# vpsmgr config example — generated at /etc/vpsmgr/config.yaml on install
panel:
  listen: ":8443"           # a FRESH install picks a random free port in 2000-9999;
                            # this line is where it lands (change it only if you know why)
  cert: /etc/vpsmgr/panel.crt
  key: /etc/vpsmgr/panel.key
  db: /etc/vpsmgr/vpsmgr.db
  public_ip: AUTO          # NIC IPv4 used by firewall/routing (private on NAT-ing clouds like AWS/Alibaba)
  display_ip: AUTO         # optional: address shown to users (panel URL / SSH hints); any string without spaces (IP or domain)
                           # auto-fetched from ipv4.ip.sb when public_ip is private; empty = fall back to public_ip
  title: VPS Manager       # name on the login page and in the panel header; empty = "VPS Manager"
  session_days: 3
  url_path: AUTO           # 10-char random [a-zA-Z0-9_-] secret prefix, generated once at install
  admin_url_path: AUTO     # 10-char random secret prefix for the ADMIN panel; can be
                           # changed later or set to empty to disable the admin panel
  admin_pass_hash: AUTO     # bcrypt hash of the admin panel password; generated at install,
                            # reset via `vps admin-passwd`. No admin username — password only.

net:
  # Container subnet 10.<n>.0.0/24, chosen ONCE at install (second octet n,
  # default 115). Immutable: changing it after install breaks existing
  # containers. The port scheme is fixed too: each container gets a random SSH
  # port from 30000-31999 plus a whole-hundred block of 100 user ports.
  subnet: "10.115.0.0/24"
  gateway: "10.115.0.1"
  # User-port ranges a NEW container's 100-port block is drawn from
  # (comma-separated inclusive ranges; auto-aligned to whole hundreds).
  # Default 10000-29999 = 200 containers. Use e.g. "10000-20000, 25000-30000"
  # to skip a middle span the host needs for other services. Affects ONLY new
  # containers — existing ones keep their ports. Since the user-port span the
  # host reserves follows these ranges, an install's port-occupancy check scans
  # only them. SSH ports (30000-31999) are NOT checked at install — each is
  # probed at `vps add` time, and a busy port is simply skipped.
  user_ports: "10000-29999"
  v4_forward: true            # true = direct IPv4 SSH/port forwarding
                              # false = IPv4 inbound fully off
                              # web-only = public IPv4 + HAProxy 80/443 domains,
                              #            no direct IPv4 SSH/port forwarding
                              # NAT4 outbound remains enabled in every mode
  haproxy: true               # domain proxy (HAProxy). true = running and enabled
                              # at boot; false = stopped and disabled at boot, with
                              # existing domain records kept but no new domains
                              # accepted. Renamed from `traefik` — same values; a
                              # Traefik-era config carrying `traefik:` is read as-is
                              # and rewritten under the new name. Toggle at runtime:
                              # vps config set net.haproxy true|false
  ext_if: AUTO             # detected from default route
  ipv6_mode: none          # fixed at install: none, prefix, or pool
  ipv6_subnet: ""          # optional: global prefix for IPv6 pass-through, e.g. "2602:fada:6::/64".
                           # /64 or shorter uses the first /64; a provider /80 slice like
                           # "2406:da14:1dd2:a807:753a::/80" is also supported.
                           # empty = IPv6 disabled (default). Containers get global
                           # addresses via SLAAC; no NAT; set at install time.
  ipv6_pool: []            # optional (pool mode): bare global IPv6 addresses or /128;
                           # addresses are assigned to containers until they are deleted.

incus:
  image: "vpsmgr/debian-sshd"
  image_fallback: "images:debian/13"
  pool: vpsmgr
  bridge: incusbr0
  socket: "/var/lib/incus/unix.socket"
  swap_ratio: 0.5          # 0 = no container swap; 0.5 = memory allowance / 2

snapshots:
  limit: 1                 # 0 disables new snapshots