Configuration ¶
+You can configure wg-access-server using environment variables, cli flags or a config file +taking precedence over one another in that order.
+The default configuration should work out of the box if you're just looking to try it out.
+The only required configuration is a wireguard private key. +You can generate a wireguard private key by following the official docs.
+TLDR:
+wg genkey
+
The config file format is yaml
and an example is provided below.
The format for specifying multiple values for options that allow it is:
+* as commandline flags:
+ * repeat the flag (e.g. --dns-upstream 2001:db8::1 --dns-upstream 192.0.2.1
)
+ * separate the values with a comma (e.g. --dns-upstream 2001:db8::1,192.0.2.1
)
+* as environment variables:
+ * separate with a comma (e.g. WG_DNS_UPSTREAM="2001:db8::1,192.0.2.1"
)
+ * separate with a new line char (e.g. WG_DNS_UPSTREAM=$'2001:db8::1\n192.0.2.1'
)
+* in the config file as YAML list.
Here's what you can configure:
+Environment Variable | +CLI Flag | +Config File Path | +Required | +Default (docker) | +Description | +
---|---|---|---|---|---|
WG_CONFIG |
+--config |
++ | + | + | The path to a wg-access-server config.yaml file | +
WG_LOG_LEVEL |
+--log-level |
+loglevel |
++ | info |
+The global log level | +
WG_ADMIN_USERNAME |
+--admin-username |
+adminUsername |
++ | admin |
+The admin account username | +
WG_ADMIN_PASSWORD |
+--admin-password |
+adminPassword |
+Yes | ++ | The admin account password | +
WG_PORT |
+--port |
+port |
++ | 8000 |
+The port the web ui will listen on (http) | +
WG_EXTERNAL_HOST |
+--external-host |
+externalHost |
++ | + | The external domain for the server (e.g. www.mydomain.com) | +
WG_STORAGE |
+--storage |
+storage |
++ | sqlite3:///data/db.sqlite3 |
+A storage backend connection string. See storage docs | +
WG_DISABLE_METADATA |
+--disable-metadata |
+disableMetadata |
++ | false |
+Turn off collection of device metadata logging. Includes last handshake time and RX/TX bytes only. | +
WG_ENABLE_INACTIVE_DEVICE_DELETION |
+--enable-inactive-device-deletion |
+enableInactiveDeviceDeletion |
++ | false |
+Enable/Disable the automatic deletion of inactive devices. | +
WG_INACTIVE_DEVICE_GRACE_PERIOD |
+--inactive-device-grace-period |
+inactiveDeviceGracePeriod |
++ | 8760h (1 Year) |
+The duration after which inactive devices are automatically deleted, if automatic deletion is enabled. A device is inactive if it has not been connected to the server for longer than the inactive device grace period. The duration format is the go duration string format | +
WG_FILENAME |
+--filename |
+filename |
++ | WireGuard |
+Change the name of the configuration file the user can download (Do not include the '.conf' extension ) | +
WG_WIREGUARD_ENABLED |
+--[no-]wireguard-enabled |
+wireguard.enabled |
++ | true |
+Enable/disable the wireguard server. Useful for development on non-linux machines. | +
WG_WIREGUARD_INTERFACE |
+--wireguard-interface |
+wireguard.interface |
++ | wg0 |
+The wireguard network interface name | +
WG_WIREGUARD_PRIVATE_KEY |
+--wireguard-private-key |
+wireguard.privateKey |
+Yes | ++ | The wireguard private key. This value is required and must be stable. If this value changes all devices must re-register. | +
WG_WIREGUARD_PORT |
+--wireguard-port |
+wireguard.port |
++ | 51820 |
+The wireguard server port (udp) | +
WG_WIREGUARD_MTU |
+--wireguard-mtu |
+wireguard.mtu |
++ | 1420 |
+The maximum transmission unit (MTU) to be used on the server-side interface. | +
WG_VPN_CIDR |
+--vpn-cidr |
+vpn.cidr |
++ | 10.44.0.0/24 |
+The VPN IPv4 network range. VPN clients will be assigned IP addresses in this range. Set to 0 to disable IPv4. |
+
WG_IPV4_NAT_ENABLED |
+--vpn-nat44-enabled |
+vpn.nat44 |
++ | true |
+Disables NAT for IPv4 | +
WG_IPV6_NAT_ENABLED |
+--vpn-nat66-enabled |
+vpn.nat66 |
++ | true |
+Disables NAT for IPv6 | +
WG_VPN_CLIENT_ISOLATION |
+--vpn-client-isolation |
+vpn.clientIsolation |
++ | false |
+BLock or allow traffic between client devices (client isolation) | +
WG_VPN_CIDRV6 |
+--vpn-cidrv6 |
+vpn.cidrv6 |
++ | fd48:4c4:7aa9::/64 |
+The VPN IPv6 network range. VPN clients will be assigned IP addresses in this range. Set to 0 to disable IPv6. |
+
WG_VPN_GATEWAY_INTERFACE |
+--vpn-gateway-interface |
+vpn.gatewayInterface |
++ | default gateway interface (e.g. eth0) | +The VPN gateway interface. VPN client traffic will be forwarded to this interface. | +
WG_VPN_ALLOWED_IPS |
+--vpn-allowed-ips |
+vpn.allowedIPs |
++ | 0.0.0.0/0, ::/0 |
+Allowed IPs that clients may route through this VPN. This will be set in the client's WireGuard connection file and routing is also enforced by the server using iptables. | +
WG_DNS_ENABLED |
+--[no-]dns-enabled |
+dns.enabled |
++ | true |
+Enable/disable the embedded DNS proxy server. This is enabled by default and allows VPN clients to avoid DNS leaks by sending all DNS requests to wg-access-server itself. | +
WG_DNS_UPSTREAM |
+--dns-upstream |
+dns.upstream |
++ | resolvconf autodetection or Cloudflare DNS | +The upstream DNS servers to proxy DNS requests to. By default the host machine's resolveconf configuration is used to find its upstream DNS server, with a fallback to Cloudflare. | +
WG_DNS_DOMAIN |
+--dns-domain |
+dns.domain |
++ | + | A domain to serve configured devices authoritatively. Queries for names in the format |
+
WG_CLIENTCONFIG_DNS_SERVERS |
+--clientconfig-dns-servers |
+clientConfig.dnsServers |
++ | + | DNS servers (one or more IP addresses) to write into the client configuration file. Are used instead of the servers DNS settings, if set. | +
WG_CLIENTCONFIG_DNS_SEARCH_DOMAIN |
+--clientconfig-dns-search-domain |
+clientConfig.dnsSearchDomain |
++ | + | DNS search domain to write into the client configuration file. | +
WG_CLIENTCONFIG_MTU |
+--clientconfig-mtu |
+clientConfig.mtu |
++ | + | The maximum transmission unit (MTU) to write into the client configuration file. If left empty, a sensible default is used. | +
The Config File (config.yaml) ¶
+Here's an example config file to get started with.
+loglevel: info
+storage: sqlite3:///data/db.sqlite3
+wireguard:
+ privateKey: "<some-key>"
+dns:
+ upstream:
+ - "2001:4860:4860::8888"
+ - "8.8.8.8"
+