-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathvpn_server.toml.example
More file actions
177 lines (160 loc) · 8.51 KB
/
Copy pathvpn_server.toml.example
File metadata and controls
177 lines (160 loc) · 8.51 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
# ezvpn server configuration example
#
# Usage: ezvpn server start -c vpn_server.toml
# ezvpn server start --default-config
#
# --default-config reads vpn_server.toml from the machine-global system config
# directory: /etc/ezvpn on Linux, /usr/local/etc/ezvpn on macOS, and
# %ProgramData%\ezvpn on Windows.
#
# Server runtime settings are read from this config file. The server CLI only
# selects the config path (-c or --default-config).
#
# Config is grouped by purpose:
# [network] - VPN tunnel addressing (the VPN itself)
# [auth] - authorized client public keys
# [iroh] - iroh transport: identity, relays, address lookup
#
# There are deliberately no performance/tuning knobs (WireGuard/Tailscale
# style): the tunnel MTU is fixed at 1280, QUIC transport settings (congestion
# control, windows, queue sizes) are fixed constants, and source-IP spoofing
# checks are always enforced.
# Required: validates config matches CLI command
role = "vpnserver"
[network]
# ============================================================================
# VPN Network Configuration
# ============================================================================
# At least one of 'network' (IPv4) or 'network6' (IPv6) is REQUIRED.
# You can configure:
# - IPv4-only: Set 'network' only
# - IPv6-only: Set 'network6' only
# - Dual-stack: Set both 'network' and 'network6'
# IPv4 VPN network CIDR (optional if network6 is set)
# Clients will be assigned IPs from this network
network = "10.0.0.0/24"
