Converted router configuration file from .conf to JSON.

2026-10-23 07:35:43 +02:00
1 parent c423ea9347
commit b18947ed9b
@@ -1,84 +0,0 @@
-# Example vpn-router configuration.
-#
-# This file is documentation. The live configuration is
-# /etc/vpn-router/vpn-router.conf, which is generated on first install and
-# owned by the operator afterwards. Copy settings from here as needed.
-#
-# Format: INI. Lists are comma-separated, booleans are true/false, an empty
-# value means unset, and a _b64 suffix means the value is base64-encoded.
-#
-# Comments start with # or ; and may follow a value on the same line. That
-# means # and ; cannot appear inside a value - which is why the pre-shared
-# key, the one setting that can hold arbitrary text, is base64-encoded.
-#
-# Apply any change with:  systemctl restart vpn-router-setup
-#
-# Every feature is optional. A file with nothing filled in configures nothing
-# and leaves the host reachable and unchanged.
-
-[general]
-# Platform: none, generic, azure or gcp.
-#   none    - configuration is deferred. Files are installed and nothing on
-#             this machine is changed. Set a real platform when ready.
-#   generic - configure, with no platform-specific additions.
-platform = none
-
-# How much of the network configuration you supply, and therefore how much is
-# read from the system:
-#   manual     - interface names, int_addr and int_gateway_ip are all given
-#                below. Nothing is detected.
-#   interfaces - the two interface names are given; int_addr and
-#                int_gateway_ip are read from them.
-#   auto       - nothing is given. The interfaces are identified from the
-#                routing table. Convenient, and able to get it wrong.
-mode = manual
-
-[interfaces]
-# External faces the untrusted network; internal faces the protected one.
-# Required in manual and interfaces mode; worked out for you in auto mode.
-external =
-internal =
-
-[wan]
-# This router's fully-qualified domain name.
-local_fqdn =
-# Source of the local IKE identity: fqdn | public_ip | internal_ip
-#   fqdn        - use local_fqdn (must match what the peer expects)
-#   public_ip   - resolve local_fqdn at boot and use the address
-#   internal_ip - use the address on the internal interface
-local_id_mode = fqdn
-
-[local]
-# Local subnets advertised into the tunnel, comma-separated.
-cidrs =
-# This host's own address on the internal network, and the next hop on that
-# side for the subnets above. Both are required in manual mode and read from
-# the internal interface in the other two.
-int_addr =
-int_gateway_ip =
-
-[remote]
-# Remote gateway address(es) or FQDN, comma-separated.
-addrs =
-# Remote IKE identity, without a leading '@'.
-id =
-# Remote subnets reachable through the tunnel, comma-separated.
-cidrs =
-# Pre-shared key, base64-encoded:  printf %s "$PSK" | base64 -w0
-psk_b64 =
-# Path to a file containing the raw PSK. Takes precedence over psk_b64.
-psk_file =
-
-[p2s]
-# Road-warrior access.
-enabled = false
-# Address pool handed to road-warrior clients.
-address_pool =
-# CN for the CA created when /etc/vpn-router/pki is empty.
-ca_name = VPN Router CA
-
-[wireguard]
-enabled = false
-# Address and prefix length for wg0, for example 192.168.200.1/24.
-address =
-listen_port = 51820
@@ -0,0 +1,36 @@
+{
+  "general": {
+    "platform": "generic",
+    "mode": "manual"
+  },
+  "interfaces": {
+    "external": "eth0",
+    "internal": "eth1"
+  },
+  "wan": {
+    "local_fqdn": "router.example.com",
+    "local_id_mode": "fqdn"
+  },
+  "local": {
+    "cidrs": ["10.0.0.0/24"],
+    "int_addr": "10.1.1.4",
+    "int_gateway_ip": "10.1.1.1"
+  },
+  "remote": {
+    "addrs": ["peer.example.net"],
+    "id": "peer.example.net",
+    "cidrs": ["192.168.0.0/24"],
+    "psk": "change-me",
+    "psk_file": ""
+  },
+  "p2s": {
+    "enabled": false,
+    "address_pool": "172.16.0.0/24",
+    "ca_name": "VPN Router CA"
+  },
+  "wireguard": {
+    "enabled": false,
+    "address": "192.168.200.1/24",
+    "listen_port": 51820
+  }
+}