profile-psk.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>PayloadDisplayName</key>
        <string>${PROFILE_NAME} (${REMOTE_ADDRESS})</string>
        <key>PayloadDescription</key>
        <string>Configures VPN (IKEv2) settings for ${REMOTE_ADDRESS}</string>
        <key>PayloadIdentifier</key>
        <string>${PROFILE_ID}</string>
        <key>PayloadUUID</key>
        <string>${PROFILE_UUID}</string>
        <key>PayloadType</key>
        <string>Configuration</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
        <key>PayloadContent</key>
        <array>
            <dict>
                <key>UserDefinedName</key>
                <string>${SERVICE_NAME_ALT}</string>
                <key>PayloadDisplayName</key>
                <string>${SERVICE_NAME}</string>
                <key>PayloadIdentifier</key>
                <string>${SERVICE_ID}</string>
                <key>PayloadUUID</key>
                <string>${SERVICE_UUID}</string>
                <key>PayloadType</key>
                <string>com.apple.vpn.managed</string>
                <key>PayloadVersion</key>
                <integer>1</integer>
                <key>VPNType</key>
                <string>IKEv2</string>
                <key>IKEv2</key>
                <dict>
                    <key>OnDemandEnabled</key>
                    <false/>
                    <key>OnDemandRules</key>
                    <array>
                        <dict>
                            <key>Action</key>
                            <string>Connect</string>
                        </dict>
                    </array>
                    <key>RemoteAddress</key>
                    <string>${REMOTE_ADDRESS}</string>
                    <key>RemoteIdentifier</key>
                    <string>${REMOTE_ID}</string>
                    <key>LocalIdentifier</key>
                    <string>${LOCAL_ID}</string>
                    <key>AuthenticationMethod</key>
                    <string>SharedSecret</string>
                    <key>SharedSecret</key>
                    <string>${SHARED_SECRET}</string>
                    <key>DeadPeerDetectionRate</key>
                    <string>High</string>
                    <key>EnablePFS</key>
                    <true/>
                    <key>IKESecurityAssociationParameters</key>
                    <dict>
                        <key>EncryptionAlgorithm</key>
                        <string>AES-256-GCM</string>
                        <key>IntegrityAlgorithm</key>
                        <string>SHA2-384</string>
                        <key>DiffieHellmanGroup</key>
                        <integer>20</integer>
                    </dict>
                    <key>ChildSecurityAssociationParameters</key>
                    <dict>
                        <key>EncryptionAlgorithm</key>
                        <string>AES-256-GCM</string>
                        <key>IntegrityAlgorithm</key>
                        <string>SHA2-384</string>
                        <key>DiffieHellmanGroup</key>
                        <integer>20</integer>
                    </dict>
                </dict>
                <key>DNS</key>
                <dict>
                    <key>ServerAddresses</key>
                    <array>
                        <!-- Cloudflare -->
                        <string>1.1.1.1</string>
                        <string>1.0.0.1</string>
                        <string>2606:4700:4700::1111</string>
                        <string>2606:4700:4700::1001</string>
                        <!-- Quad9 -->
                        <string>9.9.9.9</string>
                        <string>149.112.112.112</string>
                        <string>2620:fe::fe</string>
                        <string>2620:fe::9</string>
                    </array>
                </dict>
            </dict>
        </array>
    </dict>
</plist>