Template: vpn-router/platform
Type: select
Choices: none, generic, azure, gcp
Default: none
Description: Platform:
 Which platform this router runs on. The choice loads platform-specific
 additions, such as the provider DNS resolver for IKEv2 clients.
 .
 none defers configuration entirely: the package installs its files and
 changes nothing on the machine. Choose it when the router will be configured
 later by hand or by a configuration-management tool, then set the platform in
 /etc/vpn-router/vpn-router.json when you are ready.
 .
 generic configures the router with no platform-specific additions.

Template: vpn-router/mode
Type: select
Choices: manual, interfaces, auto
Default: manual
Description: Network configuration source:
 How much of the network configuration you are supplying, and therefore how
 much the package works out for itself:
 .
 manual - you give the interface names, the internal address and the internal
 gateway. Nothing is detected.
 .
 interfaces - you give the two interface names. The internal address and
 gateway are read from them.
 .
 auto - you give nothing. The interfaces are identified from the routing
 table and their addresses read from the system. Convenient, but it can pick
 the wrong interface and configure the machine incorrectly.

Template: vpn-router/external_interface
Type: string
Default:
Description: External network interface:
 Name of the interface facing the untrusted network, for example eth0 or
 ens4. The addresses strongSwan binds on are read from it, so they are never
 configured separately.

Template: vpn-router/internal_interface
Type: string
Default:
Description: Internal network interface:
 Name of the interface facing the protected network, for example eth1 or
 ens5. Routes for the local subnets are applied to it.

Template: vpn-router/int_addr
Type: string
Default:
Description: Internal interface address:
 This host's own address on the internal network. Asked only in manual mode;
 in the other modes it is read from the internal interface.

Template: vpn-router/local_fqdn
Type: string
Default:
Description: Local router FQDN:
 Fully-qualified domain name of this router (for example
 router.example.com). Used as the IKEv2 server identity and
 certificate common name.

Template: vpn-router/local_id_mode
Type: select
Choices: fqdn, public_ip, internal_ip
Default: fqdn
Description: IKE local identity mode:
 How to derive the IKE identity the first site-to-site connection
 advertises to the remote site:
 .
 fqdn - use the FQDN, which must match what the peer expects.
 .
 public_ip - resolve the FQDN and use the address it returns.
 .
 internal_ip - use the internal NIC address.

Template: vpn-router/local_cidrs
Type: string
Default:
Description: Local subnet CIDR(s):
 Comma-separated list of local subnet CIDRs routed by this router and
 advertised into the first site-to-site connection (for example
 10.0.0.0/24 or 10.0.0.0/24,10.0.1.0/24).

Template: vpn-router/int_gateway_ip
Type: string
Default:
Description: Internal network gateway address:
 Address of the next-hop gateway on the internal side, used to route the
 local subnets listed above. Asked only in manual mode; in the other modes it
 is derived from the internal interface.

Template: vpn-router/remote_addrs
Type: string
Default:
Description: Remote site WAN IP address(es):
 Comma-separated list of remote gateway addresses or FQDNs for the
 first site-to-site connection.

Template: vpn-router/remote_id
Type: string
Default:
Description: Remote site IKE identity:
 IKE identity of the remote peer of the first site-to-site connection,
 without a leading @.

Template: vpn-router/remote_cidrs
Type: string
Default:
Description: Remote subnet CIDR(s):
 Comma-separated list of remote subnet CIDRs reachable through the
 first site-to-site connection (for example 192.168.0.0/24).

Template: vpn-router/psk
Type: password
Description: Pre-shared key (PSK):
 Pre-shared key of the first site-to-site connection. Must match the value
 configured on the remote peer. Stored in the configuration file and cleared
 from the debconf database after installation.

Template: vpn-router/p2s_enabled
Type: boolean
Default: false
Description: Enable IKEv2 access?
 If enabled, this router accepts IKEv2 EAP-TLS connections from individual
 clients, with certificates of the router's P2S issuing CA.

Template: vpn-router/p2s_address_pool
Type: string
Default:
Description: IKEv2 address pool:
 CIDR block assigned to IKEv2 clients (for example 172.16.0.0/24).

Template: vpn-router/pki_root_name
Type: string
Default: VPN Router Root CA
Description: Root CA name:
 Common name of the root certificate authority the router creates in
 /etc/vpn-router/pki/root. Ignored when a root certificate is placed there.

Template: vpn-router/wg_enabled
Type: boolean
Default: false
Description: Enable WireGuard?
 If enabled, WireGuard is configured on wg0, a key pair is generated, and
 the matching firewall rule is installed. Peers are added by editing
 /etc/wireguard/wg0.conf.

Template: vpn-router/wg_address
Type: string
Default:
Description: WireGuard interface address:
 Address and prefix length for the wg0 interface (for example
 192.168.200.1/24).

Template: vpn-router/wg_listen_port
Type: string
Default: 51820
Description: WireGuard listen port:
 UDP port that WireGuard listens on.