37 lines
1.6 KiB
Text
37 lines
1.6 KiB
Text
|
# Which cert/tenancy strategy to run: "single" or "shared".
|
||
|
|
# See traefik/static/traefik.single.yml vs traefik.shared.yml.
|
||
|
|
GATEWAY_MODE=single
|
||
|
|
|
||
|
|
# The hostname (or IP, for a first local smoke test) wg-easy advertises to
|
||
|
|
# peers as the WireGuard endpoint. Must be reachable on udp/51820.
|
||
|
|
GATEWAY_PUBLIC_HOST=vpn.example.com
|
||
|
|
|
||
|
|
# bcrypt hash of the wg-easy admin UI password. Generate with:
|
||
|
|
# docker run --rm ghcr.io/wg-easy/wg-easy:14 node -e \
|
||
|
|
# "console.log(require('bcryptjs').hashSync(process.argv[1], 10))" 'your-password'
|
||
|
|
WG_EASY_PASSWORD_HASH=
|
||
|
|
|
||
|
|
# Credentials the control-plane uses to log into wg-easy's own admin API
|
||
|
|
# (POST /api/auth/password -> session cookie; wg-easy has no separate
|
||
|
|
# bearer-token auth). WG_EASY_ADMIN_PASSWORD is the PLAINTEXT password
|
||
|
|
# corresponding to WG_EASY_PASSWORD_HASH above — wg-easy only ever sees the
|
||
|
|
# hash, but the control-plane needs the plaintext to log in the same way a
|
||
|
|
# human would through the UI.
|
||
|
|
WG_EASY_ADMIN_USERNAME=admin
|
||
|
|
WG_EASY_ADMIN_PASSWORD=
|
||
|
|
|
||
|
|
# GATEWAY_MODE=single only: the one box token a single-tenant deployment
|
||
|
|
# accepts at /v1/boxes/register, skipping full account/registration-token
|
||
|
|
# issuance. Generate with: openssl rand -hex 32
|
||
|
|
GATEWAY_BOX_TOKEN=
|
||
|
|
|
||
|
|
# Bearer token required to create accounts via POST /v1/accounts.
|
||
|
|
# Only meaningful once account endpoints exist (Phase 2+); harmless to set
|
||
|
|
# now. Generate with: openssl rand -hex 32
|
||
|
|
GATEWAY_ADMIN_TOKEN=
|
||
|
|
|
||
|
|
# GATEWAY_MODE=shared only: base domain subdomains are issued under, and the
|
||
|
|
# DNS provider Traefik's DNS-01 challenge should use for the wildcard cert.
|
||
|
|
# See traefik/static/traefik.shared.yml.
|
||
|
|
GATEWAY_BASE_DOMAIN=boxes.example.com
|