# A VPN provider exit (here ProtonVPN) that carries nothing by default.
# Only devices whose reservation names it ("egress: wg1") send their
# Internet traffic through it; everyone else uses the WAN as usual. If the
# tunnel is down, those devices have no Internet access: they never fall
# back to the WAN.
#
# From the provider's WireGuard config file:
#   [Interface] Address    -> address
#   [Interface] DNS        -> gateway and dns
#   [Interface] PrivateKey -> save as /usr/local/etc/pebble/keys/wg1.key
#   [Peer] PublicKey, Endpoint -> peers[0]
version: 1

system:
  hostname: pebble
  timezone: Europe/London

network:
  wan:
    device: igb0
    ipv4:
      mode: dhcp

  lan:
    device: igb1
    ipv4:
      address: 192.168.10.1/24

  ipv6:
    mode: disabled

dhcp:
  enabled: true
  authoritative: true
  start: 192.168.10.100
  end: 192.168.10.199
  lease_duration: 12h
  domain: home.arpa
  reservations:
    - name: laptop
      mac: 02:00:00:00:00:50
      address: 192.168.10.50
      egress: wg1                 # this device's Internet traffic leaves via wg1

dns:
  enabled: true
  recursive: true
  dnssec: true
  cache_mb: 32

  blocking:
    enabled: true
    response: nxdomain
    update_interval: 24h
    max_domains: 250000
    lists: []
    allowlist: []
    denylist: []

wireguard:
  interfaces:
    - name: wg1
      description: ProtonVPN exit
      role: egress                # a VPN provider exit: nothing is routed into it by default
      address: 10.2.0.2/32
      gateway: 10.2.0.1           # the provider's tunnel address: next hop for assigned devices
      dns: [10.2.0.1]             # handed by DHCP to assigned devices, so lookups use the tunnel too
      private_key_file: /usr/local/etc/pebble/keys/wg1.key
      peers:
        - name: proton-uk
          public_key: vC6Mi2Kp8xd5MgUqmZBbtbX7zYSnZ4ndjuDp9wKGWUs=
          endpoint: 203.0.113.50:51820   # the provider server's host:port
          persistent_keepalive: 25
          allowed_ips: [0.0.0.0/0]

firewall:
  default_inbound: deny
  default_forward: deny
  default_outbound: allow

  nat:
    enabled: true
    outbound: wan

management:
  ssh:
    enabled: true
    allow_from:
      - 192.168.10.0/24

updates:
  automatic_install: false

recovery:
  rollback_timeout: 120s
  keep_generations: 5