StratumVPN/env.example at main · AngelGonePro/StratumVPN · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
# ════════════════════════════════════════════════════════════════════
# VPN Manager — Server Configuration
# Copy this to .env and edit ALL values before running:
#   docker compose up -d --build
# ════════════════════════════════════════════════════════════════════

# ── Server public IP or domain ────────────────────────────────────────
# Used as WireGuard's SERVERURL — can be a domain or an IP.
SERVER_IP=cloud.cosmoscraft.net

# ── VPN tunnel subnets (used to add host routes so nginx can respond) ────
# WG_SUBNET: the INTERNAL_SUBNET set in docker-compose for WireGuard.
# Must match INTERNAL_SUBNET — default is 10.13.13.0/24.
WG_SUBNET=10.13.13.0/24

# SE_SUBNET: the IP range SoftEther/OpenVPN assigns to clients.
# Check your vpn_server.config or run: docker exec softether vpncmd ...
# Leave blank if you only use WireGuard.
SE_SUBNET=192.168.30.0/24

# ── Hairpin NAT: public IP(s) VPN clients should be able to reach ─────
# Comma-separated list of bare IPv4 addresses (NO domains, NO /32 suffix).
# The API writes each one as x.x.x.x/32 in iptables automatically.
# Why /32? UniFi and strict firewall parsers reject bare IPs in NAT rules.
#
# Use case: you want connected VPN clients to reach this server's own
# public IP without hitting a routing loop (the same issue wg-easy solves
# internally). Add every public IP this server is reachable on.
#
# Multiple IPs (e.g. dual-homed or multiple servers sharing this config):
#   PUBLIC_IPS=45.79.25.46,203.0.113.10
PUBLIC_IPS=0.0.0.0

# ── LAN / private IP of this host ─────────────────────────────────────
# The actual network interface IP on your server (not a container IP).
# Used as the hairpin NAT redirect target so traffic from VPN clients
# aimed at PUBLIC_IPS gets routed to the real interface instead of loopback.
LAN_IP=192.168.0.1

# ── CRITICAL: Absolute path to wg-data on the HOST machine ───────────
# This MUST be the real path on your server, not inside any container
HOST_WG_DATA=/root/softether-vpn/wg-data

# ── SoftEther Credentials ─────────────────────────────────────────────
SE_SERVER_PASSWORD=ChangeMe_ServerPassword
SE_HUB_PASSWORD=ChangeMe_HubPassword
SE_USERS=vpnuser:ChangeMe_UserPassword
SE_PSK=ChangeMe_PreSharedKey

# ── SoftEther Ports ───────────────────────────────────────────────────
PORT_OVPN_UDP=9194
PORT_OVPN_TCP=8443
PORT_SSL_ALT=9992
PORT_L2TP=9701
PORT_IKEV2=9000
PORT_IKEV2_NAT=9500
PORT_JSONRPC=9555
PORT_WEBUI=9765

# ── WireGuard ──────────────────────────────────────────────────────────
PORT_WIREGUARD=51820
WG_PEERS=5

# ── VPN routing (applies to WireGuard AllowedIPs AND OpenVPN routes) ──────
# Comma-separated CIDRs that VPN clients will route through this server.
#
# Full tunnel (default) — all client traffic goes through VPN:
#   VPN_ROUTES=0.0.0.0/0
#
# Split tunnel — only specific subnets (e.g. your LAN + server networks):
#   VPN_ROUTES=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
#
# The UI reads this via /wg-api/config and bakes it into every downloaded
# OpenVPN (.ovpn) and WireGuard (.conf) config automatically.
VPN_ROUTES=0.0.0.0/0

# ── WireGuard API key — also set wgApiKey in ui/index.html CFG block ──
WG_API_KEY=ChangeMe_WgApiKey