WireGuard access classes, firewall nftables fixes, network sync event refactor
- WireGuard: refactor to multi-interface 'access classes' model; extract config generation and helpers into lib/wireguard.py; add per-class up/down endpoints and API routes; update UI with class management pages and QR code component - Firewall: fix zone creation with --new-zone before --set-target; skip masquerade on public zone; add masquerade propagation for nftables backend so NAT works when internal zones exit via public - Network: rename sync event subsystem 'network' -> 'networkd'; always stamp config hash even when deployment fails (fixes pending-changes detection) - DHCP: add new API endpoint and update frontend page - State/Sync: update state collectors and sync buses for new subsystems - Docs: update API and config documentation for new endpoints and schemas
This commit is contained in:
+164
-1
@@ -7,15 +7,23 @@ import logging
|
||||
|
||||
from flask import Blueprint, request
|
||||
|
||||
from daemon.client import BadRequest, NotFound, delete, get, patch, post
|
||||
from daemon.client import BadRequest, Conflict, NotFound, delete, get, patch, post
|
||||
from daemon.iface import (
|
||||
DELETE_WIREGUARD_CLASSES,
|
||||
DELETE_WIREGUARD_CLASSES_DOWN,
|
||||
DELETE_WIREGUARD_PEERS_REMOVE,
|
||||
GET_WIREGUARD_CLASS_STATUS,
|
||||
GET_WIREGUARD_CLASSES,
|
||||
GET_WIREGUARD_CONFIG,
|
||||
GET_WIREGUARD_PEER_STATUS,
|
||||
GET_WIREGUARD_PEERS,
|
||||
GET_WIREGUARD_STATUS,
|
||||
PATCH_WIREGUARD_CLASSES,
|
||||
PATCH_WIREGUARD_CONFIG,
|
||||
POST_WIREGUARD_APPLY,
|
||||
POST_WIREGUARD_CLASS_INIT_KEYS,
|
||||
POST_WIREGUARD_CLASSES,
|
||||
POST_WIREGUARD_CLASSES_UP,
|
||||
POST_WIREGUARD_CONFIG,
|
||||
POST_WIREGUARD_DOWN,
|
||||
POST_WIREGUARD_GENERATE_CLIENT,
|
||||
@@ -229,6 +237,8 @@ def add_peer_bp():
|
||||
"allowed_ips": body.get("allowed_ips", []),
|
||||
"persistent_keepalive": body.get("persistent_keepalive"),
|
||||
"preshared_key": body.get("preshared_key"),
|
||||
"description": body.get("description"),
|
||||
"access_class": body.get("access_class"),
|
||||
},
|
||||
)
|
||||
logger.info("WireGuard peer '%s' added via API", name)
|
||||
@@ -337,3 +347,156 @@ def generate_client_bp():
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to generate client config for '%s': %s", name, exc)
|
||||
return _error(str(exc), 500)
|
||||
|
||||
|
||||
@bp.route("/classes", methods=["GET"])
|
||||
def list_classes_bp():
|
||||
"""List all access classes.
|
||||
|
||||
Endpoint: GET /api/wireguard/classes
|
||||
"""
|
||||
try:
|
||||
return _ok(get(GET_WIREGUARD_CLASSES))
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to list access classes: %s", exc)
|
||||
return _error(str(exc), 500)
|
||||
|
||||
|
||||
@bp.route("/classes", methods=["POST"])
|
||||
def create_class_bp():
|
||||
"""Create a new access class.
|
||||
|
||||
Endpoint: POST /api/wireguard/classes
|
||||
"""
|
||||
body = request.get_json(silent=True) or {}
|
||||
if not isinstance(body, dict):
|
||||
return _error("Request body must be a JSON object", 400)
|
||||
key = body.get("key", "").strip()
|
||||
if not key:
|
||||
return _error("'key' is required", 400)
|
||||
try:
|
||||
result = post(POST_WIREGUARD_CLASSES, body)
|
||||
return _ok(result)
|
||||
except BadRequest as exc:
|
||||
logger.info("Create access class rejected: %s", exc)
|
||||
return _error(str(exc), 400)
|
||||
except Conflict as exc:
|
||||
logger.info("Create access class conflict: %s", exc)
|
||||
return _error(str(exc), 409)
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to create access class: %s", exc)
|
||||
return _error(str(exc), 500)
|
||||
|
||||
|
||||
@bp.route("/classes", methods=["PATCH"])
|
||||
def update_class_bp():
|
||||
"""Update an access class.
