yml

@@ -0,0 +1,63 @@
+---
+# ---------------------------------------------------------------------------
+# Defaults shared by every site. Do not edit this file per-site — put the
+# differences in your site vars file (see vars/site-a.yml) and pass it with
+# -e @vars/<site>.yml, which overrides everything here.
+#
+# Anything marked REQUIRED has no sensible default and must be set there.
+# ---------------------------------------------------------------------------
+
+wg_interface: wg0
+wg_listen_port: 51820
+
+# 1420 leaves room for the WireGuard header inside a 1500-byte path.
+# Drop to 1380 if either side is on PPPoE or a tunnelled uplink.
+wg_mtu: 1420
+
+# REQUIRED: this box's tunnel address, as a /32. Never a /24 — the mask is
+# what stops wg-quick installing a route to the whole tunnel subnet.
+wg_address: ""
+
+# Leave undefined to have the playbook generate a keypair on first run and print
+# the public key. Set it (from Ansible Vault) if you manage keys centrally.
+# wg_private_key: "..."
+
+# REQUIRED: the remote site.
+#   allowed_ips  - their /32 and nothing wider. This is the kernel's source
+#                  filter, not just a route.
+#   endpoint     - omit entirely if they're behind CGNAT and dial out to you.
+wg_peers: []
+#   - name: site-b
+#     public_key: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx="
+#     allowed_ips: 10.99.0.2/32
+#     endpoint: site-b.example.com:51820
+#     keepalive: 25
+
+# REQUIRED: the socat listeners.
+#   direction: inbound  - listens on the tunnel, forwards to your LAN
+#   direction: outbound - listens on your LAN, forwards down the tunnel
+#   source_allow        - nftables source restriction for this listener
+relays: []
+#   - name: in-site-b
+#     direction: inbound
+#     listen_address: 10.99.0.1
+#     listen_port: 9000
+#     target: 192.168.1.50:9000
+#     source_allow: 10.99.0.2/32
+#   - name: out-site-b
+#     direction: outbound
+#     listen_address: 192.168.1.10
+#     listen_port: 9001
+#     target: 10.99.0.2:9000
+#     source_allow: 192.168.1.50/32
+
+# Unprivileged account the socat units run as. 'nogroup' is Debian/Ubuntu;
+# on RHEL-family set both to 'nobody'.
+socat_user: nobody
+socat_group: nogroup
+
+# Safety rails. Only flip these if you know why.
+#   forwarding_enabled: true turns this box into a router between the tunnel
+#   and your LAN, which defeats the point of the relay design.
+wg_relay_forwarding_enabled: false
+wg_relay_manage_nftables: true