63 lines
2.3 KiB
YAML
63 lines
2.3 KiB
YAML
---
|
|
# ---------------------------------------------------------------------------
|
|
# Defaults shared by every site. Do not edit this file per-site — put the
|
|
# differences in your site vars file (see vars/site-a.yml) and pass it with
|
|
# -e @vars/<site>.yml, which overrides everything here.
|
|
#
|
|
# Anything marked REQUIRED has no sensible default and must be set there.
|
|
# ---------------------------------------------------------------------------
|
|
|
|
wg_interface: wg0
|
|
wg_listen_port: 51820
|
|
|
|
# 1420 leaves room for the WireGuard header inside a 1500-byte path.
|
|
# Drop to 1380 if either side is on PPPoE or a tunnelled uplink.
|
|
wg_mtu: 1420
|
|
|
|
# REQUIRED: this box's tunnel address, as a /32. Never a /24 — the mask is
|
|
# what stops wg-quick installing a route to the whole tunnel subnet.
|
|
wg_address: ""
|
|
|
|
# Leave undefined to have the playbook generate a keypair on first run and print
|
|
# the public key. Set it (from Ansible Vault) if you manage keys centrally.
|
|
# wg_private_key: "..."
|
|
|
|
# REQUIRED: the remote site.
|
|
# allowed_ips - their /32 and nothing wider. This is the kernel's source
|
|
# filter, not just a route.
|
|
# endpoint - omit entirely if they're behind CGNAT and dial out to you.
|
|
wg_peers: []
|
|
# - name: site-b
|
|
# public_key: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx="
|
|
# allowed_ips: 10.99.0.2/32
|
|
# endpoint: site-b.example.com:51820
|
|
# keepalive: 25
|
|
|
|
# REQUIRED: the socat listeners.
|
|
# direction: inbound - listens on the tunnel, forwards to your LAN
|
|
# direction: outbound - listens on your LAN, forwards down the tunnel
|
|
# source_allow - nftables source restriction for this listener
|
|
relays: []
|
|
# - name: in-site-b
|
|
# direction: inbound
|
|
# listen_address: 10.99.0.1
|
|
# listen_port: 9000
|
|
# target: 192.168.1.50:9000
|
|
# source_allow: 10.99.0.2/32
|
|
# - name: out-site-b
|
|
# direction: outbound
|
|
# listen_address: 192.168.1.10
|
|
# listen_port: 9001
|
|
# target: 10.99.0.2:9000
|
|
# source_allow: 192.168.1.50/32
|
|
|
|
# Unprivileged account the socat units run as. 'nogroup' is Debian/Ubuntu;
|
|
# on RHEL-family set both to 'nobody'.
|
|
socat_user: nobody
|
|
socat_group: nogroup
|
|
|
|
# Safety rails. Only flip these if you know why.
|
|
# forwarding_enabled: true turns this box into a router between the tunnel
|
|
# and your LAN, which defeats the point of the relay design.
|
|
wg_relay_forwarding_enabled: false
|
|
wg_relay_manage_nftables: true |