> ## Documentation Index
> Fetch the complete documentation index at: https://docs.siderolabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

> WireguardConfig is a config document to create and configure a Wireguard network link.

# WireguardConfig

```yaml theme={null}
apiVersion: v1alpha1
kind: WireguardConfig
name: wg1 # Name of the Wireguard link (interface).
privateKey: OJ34O6J1z4ZZB+t16c+vYrzIrKddxyU3Z2eLhwYzqE8= # Specifies a private key configuration (base64 encoded).
listenPort: 51820 # Specifies a device's listening port (UDP).
# Specifies a list of peer configurations to apply to a device.
peers:
    - publicKey: fP+xJZvUA5n1Pi/f5wcPiV6tZ6fHwqcGaXe98NfEgkE= # Specifies the public key of this peer.
      endpoint: 10.0.0.1:5180 # Specifies the endpoint of this peer entry.
      # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
      allowedIPs:
        - 192.168.2.0/24
    - publicKey: TDd25Cwq6tMZANIKUaqred+Zt+09HtCqwFeOLtKQ9Cs= # Specifies the public key of this peer.
      presharedKey: UpH8htYK7yJBPg5+q4M/Tx0o5ipHbeSZtI/h/mHxOeU= # Specifies the preshared key for this peer (base64 encoded).
      # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
      allowedIPs:
        - 192.168.3.0/24
mtu: 1420 # Configure LinkMTU (Maximum Transmission Unit) for the link.
# Configure addresses to be statically assigned to the link.
addresses:
    - address: 192.168.1.100/24 # IP address to be assigned to the link.
```

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`name`</td>
      <td>string</td>
      <td>Name of the Wireguard link (interface).</td>

      <td />
    </tr>

    <tr>
      <td>`privateKey`</td>
      <td>string</td>
      <td>Specifies a private key configuration (base64 encoded).<br />Can be generated by `wg genkey`.</td>

      <td />
    </tr>

    <tr>
      <td>`listenPort`</td>
      <td>int</td>
      <td>Specifies a device's listening port (UDP).<br />If not specified, a random port will be chosen.</td>

      <td />
    </tr>

    <tr>
      <td>`firewallMark`</td>
      <td>int</td>
      <td>Specifies a device's firewall mark.<br />Useful for advanced routing setups, marking packets originating from this device.</td>

      <td />
    </tr>

    <tr>
      <td>`peers`</td>
      <td><a href="#peers%5B%5D">WireguardPeer</a></td>
      <td>Specifies a list of peer configurations to apply to a device.</td>

      <td />
    </tr>

    <tr>
      <td>`up`</td>
      <td>bool</td>
      <td>Bring the link up or down.<br /><br />If not specified, the link will be brought up.</td>

      <td />
    </tr>

    <tr>
      <td>`mtu`</td>
      <td>uint32</td>
      <td>Configure LinkMTU (Maximum Transmission Unit) for the link.<br /><br />If not specified, the system default LinkMTU will be used (usually 1500).</td>

      <td />
    </tr>

    <tr>
      <td>`addresses`</td>
      <td><a href="#addresses%5B%5D">AddressConfig</a></td>
      <td>Configure addresses to be statically assigned to the link.</td>

      <td />
    </tr>

    <tr>
      <td>`routes`</td>
      <td><a href="#routes%5B%5D">RouteConfig</a></td>
      <td>Configure routes to be statically created via the link.</td>

      <td />
    </tr>

    <tr>
      <td>`multicast`</td>
      <td>bool</td>
      <td>Set the multicast capability of the link.</td>

      <td />
    </tr>
  </tbody>
</table>

## peers\[]

WireguardPeer describes a Wireguard peer configuration.

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`publicKey`</td>
      <td>string</td>
      <td>Specifies the public key of this peer.<br />Can be extracted from private key by running `wg pubkey < private.key`.</td>

      <td />
    </tr>

    <tr>
      <td>`presharedKey`</td>
      <td>string</td>
      <td>Specifies the preshared key for this peer (base64 encoded).<br />Can be generated by `wg genpsk`.<br />Optional, this key provides an additional layer of symmetric-key cryptography<br />to the peer connection.</td>

      <td />
    </tr>

    <tr>
      <td>`endpoint`</td>
      <td>AddrPort</td>
      <td>Specifies the endpoint of this peer entry.<br />Format: {"<"}IP address{">"}:{"<"}port{">"}.<br />If not set, the peer should connect to us without us connecting to it first.</td>

      <td />
    </tr>

    <tr>
      <td>`persistentKeepaliveInterval`</td>
      <td>Duration</td>
      <td>Specifies the persistent keepalive interval for this peer.<br />Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).</td>

      <td />
    </tr>

    <tr>
      <td>`allowedIPs`</td>
      <td>\[]Prefix</td>
      <td>AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.<br />These IPs will be routed to this peer, and defines which IPs this peer is allowed to use.</td>

      <td />
    </tr>
  </tbody>
</table>

## addresses\[]

AddressConfig represents a network address configuration.

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`address`</td>
      <td>Prefix</td>
      <td>IP address to be assigned to the link.<br /><br />This field must include the network prefix length (e.g. /24 for IPv4, /64 for IPv6).</td>

      <td />
    </tr>

    <tr>
      <td>`routePriority`</td>
      <td>uint32</td>
      <td>Configure the route priority (metric) for routes created for this address.<br /><br />If not specified, the system default route priority will be used.</td>

      <td />
    </tr>
  </tbody>
</table>

## routes\[]

RouteConfig represents a network route configuration.

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`destination`</td>
      <td>Prefix</td>
      <td>The route's destination as an address prefix.<br /><br />If not specified, a default route will be created for the address family of the gateway.</td>

      <td />
    </tr>

    <tr>
      <td>`gateway`</td>
      <td>Addr</td>
      <td>The route's gateway (if empty, creates link scope route).</td>

      <td />
    </tr>

    <tr>
      <td>`source`</td>
      <td>Addr</td>
      <td>The route's source address (optional).</td>

      <td />
    </tr>

    <tr>
      <td>`metric`</td>
      <td>uint32</td>
      <td>The optional metric for the route.</td>

      <td />
    </tr>

    <tr>
      <td>`mtu`</td>
      <td>uint32</td>
      <td>The optional MTU for the route.</td>

      <td />
    </tr>

    <tr>
      <td>`table`</td>
      <td>RoutingTable</td>
      <td>The routing table to use for the route.<br /><br />If not specified, the main routing table will be used.</td>

      <td />
    </tr>
  </tbody>
</table>