# refer to wireguard-proxy --help for info on what these are # this binds ipv4 and ipv6 if dual stacked WGP_TCP_HOST=[::]:5555 # this binds all ipv4 addresses #WGP_TCP_HOST=0.0.0.0:5555 WGP_UDP_TARGET=127.0.0.1:51820 # on the server you'll want to set this to slightly more than PersistentKeepalive= in your client's wireguard config # this allows the udp sockets to be closed in a reasonable amount of time after the TCP connections are terminated # if PersistentKeepalive=25 as is recommended just set this to 60 WGP_SOCKET_TIMEOUT=60 WGP_UDP_BIND_HOST_RANGE=127.0.0.1:30000-40000 # if you don't want proper cert generate with: # openssl req -new -x509 -sha256 -days 3650 -nodes -subj "/C=US/CN=example.org" -newkey rsa:2048 -out cert.pem -keyout key.pem # if systemd template has SupplementaryGroups=systemd-network set permissions on key properly: # chown root.systemd-network key.pem && chmod 640 key.pem # optionally (but recommended) extract pinnedpubkey hash from the above generated cert like so: # openssl x509 -in cert.pem -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64 #WGP_TLS_KEY=/etc/wireguard-proxy/key.pem #WGP_TLS_CERT=/etc/wireguard-proxy/cert.pem