Tunnel configuration

Each enabled tunnel gets an isolated namespace. Provider files are loaded from source, described under Subscriptions; routes, DNS, and probes are separate policy fields.

`tunnels[].id`

Type: string
Required: Yes
Default: None
Validation: Unique, at most 12 characters, lowercase alphanumeric with internal hyphens; direct is reserved.
Secret classification: No; identifier metadata.
Side effects: Names namespaces, interfaces, transient units, nftables sets, and state files.
Minimal example: edge-wg

`tunnels[].type`

Type: enum
Required: Yes
Default: None
Validation: One of wireguard, amneziawg, xray, or openvpn.
Secret classification: No.
Side effects: Selects the provider parser, interface, and egress driver.
Minimal example: wireguard

`tunnels[].role`

Type: enum
Required: Yes
Default: None
Validation: One of egress or private-network.
Secret classification: No.
Side effects: Egress is selected per device; private-network is selected by route or private DNS answer.
Minimal example: egress

`tunnels[].enabled`

Type: nullable boolean
Required: No
Default: true when absent
Validation: Cannot be false while an enrolled device selects this tunnel as egress.
Secret classification: No.
Side effects: A disabled tunnel is omitted from desired state and removed instead of being built idle.
Minimal example: enabled: false

`tunnels[].allowed_devices[]`

Type: array of device IDs
Required: No
Default: Empty, meaning all enrolled devices
Validation: Every ID must name an existing device.
Secret classification: No; access-policy metadata.
Side effects: Limits default egress, private-network access, and the tunnel's SOCKS endpoint.
Minimal example: allowed_devices: [laptop]

tunnels:
  - id: edge-wg
    type: wireguard
    role: egress
    source:
      kind: config
      value: secrets/edge-wg.conf
    allowed_devices: [laptop]

Move assigned devices before disabling an egress; validation refuses silent failover.

Next: choose WireGuard, AmneziaWG, Xray/VLESS, or OpenVPN.