|
||||
|
||||
Endpoint: PATCH /api/wireguard/classes
|
||||
"""
|
||||
body = request.get_json(silent=True) or {}
|
||||
if not isinstance(body, dict):
|
||||
return _error("Request body must be a JSON object", 400)
|
||||
key = body.get("key", "").strip()
|
||||
if not key:
|
||||
return _error("'key' is required", 400)
|
||||
try:
|
||||
result = patch(PATCH_WIREGUARD_CLASSES, body)
|
||||
return _ok(result)
|
||||
except BadRequest as exc:
|
||||
logger.info("Update access class rejected: %s", exc)
|
||||
return _error(str(exc), 400)
|
||||
except NotFound as exc:
|
||||
logger.info("Access class not found: %s", exc)
|
||||
return _error(str(exc), 404)
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to update access class: %s", exc)
|
||||
return _error(str(exc), 500)
|
||||
|
||||
|
||||
@bp.route("/classes", methods=["DELETE"])
|
||||
def delete_class_bp():
|
||||
"""Delete an access class.
|
||||
|
||||
Endpoint: DELETE /api/wireguard/classes
|
||||
"""
|
||||
body = request.get_json(silent=True) or {}
|
||||
if not isinstance(body, dict):
|
||||
return _error("Request body must be a JSON object", 400)
|
||||
key = body.get("key", "").strip()
|
||||
if not key:
|
||||
return _error("'key' is required", 400)
|
||||
try:
|
||||
result = delete(DELETE_WIREGUARD_CLASSES, {"key": key})
|
||||
logger.info("Access class '%s' deleted via API", key)
|
||||
return _ok(result)
|
||||
except NotFound as exc:
|
||||
logger.info("Access class not found: %s", exc)
|
||||
return _error(str(exc), 404)
|
||||
except Conflict as exc:
|
||||
logger.info("Delete access class conflict: %s", exc)
|
||||
return _error(str(exc), 409)
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to delete access class: %s", exc)
|
||||
return _error(str(exc), 500)
|
||||
|
||||
|
||||
@bp.route("/classes/<key>/up", methods=["POST"])
|
||||
def class_up_bp(key):
|
||||
"""Bring up a single access class's WireGuard tunnel.
|
||||
|
||||
Endpoint: POST /api/wireguard/classes/<key>/up
|
||||
"""
|
||||
try:
|
||||
post(POST_WIREGUARD_CLASSES_UP, {"class_key": key})
|
||||
logger.info("WireGuard class '%s' tunnel brought up via API", key)
|
||||
return _ok(None)
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to bring up class '%s': %s", key, exc)
|
||||
return _error(str(exc), 500)
|
||||
|
||||
|
||||
@bp.route("/classes/<key>/down", methods=["POST"])
|
||||
def class_down_bp(key):
|
||||
"""Bring down a single access class's WireGuard tunnel.
|
||||
|
||||
Endpoint: POST /api/wireguard/classes/<key>/down
|
||||
"""
|
||||
try:
|
||||
delete(DELETE_WIREGUARD_CLASSES_DOWN, {"class_key": key})
|
||||
logger.info("WireGuard class '%s' tunnel brought down via API", key)
|
||||
return _ok(None)
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to bring down class '%s': %s", key, exc)
|
||||
return _error(str(exc), 500)
|
||||
|
||||
|
||||
@bp.route("/classes/<key>/status", methods=["GET"])
|
||||
def class_status_bp(key):
|
||||
"""Get status for a single access class's tunnel.
|
||||
|
||||
Endpoint: GET /api/wireguard/classes/<key>/status
|
||||
"""
|
||||
try:
|
||||
return _ok(get(GET_WIREGUARD_CLASS_STATUS, {"class_key": key}))
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to get class '%s' status: %s", key, exc)
|
||||
return _error(str(exc), 500)
|
||||
|
||||
|
||||
@bp.route("/classes/keys/<key>", methods=["POST"])
|
||||
def class_init_keys_bp(key):
|
||||
"""Generate key pair for a single access class.
|
||||
|
||||
Endpoint: POST /api/wireguard/classes/keys/<key>
|
||||
"""
|
||||
try:
|
||||
post(POST_WIREGUARD_CLASS_INIT_KEYS, {"class_key": key})
|
||||
logger.info("WireGuard class '%s' keys generated via API", key)
|
||||
return _ok(None)
|
||||
except NotFound as exc:
|
||||
logger.info("Class '%s' not found for keys: %s", key, exc)
|
||||
return _error(str(exc), 404)
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to generate keys for class '%s': %s", key, exc)
|
||||
return _error(str(exc), 500)
|
||||
|
||||
Reference in New Issue
Block a user