config.example.yaml

Rama main · réplica de lectura del repositorio original.

# wgroster configuration example.

# HTTP listen address.
listen: ":8080"

# Externally reachable base URL (used in the curl snippets shown to admins).
base_url: "https://wgroster.example.com"

# Secret used to sign session cookies. Generate with: openssl rand -hex 32
# May also be provided via the WG_SESSION_KEY environment variable.
# If left empty an ephemeral key is generated (sessions reset on restart).
session_key: ""

# Set to true when served behind HTTPS so cookies get the Secure flag (also
# enables HSTS).
cookie_secure: true

# Session lifetime, sliding (extended on each request). Go duration syntax:
# "12h", "30m", "168h" (= 7 days). Default 12h.
session_ttl: "12h"

# Absolute session lifetime cap: a session is rejected once it is older than
# this, no matter how often it is refreshed. Must be >= session_ttl. This bounds
# how long a stolen-and-kept-alive cookie can remain valid. Default 168h (7d).
session_max_lifetime: "168h"

# Enable ONLY when behind a reverse proxy that sets/overwrites X-Forwarded-For,
# so the real client IP is used for logs and login rate-limiting.
trusted_proxy: false

# Path to the SQLite database file.
database: "/data/wgroster.db"

# Global client address pool. Each machine gets one unique IP from this range.
# A list of non-overlapping ranges is also accepted; new addresses are taken
# from the first range until it is full, then from the next one:
# vpn_cidr: ["10.0.0.0/16", "10.8.0.0/24"]
vpn_cidr: "10.0.0.0/16"

# Optional bearer token protecting the Prometheus /metrics endpoint. When set,
# /metrics accepts this token. When empty, /metrics still requires an
# authenticated admin session (it is never exposed anonymously).
metrics_token: ""

# Optional webhook: receives a JSON POST when an endpoint goes stale or a drift
# (missing / unexpected / mismatch) appears or clears. Leave empty to disable.
alert_webhook_url: ""

# Optional offline MaxMind GeoLite2 database (Country or City). When set, the
# peer drawer shows the country (and city, if a City DB) of the remote IP,
# looked up locally — no external call. Optionally an ASN DB for the network.
# geoip_db: "/data/GeoLite2-Country.mmdb"
# geoip_asn_db: "/data/GeoLite2-ASN.mmdb"

# Optional built-in administrator account, checked before LDAP. Useful to
# bootstrap the portal or to run it without LDAP (e.g. for testing). Leave the
# whole block out for a pure-LDAP setup.
# local_admin:
#   username: "admin"
#   # Recommended: bcrypt hash, generated with "wgroster -hash-password".
#   password_hash: "$2a$10$replace_me_with_a_real_bcrypt_hash"
#   # Development convenience only (ignored when password_hash is set):
#   # password: "changeme"

# Self-enrollment (mobile "scan-once"): a logged-in user names a device, the
# browser generates the keys, an IP is reserved immediately and a complete
# config/QR is shown. The machine stays pending until an admin approves it.
self_enroll: false
# Endpoint (by name) self-enrolled devices connect to (required if self_enroll).
self_enroll_endpoint: ""
# Cap pending machines per user (default 5; 0 = unlimited) and auto-expire
# stale pending machines after N days, freeing their reserved IP (0 = never).
max_pending_per_user: 5
pending_expiry_days: 0

# Prune admin audit entries older than N days (0 = keep forever). The audit log
# is append-only, so leave it at 0 only if you archive the database elsewhere.
audit_retention_days: 0

# Offboarding check (requires LDAP). Once a day the portal asks the directory
# whether each machine owner still has an entry. An owner absent for this many
# consecutive days is reported on the machines page, in the audit log and on the
# alert webhook. 0 disables the check.
orphan_grace_days: 0
# What happens when the grace period expires:
#   flag    — report only, machines keep working (default)
#   disable — also disable the owner's active machines, which drops them from
#             every concentrator's expected peer list. Their address and endpoint
#             links are kept, so enabling them again is one click. Disabled is a
#             status of its own: such a machine is not in the review queue and is
#             never removed by pending_expiry_days.
# The check refuses to act on a round where no owner could be confirmed present,
# or where a majority look absent — a broken search account or bind_dn_pattern
# makes everyone look gone, and that must not disconnect the fleet.
orphan_action: "flag"

# Dormancy check (no LDAP needed). The hourly maintenance sweep reports machines
# whose last handshake is older than this many days — and machines that were
# approved more than that long ago and never connected at all. 0 disables it.
# A device nobody uses any more otherwise keeps a working peer forever.
dormant_days: 0
# What happens to a dormant machine:
#   flag    — report only, it keeps working (default)
#   disable — also take it out of service, dropping it from every concentrator's
#             expected peer list. Its address and endpoints are kept.
# The check refuses to act when no endpoint has reported in the last hour, or
# when a majority of active machines look dormant: agents that all stopped (or a
# portal that was down for a week) must not be read as an idle fleet.
dormant_action: "flag"

# LDAP is optional when local_admin is configured.
ldap:
  # OpenLDAP server URL.
  url: "ldap://ldap.example.com:389"
  # Pattern used to build the user DN from the login. %s is the username.
  bind_dn_pattern: "uid=%s,ou=people,dc=example,dc=com"
  # Group whose members are administrators.
  admin_group_dn: "cn=vpn-admins,ou=groups,dc=example,dc=com"
  # Attribute listing group members: "memberUid" (value=uid) or "member" (value=DN).
  member_attr: "memberUid"
  # Attribute holding the user's display name (default "cn"; AD often "displayName").
  name_attr: "cn"
  # Binary attribute holding the user's photo/mugshot (default "jpegPhoto"; AD
  # often "thumbnailPhoto"). Leave empty to disable avatars.
  photo_attr: "jpegPhoto"
  # Optional service account to read group membership and to resolve the name
  # and photo of users who have not logged in yet (shown on the admin machines
  # list). If empty, the user's own connection is reused for their own lookups,
  # and directory lookups for other users are attempted anonymously — set this
  # only if your directory rejects anonymous reads.
  search_bind_dn: ""
  search_bind_password: ""
  # Upgrade a plain ldap:// connection to TLS.
  start_tls: false
  # Disable TLS certificate verification (testing only).
  insecure_skip_verify: false