26 lines
1.2 KiB

# refer to wireguard-proxy --help for info on what these are
# this binds ipv4 and ipv6 if dual stacked
# this binds all ipv4 addresses
# on the server you'll want to set this to slightly more than PersistentKeepalive= in your client's wireguard config
# this allows the udp sockets to be closed in a reasonable amount of time after the TCP connections are terminated
# if PersistentKeepalive=25 as is recommended just set this to 60
# if you don't want proper cert generate with:
# openssl req -new -x509 -sha256 -days 3650 -nodes -subj "/C=US/CN=example.org" -newkey rsa:2048 -out cert.pem -keyout key.pem
# if systemd template has SupplementaryGroups=systemd-network set permissions on key properly:
# chown root.systemd-network key.pem && chmod 640 key.pem
# optionally (but recommended) extract pinnedpubkey hash from the above generated cert like so:
# openssl x509 -in cert.pem -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64