# MeduzaVPN -- /etc/config/meduzavpn
#
# This file is the source of truth for the router's VPN, in the format OpenWrt
# uses for everything else: you can edit it over SSH, `uci set` it from a
# script, and `sysupgrade` keeps it across a firmware update. The daemon does
# not read it directly -- /etc/init.d/meduzavpn translates it into the settings
# file the daemon understands and regenerates that on every start -- so what is
# written here always wins.
#
# After changing anything:  /etc/init.d/meduzavpn reload

config meduzavpn 'general'
	# Shipped off. Installing software must not be the same act as handing the
	# household's routing table to a new owner, and nothing can connect before
	# `meduzavpn login` has signed this router in anyway.
	option enabled '0'

	# Which VPN on the account, when it has more than one. Either its id, or
	# any unambiguous part of its name or location -- 'nl-ams', 'amsterdam'
	# and 'nl' all work if only one VPN matches. Empty is correct when the
	# account has exactly one; it is an error, naming the choices, when it has
	# several, because guessing would be a coin flip with the traffic.
	option service_id ''
	# A second spelling of the same thing, for the reader who thinks in
	# locations. Ignored when service_id is set.
	option location ''

	# How the protocol is chosen.
	#
	#   auto            try each in turn: ULTRA, AmneziaWG, Hysteria, VLESS,
	#                   WireGuard, OpenVPN -- the ones that survive a network
	#                   that interferes first, the ones that work where nothing
	#                   interferes last.
	#   prefer:ultra    try that one first, then fall back to the rest.
	#   only:wireguard  that one or nothing. For the operator who would rather
	#                   have no tunnel than an unexpected one.
	#
	# Whatever this says, a candidate is brought up in a routing table of its
	# own and tested there. The router's default route moves only to a protocol
	# that has already carried real bytes, so a blocked protocol costs a few
	# seconds and never takes the house offline. What worked is remembered per
	# uplink, so the next boot starts with it instead of walking the list again.
	option protocol 'auto'

	# Connect by itself: at boot, and again whenever the tunnel is found down.
	# This is the setting that makes a router a router -- there is nobody to
	# type `meduzavpn connect` after a power cut.
	#
	# It also means `meduzavpn disconnect` lasts about half a minute: the daemon
	# finds the tunnel down and puts it back. To keep it down, turn this off, or
	# set enabled='0', and `/etc/init.d/meduzavpn reload`.
	option auto_connect '1'

	# Read this before turning it on.
	#
	# A kill switch means "if the tunnel is down, let nothing out". On a phone
	# that protects one person. On a router it takes the internet away from
	# everyone in the house -- the televisions, the work laptop, somebody's
	# video call -- and it does so at the moment the VPN is already broken, so
	# there is no warning anybody will see. It also blocks the router's own
	# traffic, which means the LuCI page you would use to turn it back off may
	# be unreachable; recovering needs SSH, or the reset button.
	#
	# The LAN and the router itself are never blocked, so LuCI from inside the
	# house keeps working. The rest of the house does not.
	option killswitch '0'

	# DNS servers to use instead of the ones the VPN pushes. Leave empty to use
	# the VPN's own, which is usually what you want: a resolver outside the
	# tunnel can undo the point of having one.
	# list dns '1.1.1.1'
	# list dns '1.0.0.1'

	# 0 lets each protocol choose. Set it only if a link is known to need it.
	option mtu '0'

	# Whether to route IPv6 through the tunnel as well. Off by default: a VPN
	# profile without IPv6 plus a router that still advertises native IPv6 to
	# the house is how traffic leaves beside the tunnel without anybody
	# noticing, and turning this on without an IPv6-capable profile breaks v6
	# outright.
	option ipv6 '0'

	# error, warn, info or debug. `logread -e meduzavpn` reads it.
	option log_level 'info'

	# Staging or a local API. Leave empty for production.
	option api_base ''

# Per-device policy: which of the machines behind this router go through the
# tunnel and which go straight out. This is the whole reason a router is worth
# doing -- a Samsung or LG television knows nothing about VPNs, and its traffic
# is tunnelled because a rule here says so.
#
# NOT YET ENFORCED. The section is documented and parsed so that configuration
# written today survives, but this version of the daemon routes the whole house
# the same way; a policy section present in this file makes the init script say
# so in the log rather than being silently ignored. Until it lands, everything
# behind the router follows the tunnel.
#
# config policy
#	option match 'mac:AA:BB:CC:DD:EE:FF'   # or ip:192.168.1.50
#	option route 'direct'                  # vpn | direct
