</code></pre></div></details><p>Below you will find sections like <ahref=#core><code>core</code></a>, <ahref=#advanced><code>advanced</code></a>, <ahref=#database><code>database</code></a>, <ahref=#statistics><code>statistics</code></a>, <ahref=#mail><code>mail</code></a>, <ahref=#auth><code>auth</code></a> and <ahref=#web><code>web</code></a>.<br> Each section describes the individual configuration keys, their default values, and a brief explanation of their purpose.</p><hr><h2id=core>Core</h2><p>These are the primary configuration options that control fundamental WireGuard Portal behavior. More advanced options are found in the subsequent <code>Advanced</code> section.</p><h3id=admin_user><code>admin_user</code></h3><ul><li><strong>Default:</strong><code>admin@wgportal.local</code></li><li><strong>Description:</strong> The administrator user. This user will be created as a default admin if it does not yet exist.</li></ul><h3id=admin_password><code>admin_password</code></h3><ul><li><strong>Default:</strong><code>wgportal</code></li><li><strong>Description:</strong> The administrator password. The default password of <code>wgportal</code> should be changed immediately.</li></ul><h3id=admin_api_token><code>admin_api_token</code></h3><ul><li><strong>Default:</strong><em>(empty)</em></li><li><strong>Description:</strong> An API token for the admin user. If a token is provided, the REST API can be accessed using this token. If empty, the API is initially disabled for the admin user.</li></ul><h3id=editable_keys><code>editable_keys</code></h3><ul><li><strong>Default:</strong><code>true</code></li><li><strong>Description:</strong> Allow editing of WireGuard key-pairs directly in the UI.</li></ul><h3id=create_default_peer><code>create_default_peer</code></h3><ul><li><strong>Default:</strong><code>false</code></li><li><strong>Description:</strong> If a user logs in for the first time with no existing peers, automatically create a new WireGuard peer for <strong>all</strong> server interfaces.</li></ul><h3id=create_default_peer_on_creation><code>create_default_peer_on_creation</code></h3><ul><li><strong>Default:</strong><code>false</code></li><li><strong>Description:</strong> If an LDAP user is created (e.g., through LDAP sync) and has no peers, automatically create a new WireGuard peer for <strong>all</strong> server interfaces.</li></ul><h3id=re_enable_peer_after_user_enable><code>re_enable_peer_after_user_enable</code></h3><ul><li><strong>Default:</strong><code>true</code></li><li><strong>Description:</strong> Re-enable all peers that were previously disabled if the associated user is re-enabled.</li></ul><h3id=delete_peer_after_user_deleted><code>delete_peer_after_user_deleted</code></h3><ul><li><strong>Default:</strong><code>false</code></li><li><strong>Description:</strong> If a user is deleted, remove all linked peers. Otherwise, peers remain but are disabled.</li></ul><h3id=self_provisioning_allowed><code>self_provisioning_allowed</code></h3><ul><li><strong>Default:</strong><code>false</code></li><li><strong>Description:</strong> Allow registered (non-admin) users to self-provision peers from their profile page.</li></ul><h3id=import_existing><code>import_existing</code></h3><ul><li><strong>Default:</strong><code>true</code></li><li><strong>Description:</strong> On startup, import existing WireGuard interfaces and peers into WireGuard Portal.</li></ul><h3id=restore_state><code>restore_state</code></h3><ul><li><strong>Default:</strong><code>true</code></li><li><strong>Description:</strong> Restore the WireGuard interface states (up/down) that existed before WireGuard Portal started.</li></ul><hr><h2id=advanced>Advanced</h2><p>Additional or more specialized configuration options for logging and interface creation details.</p><h3id=log_level><code>log_level</code></h3><ul><li><strong>Default:</strong><code>info</code></li><li><strong>Description:</strong> The log level used by the application. Valid options are: <code>trace</c
