mirror of https://github.com/wg-easy/wg-easy
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
37 lines
1.8 KiB
37 lines
1.8 KiB
# wg-easy — example environment file
|
|
#
|
|
# Copy to `.env` and adjust. All variables are OPTIONAL; wg-easy runs with
|
|
# sensible defaults and an interactive setup wizard if none are set.
|
|
# See docs: advanced/config/optional-config and advanced/config/unattended-setup.
|
|
|
|
# ── General ────────────────────────────────────────────────────────────────
|
|
# PORT=51821
|
|
# HOST=0.0.0.0
|
|
# INSECURE=false
|
|
# DISABLE_IPV6=false
|
|
|
|
# ── Unattended first-run setup (only used on first start) ───────────────────
|
|
# INIT_ENABLED=true
|
|
# INIT_USERNAME=admin
|
|
# INIT_PASSWORD=change-me-to-something-long
|
|
# INIT_HOST=vpn.example.com
|
|
# INIT_PORT=51820
|
|
# INIT_DNS=1.1.1.1,8.8.8.8
|
|
|
|
# ── Trusted-Header SSO (reverse-proxy authentication) ───────────────────────
|
|
# Have wg-easy trust an identity your authenticating reverse proxy (Authentik,
|
|
# Authelia, oauth2-proxy, …) has already verified, instead of showing its own
|
|
# login form. Disabled unless TRUSTED_PROXY_ENABLED=true.
|
|
#
|
|
# SECURITY: TRUSTED_PROXY_SECRET is the trust boundary. A client can forge any
|
|
# header, so the proxy must inject this secret and it must be unreachable by end
|
|
# users. The feature fails closed if enabled without a secret.
|
|
#
|
|
# TRUSTED_PROXY_ENABLED=true
|
|
# TRUSTED_PROXY_SECRET= # generate: openssl rand -hex 32
|
|
# TRUSTED_PROXY_SECRET_HEADER=x-wg-proxy-secret
|
|
# TRUSTED_PROXY_HEADER=x-authentik-username
|
|
# TRUSTED_PROXY_EMAIL_HEADER=x-authentik-email
|
|
# TRUSTED_PROXY_NAME_HEADER=x-authentik-name
|
|
# TRUSTED_PROXY_DEFAULT_ROLE=client # or: admin
|
|
# TRUSTED_PROXY_IPS= # optional CSV source-IP allowlist (defense-in-depth)
|
|
|