Default Configuration Settings
Overview of Wiretastix's default configuration parameters.
Wiretastix uses a set of default configuration parameters that govern various aspects of its operation, including WireGuard peer settings, user management, and authentication behavior. These defaults can be viewed and modified using the wiretastix-cli config list command or through the API.
The table below shows the value each parameter is seeded with the first time the database schema is created (a brand-new install has these values from the start, not “no value”) – and, separately, what actually happens if you config delete a parameter or otherwise end up with it unset. For most parameters those two things match. For a few, they don’t, and that gap is worth knowing about before you go deleting things.
| Parameter | Seeded Value | Description |
|---|---|---|
additional_ports | (none) | Identifies other UDP ports, besides the main Wiretastix port, that will be forwarded. This can be useful for bypassing certain ISP blocks. If unset, no additional ports are forwarded – functionally identical to being empty. |
auto_disable_on_auth_error | 1 (true) | Every reauthenticate_every interval, Wiretastix refreshes each user’s OIDC token with the IdP. When set to 1 (true), a refresh that fails with what looks like a genuine authorization problem (e.g. a revoked or expired refresh token) automatically disables that user and all their tunnels – useful for automatic de-provisioning. Failures that look like an infrastructure problem instead (the IdP is unreachable, times out, or returns a 5xx) are deliberately not treated as an auth failure and do not disable the user, so a temporary IdP outage doesn’t lock everyone out. If unset, defaults to 1 (same as seeded) – fails safe toward disabling. |
default_allowed_ips | 192.168.1.0/24 | Default allowed IP ranges for new WireGuard peers – change this to match your actual internal network before onboarding real users. If unset (e.g. after config delete), there is no built-in fallback: new peers get an empty AllowedIPs, not the seeded value or any other default. Set it explicitly rather than deleting it. |
default_dns | 1.1.1.1,8.8.8.8 | Default DNS server(s) assigned to new WireGuard peers. Multiple resolvers can be specified, separated by a comma. If unset, falls back to a hardcoded 8.8.8.8,1.1.1.1 (the same two resolvers, reverse preference order) – functionally equivalent, so this one is safe to delete. |
default_endpoint | 192.168.0.1:51820 | The address (IP or hostname) and port clients use to reach the Wiretastix VPN concentrator – this seeded value is a non-functional placeholder and must be changed to your real public endpoint before anyone can connect. This often matches the web interface’s hostname, but can differ if the GUI sits behind a proxy while WireGuard listens on a different address. There is no fallback if it’s unset: generating any peer’s client config fails outright with “cannot find any suitable endpoint for the client,” for every peer, not just new ones – this is the one other parameter (besides default_group) with a hard failure mode instead of a soft one. |
default_group | fallback | When a user authenticates, their OIDC group claims are considered and they’re assigned to the first matching group (by priority). If none of their claims match an existing, enabled group, default_group is tried as a last resort. The seeded value is just the string "fallback" – it does not create a group named fallback for you. Until you actually create an enabled group with that OIDC name (or point this at one that already exists), a fresh install behaves exactly as if default_group were unset: a user who doesn’t match a real group gets no group assigned, and self-service tunnel creation for that user fails outright (a generic “not found” error), rather than just proceeding without group-level settings. See Manage Groups. |
default_keepalive_seconds | 25 | The default PersistentKeepalive interval in seconds for new WireGuard peers. If unset, falls back to a hardcoded 30 – a different number, but not a meaningfully different behavior. |
default_mtu | 1280 | The default MTU (Maximum Transmission Unit) for new WireGuard peers. If unset, falls back to a hardcoded 1280 – identical to the seeded value. |
default_search | localdomain | Sets the search domain for WireGuard clients. If unset, falls back to no search domain at all (empty) rather than localdomain – functionally different from the seeded default, though rarely consequential. |
max_devices | 100 (SQLite) / 1 (Postgres) | The device limit assigned to a user the first time they authenticate, unless their first matching group’s max-devices overrides it. The seeded value itself differs by database backend – worth knowing if you compare a SQLite test instance against a Postgres production one. If unset entirely, code falls back to 1 regardless of backend, logging a warning. |
new_devices_enabled | 1 (true) | Determines if newly created WireGuard tunnels are active by default. Setting this to 0 (false) can be useful for reviewing and manually authorizing new VPN tunnels, especially when policy mandates it. If unset, new tunnels default to inactive (0) – the opposite of the seeded value – so a deleted parameter here fails toward more restrictive, not less. |
new_users_enabled | 1 (true) | Determines if newly authenticated users are active by default. Setting this to 0 (false) can be appropriate for vetting new users before enabling them. A disabled user cannot create or use any tunnels. If unset, new users default to disabled (0) – the opposite of the seeded value – again failing toward more restrictive, not less. |
reauthenticate_every | 30m | The interval after which Wiretastix attempts to reauthenticate users with the OIDC IdP. If unset (or set to something that parses to zero), falls back to 15m, not 30m. |
These values can be overridden globally via the config set CLI command or through the API, and some can be further customized at the group or peer level. config delete <param> removes the stored row entirely rather than restoring the seeded value – for most parameters that lands on a safe or equivalent fallback (see above), but for default_allowed_ips, default_endpoint, and default_group there is either no fallback at all or one that isn’t obviously connected to what you deleted. Prefer config set to a value you intend, rather than config delete, for those three.