</code></pre></div></li></ul><hr><h2id=statistics>Statistics</h2><p>Controls how WireGuard Portal collects and reports usage statistics, including ping checks and Prometheus metrics.</p><h3id=use_ping_checks><code>use_ping_checks</code></h3><ul><li><strong>Default:</strong><code>true</code></li><li><strong>Description:</strong> Enable periodic ping checks to verify that peers remain responsive.</li></ul><h3id=ping_check_workers><code>ping_check_workers</code></h3><ul><li><strong>Default:</strong><code>10</code></li><li><strong>Description:</strong> Number of parallel worker processes for ping checks.</li></ul><h3id=ping_unprivileged><code>ping_unprivileged</code></h3><ul><li><strong>Default:</strong><code>false</code></li><li><strong>Description:</strong> If <code>false</code>, ping checks run without root privileges. This is currently considered BETA.</li></ul><h3id=ping_check_interval><code>ping_check_interval</code></h3><ul><li><strong>Default:</strong><code>1m</code></li><li><strong>Description:</strong> Interval between consecutive ping checks for all peers. Format uses <code>s</code>, <code>m</code>, <code>h</code>, <code>d</code> for seconds, minutes, hours, days, see <ahref=https://golang.org/pkg/time/#ParseDuration>time.ParseDuration</a>.</li></ul><h3id=data_collection_interval><code>data_collection_interval</code></h3><ul><li><strong>Default:</strong><code>1m</code></li><li><strong>Description:</strong> Interval between data collection cycles (bytes sent/received, handshake times, etc.). Format uses <code>s</code>, <code>m</code>, <code>h</code>, <code>d</code> for seconds, minutes, hours, days, see <ahref=https://golang.org/pkg/time/#ParseDuration>time.ParseDuration</a>.</li></ul><h3id=collect_interface_data><code>collect_interface_data</code></h3><ul><li><strong>Default:</strong><code>true</code></li><li><strong>Description:</strong> If <code>true</code>, collects interface-level data (bytes in/out) for monitoring and statistics.</li></ul><h3id=collect_peer_data><code>collect_peer_data</code></h3><ul><li><strong>Default:</strong><code>true</code></li><li><strong>Description:</strong> If <code>true</code>, collects peer-level data (bytes, last handshake, endpoint, etc.).</li></ul><h3id=collect_audit_data><code>collect_audit_data</code></h3><ul><li><strong>Default:</strong><code>true</code></li><li><strong>Description:</strong> If <code>true</code>, logs certain portal events (such as user logins) to the database.</li></ul><h3id=listening_address><code>listening_address</code></h3><ul><li><strong>Default:</strong><code>:8787</code></li><li><strong>Description:</strong> Address and port for the integrated Prometheus metric server (e.g., <code>:8787</code>).</li></ul><hr><h2id=mail>Mail</h2><p>Options for configuring email notifications or sending peer configurations via email.</p><h3id=host><code>host</code></h3><ul><li><strong>Default:</strong><code>127.0.0.1</code></li><li><strong>Description:</strong> Hostname or IP of the SMTP server.</li></ul><h3id=port><code>port</code></h3><ul><li><strong>Default:</strong><code>25</code></li><li><strong>Description:</strong> Port number for the SMTP server.</li></ul><h3id=encryption><code>encryption</code></h3><ul><li><strong>Default:</strong><code>none</code></li><li><strong>Description:</strong> SMTP encryption type. Valid values: <code>none</code>, <code>tls</code>, <code>starttls</code>.</li></ul><h3id=cert_validation><code>cert_validation</code></h3><ul><li><strong>Default:</strong><code>true</code></li><li><strong>Description:</strong> If <code>true</code>, validate the SMTP server certificate (relevant if <code>encryption</code> = <code>tls</code>).</li></ul><h3id=username><code>username</code></h3><ul><li><strong>Default:</strong><em>(empty)</em></li><li><strong>Description:</strong> Optional SMTP username for authentication.</li></ul><h3id=password><code>password</code></h3><ul><li><strong>Default:</strong><em>(empty)</em></li><li><strong>Descriptio
</code></pre></div></li></ul><h4id=admin_group><code>admin_group</code></h4><ul><li><strong>Default:</strong><em>(empty)</em></li><li><strong>Description:</strong> A specific LDAP group whose members are considered administrators in WireGuard Portal. For example: <divclass=highlight><pre><span></span><code>CN=WireGuardAdmins,OU=Some-OU,DC=YOURDOMAIN,DC=LOCAL
</code></pre></div></li></ul><h4id=sync_interval><code>sync_interval</code></h4><ul><li><strong>Default:</strong><em>(empty)</em></li><li><strong>Description:</strong> How frequently (in duration, e.g. <code>30m</code>) to synchronize users from LDAP. Empty or <code>0</code> disables sync. Format uses <code>s</code>, <code>m</code>, <code>h</code>, <code>d</code> for seconds, minutes, hours, days, see <ahref=https://golang.org/pkg/time/#ParseDuration>time.ParseDuration</a>. Only users that match the <code>sync_filter</code> are synchronized, if <code>disable_missing</code> is <code>true</code>, users not found in LDAP are disabled.</li></ul><h4id=sync_filter><code>sync_filter</code></h4><ul><li><strong>Default:</strong><em>(empty)</em></li><li><strong>Description:</strong> An LDAP filter to select which users get synchronized into WireGuard Portal. For example: <divclass=highlight><pre><span></span><code>(&(objectClass=organizationalPerson)(!userAccountControl:1.2.840.113556.1.4.803:=2)(mail=*))
