.wireguard-auth.yaml

syncInterval: 60
ipPoolStart: 172.20.0.2
region: us-west-2
dynamoDBTable: ops-vpn

# Allow internet on full tunnel connections. If true; also adds a deny for RFC1918 networks
allowInternet: true

server:
  extInterface: ens5
  wgInterface: wg0
  privateKey: ABCD1234789278930091237=
  port: 51820

smtp:
  enabled: true
  from: DevOps <devops@example.com>
  server: smtp.example.com
  port: 25
  body: "Attached is your VPN profile. Please open with the Wireguard GUI"
  authLogin: false
  username: ""
  password: ""

# For duo MFA
mfa:
  ikey: HUIOUIQIOWEIOMQWIOE
  skey: cjiejieu1AjLjZ92920GbNokeoikeokokeoiI
  host: api-123456.duosecurity.com

splunk:
  enabled: false
  token: abcd-1234-1234-abcd-12345
  server: splunk.example.com
  index: main
  source: vpn
  sourcetype: audit

loki:
  enabled: true
  pushURL: https://domain.com/loki/api/v1/push
  basicAuth: 12345:eyJtoken

clientConfig:
  # Routes to be pushed to user
  routes:
  - 172.16.0.0/12
  - 10.128.0.0/10
  dns: 8.8.8.8
  # server address and port
  serverAddress: wireguard.example.com:51820

# Rule profiles. Easily add in certain groups. Proto and port are optional
#   ruleProfiles:
#   supportUsers:
#   - route: 10.190.0.0/24
#     proto: tcp
#     port: 80
#   - route: 10.190.0.0/24
#     proto: tcp
#     port: 443
#   - route: 172.16.0.0/24