NVS Storage

NVS Storage Reference

All persistent configuration is stored in the device's NVS (Non-Volatile Storage) flash partition. Everything lives in a single namespace:

Namespace	esp32_nat (PARAM_NAMESPACE, defined in include/router_config.h)
Accessors	Most keys are read/written through the get_config_param_str / _int / _blob (and matching set_…) helper functions.
Key limit	NVS keys are limited to 15 characters, which is why many keys are abbreviated (e.g. vpn_ka, rc_bind, wd_s).
Types	str (string), blob (binary), u8/u16/u32 (unsigned ints), i32 (signed int, used as a boolean/enum flag).

Most settings can be changed from the Web Interface or the CLI (see CLI Reference); both read and write these same keys.

⚠️ Security note: With the exception of web_password (stored as a salted hash), all values — including Wi-Fi passwords and WireGuard private/preshared keys — are stored in flash in plaintext. A plaintext config export omits WireGuard secrets; only an encrypted export includes them. See Security.

---

Wi-Fi — Uplink (Station / STA)

Key	Type	Description
ssid	str	SSID of the upstream Wi-Fi network to connect to.
passwd	str	Pre-shared key (password) for the upstream network.
static_ip	str	Static IP for the STA interface. Empty = obtain via DHCP.
subnet_mask	str	Subnet mask used with static_ip.
gateway_addr	str	Gateway IP used with the static STA configuration.
mac	blob	STA MAC address override.
sta_band	i32	Preferred band: auto / 2.4 GHz / 5 GHz.
sta_ttl	i32	TTL override applied to routed STA packets (0 = no override).

Wi-Fi — Hotspot (Access Point / AP)

Key	Type	Description
ap_ssid	str	SSID broadcast by the device's own hotspot.
ap_passwd	str	Password for the hotspot (empty = open network).
ap_ip	str	The hotspot's own IP / gateway for AP clients (default 192.168.4.1).
ap_dns	str	DNS server handed to AP clients (empty = use upstream DNS).
ap_mac	blob	AP MAC address override.
ap_channel	i32	AP Wi-Fi channel (0 = auto).
ap_authmode	i32	AP authentication mode (1 = WPA2, otherwise WPA3).
ap_hidden	i32	1 = hide the AP SSID (no broadcast).
ap_nat	i32	1 = NAT enabled for the AP, 0 = routed mode.
ap_disabled	i32	1 = hotspot disabled.

WPA2-Enterprise (uplink)

Used when the upstream network requires 802.1X / enterprise authentication.

Key	Type	Description
eap_method	i32	EAP method: 0=Auto, 1=PEAP, 2=TTLS, 3=TLS.
ent_username	str	Enterprise username.
ent_identity	str	Anonymous / outer identity (defaults to username if empty).
ttls_phase2	i32	TTLS phase-2 auth: 0=MSCHAPv2, 1=MSCHAP, 2=PAP, 3=CHAP.
cert_bundle	i32	1 = validate the server certificate against the bundled CA store, 0 = off.
no_time_chk	i32	1 = skip the certificate validity-period (time) check.

NAT, DHCP & Port Forwarding

Key	Type	Description
portmap_tab	blob	Port-forwarding table (NAT inbound mappings). See Firewall.
dhcp_res	blob	Static DHCP reservations (MAC → IP leases).

WireGuard VPN

See WireGuard VPN for full details.

Key	Type	Description
vpn_enabled	i32	1 = WireGuard tunnel enabled.
vpn_privkey	str	This device's WireGuard private key.
vpn_pubkey	str	Peer (server) public key.
vpn_psk	str	Optional preshared key for the peer.
vpn_endpoint	str	Peer endpoint host/IP.
vpn_port	i32	Peer endpoint UDP port.
vpn_ip	str	Tunnel (interface) IP address assigned to this device.
vpn_mask	str	Tunnel subnet mask.
vpn_dns	str	DNS server to use while the tunnel is up.
vpn_ka	i32	Persistent keepalive interval, in seconds (0 = off).
vpn_rall	i32	1 = route all traffic through the tunnel (default), 0 = split tunnel.
vpn_ks	i32	Kill switch: block traffic if the tunnel drops.

System & Radio

Key	Type	Description
hostname	str	DHCP (Option 12) and mDNS hostname (<hostname>.local). Empty = default espressif.
tz	str	POSIX timezone string (e.g. CET-1CEST,M3.5.0,M10.5.0/3).
wifi_cc	str	Wi-Fi country/regulatory code (e.g. US, DE).
tx_power	i32	Wi-Fi TX power in dBm (valid range 2–20).
rf_switch	i32	1 = enable the external-antenna RF switch (XIAO ESP32-C6).
wd_s	i32	Reconnect watchdog timeout, in seconds (0 = disabled).
cstats_en	i32	1 = per-client traffic statistics enabled.
log_level	u8	System log verbosity level.

Web Interface

Key	Type	Description
web_password	str	Admin password for the web UI, stored as a salted hash. Empty = no password protection.
web_port	i32	Web UI TCP port (default 80).
web_bind	i32	Web UI interface bind bitmask (AP / STA).
web_disabled	str	Web server disabled flag.

Display & LEDs

See Hardware.

Key	Type	Description
oled_en	i32	1 = OLED status display enabled.
oled_sda	i32	I²C SDA GPIO pin for the OLED.
oled_scl	i32	I²C SCL GPIO pin for the OLED.
led_gpio	i32	Status LED GPIO (-1 = none).
led_low	i32	1 = status LED is active-low.
ls_gpio	i32	Addressable LED-strip (e.g. WS2812) GPIO (-1 = disabled).

Remote Console

See Remote Console.

Key	Type	Description
rc_enabled	u8	1 = remote (telnet-style) console enabled.
rc_port	u16	TCP port the remote console listens on.
rc_bind	u8	Interface bind bitmask (AP / STA).
rc_timeout	u32	Idle session timeout, in seconds.

Syslog

See Syslog.

Key	Type	Description
syslog_en	u8	1 = remote syslog forwarding enabled.
syslog_srv	str	Syslog server host/IP.
syslog_port	u16	Syslog server UDP port.

MQTT / Home Assistant

See MQTT Home Assistant.

Key	Type	Description
mqtt_en	i32	1 = MQTT publishing enabled.
mqtt_uri	str	MQTT broker URI (e.g. mqtt://host:1883).
mqtt_user	str	MQTT username.
mqtt_pass	str	MQTT password.
mqtt_intv	i32	Publish interval, in seconds.

---

Resetting

Erasing the NVS partition (factory reset) clears all of the keys above and restores compile-time defaults. This can be done from the CLI or by reflashing. See Installation and CLI Reference.