From 00a69567d9cf9e160bae99b555c02cbb7b4bad10 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Tue, 15 Sep 2026 17:10:15 -0400
Subject: [PATCH] Move interface stuff to the bottom

---
 manage/sites/configure-site.mdx | 137 ++++++++++++++++++--------------
 1 file changed, 77 insertions(+), 60 deletions(-)

diff --git a/manage/sites/configure-site.mdx b/manage/sites/configure-site.mdx
index 0655dd0..5f42df8 100644
--- a/manage/sites/configure-site.mdx
+++ b/manage/sites/configure-site.mdx
@@ -88,56 +88,6 @@ Almost every setting below can also be set via an environment variable (**Env va
   **Env var**: `CONFIG_FILE`
 </ResponseField>
 
-<ResponseField name="port" type="integer">
-  Port for the peers to connect to the site on. This can be used to keep a static port open in firewalls instead of default random ports.
-
-  **Example**: `34534`
-
-  **Env var**: `PORT`
-
-  **Config file key**: `port`
-</ResponseField>
-
-<ResponseField name="native" type="boolean">
-  Use a native WireGuard interface for client tunnels instead of the userspace netstack implementation.
-
-  **Default**: `false`
-
-  **Env var**: `USE_NATIVE_INTERFACE`
-
-  **Config file key**: `native`
-</ResponseField>
-
-<ResponseField name="native-main" type="boolean">
-  Use a native WireGuard interface for the main tunnel (instead of netstack).
-
-  **Default**: `false`
-
-  **Env var**: `USE_NATIVE_MAIN_INTERFACE`
-
-  **Config file key**: `nativeMain`
-</ResponseField>
-
-<ResponseField name="interface-main" type="string">
-  Name of the native main tunnel WireGuard interface (used with `--native-main`).
-
-  **Default**: `pangolin`
-
-  **Env var**: `INTERFACE_MAIN`
-
-  **Config file key**: `interfaceMain`
-</ResponseField>
-
-<ResponseField name="mtu" type="integer">
-  MTU for the internal WireGuard interface.
-
-  **Default**: `1280`
-
-  **Env var**: `MTU`
-
-  **Config file key**: `mtu`
-</ResponseField>
-
 <ResponseField name="dns" type="string">
   DNS server to use for resolving the endpoint.
 
@@ -272,16 +222,6 @@ Almost every setting below can also be set via an environment variable (**Env va
   **Config file key**: `disableSsh`
 </ResponseField>
 
-<ResponseField name="interface" type="string">
-  Name of the WireGuard interface.
-
-  **Default**: `pangolin`
-
-  **Env var**: `INTERFACE`
-
-  **Config file key**: `interface`
-</ResponseField>
-
 <ResponseField name="metrics" type="boolean">
   Enable Prometheus /metrics exporter.
 
@@ -460,6 +400,83 @@ Almost every setting below can also be set via an environment variable (**Env va
   **Config file key**: `preferEndpoint`
 </ResponseField>
 
+
+<ResponseField name="interface" type="string">
+  Name of the WireGuard interface.
+
+  **Default**: `pangolin`
+
+  **Env var**: `INTERFACE`
+
+  **Config file key**: `interface`
+</ResponseField>
+
+<ResponseField name="port" type="integer">
+  Port for the peers to connect to the site on. This can be used to keep a static port open in firewalls instead of default random ports.
+
+  **Example**: `34534`
+
+  **Env var**: `PORT`
+
+  **Config file key**: `port`
+</ResponseField>
+
+<ResponseField name="native" type="boolean">
+  Use a native WireGuard interface for client tunnels instead of the userspace netstack implementation.
+
+  <Note>
+    Most users should not use this feature.
+  </Note>
+
+  **Default**: `false`
+
+  **Env var**: `USE_NATIVE_INTERFACE`
+
+  **Config file key**: `native`
+</ResponseField>
+
+<ResponseField name="native-main" type="boolean">
+  Use a native WireGuard interface for the main tunnel (instead of netstack).
+
+  <Note>
+    Most users should not use this feature.
+  </Note>
+
+  **Default**: `false`
+
+  **Env var**: `USE_NATIVE_MAIN_INTERFACE`
+
+  **Config file key**: `nativeMain`
+</ResponseField>
+
+<ResponseField name="interface-main" type="string">
+  Name of the native main tunnel WireGuard interface (used with `--native-main`).
+
+  <Note>
+    Most users should not use this feature.
+  </Note>
+
+  **Default**: `pangolin`
+
+  **Env var**: `INTERFACE_MAIN`
+
+  **Config file key**: `interfaceMain`
+</ResponseField>
+
+<ResponseField name="mtu" type="integer">
+  MTU for the internal WireGuard interface. 
+
+  <Note>
+    Most users should not use this feature.
+  </Note>
+
+  **Default**: `1280`
+
+  **Env var**: `MTU`
+
+  **Config file key**: `mtu`
+</ResponseField>
+
 ## Config File
 
 The site can be configured entirely with a JSON config file instead of (or in addition to) CLI flags and environment variables. Almost every flag documented above has a matching camelCase key in this file — see the **Config file key** on each flag for its exact name.