# Server's VPN IP address (optional, defaults to first IP in network)
# This becomes the gateway for connected clients
# server_ip = "10.0.0.1"
# ----------------------------------------------------------------------------
# IPv6 Configuration (Optional for Dual-Stack or IPv6-only)
# ----------------------------------------------------------------------------
# Enable IPv6 alongside IPv4 (dual-stack) or as the only address family (IPv6-only).
# When both network and network6 are set, clients receive addresses from both.
# IPv6 VPN network CIDR (required for dual-stack or IPv6-only)
# Clients will be assigned IPs from this network (one /128 per client)
# network6 = "fd00::/64"
# IPv6 address-assignment strategy (optional, default: "sequential")
#
# "sequential" (default): Server gets the first IP (e.g., fd00::1), clients
# get fd00::2, fd00::3, ... in connection order.
#
# "node-id": Stateless deterministic addressing. Each 64-bit host
# suffix is derived (SHA-256) from an iroh node id, so
# the same client node id gets the same address across
# reconnects and server restarts — no allocation state
# is kept. Current clients use ephemeral node ids, so
# this is stable only for clients that reuse the same
# iroh identity. The server's address is likewise
# derived from the server's node id.
# Requires 'network6' of /64 or wider (prefix <= 64)
# and cannot be combined with 'server_ip6' (the
# server address is derived, not configured).
# ip6_strategy = "node-id"
# Server's IPv6 VPN address (optional, defaults to first IP in network6)
# This becomes the IPv6 gateway for connected clients
# NOTE: Only valid with the default "sequential" strategy; with "node-id"
# the server address is derived from the server's node id.
# server_ip6 = "fd00::1"
# ----------------------------------------------------------------------------
# IPv6-only Example Configuration
# ----------------------------------------------------------------------------
# For an IPv6-only VPN server, comment out 'network' above and enable:
#
# # network = "10.0.0.0/24" # Comment out or remove for IPv6-only
# network6 = "fd00::/64"
# ip6_strategy = "node-id" # or omit for sequential (server_ip6 allowed then)
# NOTE: There is no 'mtu' setting. The tunnel MTU is fixed at 1280 on both
# ends (the IPv6 minimum link MTU and the same fixed value Tailscale uses),
# which is mobile-safe on essentially any real path.
[auth]
# ============================================================================
# Authentication (REQUIRED)
# ============================================================================
# Clients authenticate with an ed25519 keypair. Each client generates its own
# keypair and gives you the public half; you list the accepted public keys here,
# ssh authorized_keys style.
#
# Key management lives in the standalone flexaccess-keys CLI
# (https://github.com/flexaccessdev/flexaccess-keys):
# flexaccess-keys generate-auth-key "alice laptop" -o client.key # on the client
# flexaccess-keys show-auth-key --private-key-file client.key # its public entry
#
# File format: one `ed25519-pub:...` per line, optional trailing comment;
# `#` lines and blank lines are ignored. Example:
# # ./authorized_keys
# ed25519-pub:AAAA... alice laptop
# ed25519-pub:BBBB... build server
authorized_keys_file = "./authorized_keys"
# ============================================================================
# Performance Notes (no config keys)
# ============================================================================
# Linux GSO offload is automatic (no config toggle).
# On startup, server logs local TUN GSO status.
# Per-client, server logs: `server_local`, `client_reported`, and `active` GSO status.
#
# Kernel UDP socket buffers (Linux): iroh requests 7 MiB socket buffers. A
# plain SO_RCVBUF/SO_SNDBUF request is capped at net.core.rmem_max /
# net.core.wmem_max (default ~208 KiB), which drops inbound datagram bursts, so
# the server (running as root) sets them with SO_RCVBUFFORCE/SO_SNDBUFFORCE,
# which bypass the cap. No sysctl tuning is needed.
#
# Queue behavior is fixed: when a slow client's outbound queue fills, its
# packets are dropped (WireGuard-style) so one stalled client never blocks
# packet delivery to the others.
#
# Source-IP spoofing checks are always enforced (the analog of WireGuard's
# cryptokey routing) and cannot be disabled.
[iroh]
# ============================================================================
# Server Identity (Required)
# ============================================================================
# Path to secret key file for persistent iroh identity (REQUIRED)
# Generates same EndpointId across restarts
# Create with: ezvpn generate-server-key -o ./vpn-server.key
secret_file = "./vpn-server.key"
# ============================================================================
# Relay and Discovery (Optional)
# ============================================================================
# Custom relay server URLs: at least two distinct relays. The server rides out
# a relay outage by moving onto another configured relay in place (same node
# id, nothing torn down), so a single custom relay is rejected at startup.
# Every relay is probed at startup; startup fails only when none comes online,
# and a relay that does not is named in a warning, left out of the relay map,
# and put back once it is connectable again. Clients must be configured with
# this same full list: with custom relays they reach the server only through
# the relay it is currently homed on.
# relay_urls = [
# "https://relay1.example.com",
# "https://relay2.example.com",
# ]
#
# Optional shared bearer token for a private relay deployment. When set, it is
# sent to every custom relay as an "Authorization: Bearer <token>" header. It is
# only valid together with relay_urls (above) — setting it with the default
# relays is rejected at startup. All endpoints (server and clients) that use the
# private relay must present the same token.
# relay_auth_token = "your-shared-relay-token"
#
# Whether iroh address lookup (pkarr publishing + DNS lookup via n0's
# dns.iroh.link, https://docs.iroh.computer/concepts/address-lookup) runs
# follows the relay choice and is not separately configurable: ON with the
# default relays, so clients resolve the server's home relay by endpoint ID;
# OFF with custom relays, so nothing is published to or resolved from public
# iroh infrastructure and clients reach the server through the relay URLs
# they attach as dial hints. It is NOT real/VPN DNS. See "Relay and Address
# Lookup" in README.md and https://github.com/flexaccessdev/iroh-common-architecture
# for the full design.
# NOTE: There is no [iroh.transport] section. QUIC transport settings are
# fixed constants on both ends: Cubic congestion control, 8 MB receive/send
# windows, 15 s keep-alive, and 30 s idle timeout.