---
# WireGuard default configuration
wireguard_interface: wg0
wireguard_port: 60101
wireguard_ipv4: 10.20.0.10
wireguard_ipv6: fd69:69:69::1
wireguard_ipv4_network: 10.20.0.0/24
wireguard_ipv6_network: fd69:69:69::/64

# Directory paths
wireguard_config_dir: /etc/wireguard
wireguard_keys_dir: "{{ wireguard_config_dir }}/keys"
wireguard_clients_dir: "{{ wireguard_config_dir }}/clients"

# Enable IPv4 forwarding
wireguard_enable_forwarding: true

# UFW configuration (if false, will use iptables rules in PostUp/PostDown)
# Default to false since most Debian servers don't have UFW enabled by default
wireguard_enable_ufw: false

# Client configurations
wireguard_clients: []
# Example client structure:
# wireguard_clients:
#   - name: laptop
#     ipv4: 10.20.0.2
#     ipv6: fd69:69:69::2
#     preshared_key: true  # Optional: generate preshared key for extra security
#   - name: phone
#     ipv4: 10.20.0.3
#     ipv6: fd69:69:69::3
#     preshared_key: true

# DNS servers for clients (optional)
wireguard_dns_servers: []

# Additional routes for split tunneling (optional)
wireguard_additional_routes: []