# Copy to .env and fill in. .env is gitignored.

# Public IP or domain that clients use to reach this server (required)
WG_HOST=

# WireGuard interface and port managed by the panel.
# Use wg1/51821 so it can coexist with a local wg0 client tunnel.
WG_INTERFACE=wg1
WG_PORT=51821
WG_SUBNET=10.8.0.0/24
WG_DNS=8.8.8.8

# What client configs route through the tunnel.
# Full tunnel (all traffic): 0.0.0.0/0, ::/0
# Split tunnel / mesh: list subnets, e.g. "10.8.0.0/24, 10.7.0.0/24"
# to let clients reach both this VPN and the wg0 tunnel network.
WG_ALLOWED_IPS=0.0.0.0/0, ::/0

# Relay (组网): extra host networks to NAT wg1 clients into, e.g. "10.7.0.0/24"
# to bridge clients into the wg0 tunnel. Requires network_mode: host in
# docker-compose.yml (uncomment it and remove ports:) so the container can
# reach the host's wg0 interface.
WG_RELAY_SUBNETS=

# Set true to block peer-to-peer traffic between VPN clients (isolation).
WG_PEER_ISOLATION=false

# Admin panel login
ADMIN_USERNAME=admin
ADMIN_PASSWORD=password

# Session signing / key encryption secret. Generate with: openssl rand -hex 32
SECRET_KEY=secret