---
# ---------------------------------------------------------------------------
# Defaults shared by every site. Do not edit this file per-site — put the
# differences in your site vars file (see vars/site-a.yml) and pass it with
# -e @vars/<site>.yml, which overrides everything here.
#
# Anything marked REQUIRED has no sensible default and must be set there.
# ---------------------------------------------------------------------------

wg_interface: wg0
wg_listen_port: 51820

# 1420 leaves room for the WireGuard header inside a 1500-byte path.
# Drop to 1380 if either side is on PPPoE or a tunnelled uplink.
wg_mtu: 1420

# REQUIRED: this box's tunnel address, as a /32. Never a /24 — the mask is
# what stops wg-quick installing a route to the whole tunnel subnet.
wg_address: ""

# Leave undefined to have the playbook generate a keypair on first run and print
# the public key. Set it (from Ansible Vault) if you manage keys centrally.
# wg_private_key: "..."

# REQUIRED: the remote site.
#   allowed_ips  - their /32 and nothing wider. This is the kernel's source
#                  filter, not just a route.
#   endpoint     - omit entirely if they're behind CGNAT and dial out to you.
wg_peers: []
#   - name: site-b
#     public_key: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx="
#     allowed_ips: 10.99.0.2/32
#     endpoint: site-b.example.com:51820
#     keepalive: 25

# REQUIRED: the socat listeners.
#   direction: inbound  - listens on the tunnel, forwards to your LAN
#   direction: outbound - listens on your LAN, forwards down the tunnel
#   source_allow        - nftables source restriction for this listener
relays: []
#   - name: in-site-b
#     direction: inbound
#     listen_address: 10.99.0.1
#     listen_port: 9000
#     target: 192.168.1.50:9000
#     source_allow: 10.99.0.2/32
#   - name: out-site-b
#     direction: outbound
#     listen_address: 192.168.1.10
#     listen_port: 9001
#     target: 10.99.0.2:9000
#     source_allow: 192.168.1.50/32

# Unprivileged account the socat units run as. 'nogroup' is Debian/Ubuntu;
# on RHEL-family set both to 'nobody'.
socat_user: nobody
socat_group: nogroup

# Safety rails. Only flip these if you know why.
#   forwarding_enabled: true turns this box into a router between the tunnel
#   and your LAN, which defeats the point of the relay design.
wg_relay_forwarding_enabled: false
wg_relay_manage_nftables: true