# Advanced server example. Values are placeholders, not credentials.

[server]
listen = "0.0.0.0"

[backend]
target = "127.0.0.1:51820"

[network]
# Default application payload; configurable up to the 16384-byte safety ceiling.
max_datagram_size = 1200

[transports.direct_udp]
enabled = true
port = 51830

[transports.quic]
enabled = true
port = 443

[transports.http3]
enabled = true
port = 4443
path = "/tunnel"

[transports.tls_tcp]
enabled = true
port = 443

# Required when TLS-capable transports are enabled.
[tls]
certificate = "/etc/letsencrypt/live/vpn.example.invalid/fullchain.pem"
private_key = "/etc/letsencrypt/live/vpn.example.invalid/privkey.pem"

[session]
idle_timeout_secs = 120

[limits]
max_sessions = 1024
max_sessions_per_ip = 32
max_pending_handshakes = 256
handshake_timeout_ms = 3000

[[auth.clients]]
id = "laptop"
secret_file = "/etc/wgcloak/clients/laptop.secret"

[[auth.clients]]
id = "desktop"
secret_file = "/etc/wgcloak/clients/desktop.secret"

[logging]
level = "info"