mteehan/vacuum-wall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

WireGuard access classes, firewall nftables fixes, network sync event refactor

Browse Source 
- WireGuard: refactor to multi-interface 'access classes' model; extract config
  generation and helpers into lib/wireguard.py; add per-class up/down endpoints
  and API routes; update UI with class management pages and QR code component
- Firewall: fix zone creation with --new-zone before --set-target; skip
  masquerade on public zone; add masquerade propagation for nftables backend
  so NAT works when internal zones exit via public
- Network: rename sync event subsystem 'network' -> 'networkd'; always stamp
  config hash even when deployment fails (fixes pending-changes detection)
- DHCP: add new API endpoint and update frontend page
- State/Sync: update state collectors and sync buses for new subsystems
- Docs: update API and config documentation for new endpoints and schemas
This commit is contained in:
Mike Teehan
2026-07-20 03:57:16 +00:00
parent dadabd7954
commit 04417cf05c
19 changed files with 2688 additions and 455 deletions
Download Patch File Download Diff File Expand all files Collapse all files
daemon/handlers/firewall.py
+35
View File
@@ -136,7 +136,13 @@ def _config_apply() -> dict[str, Any]:
need_create = zone_name not in available
if need_create:
# Create new zone first (--new-zone is required before --set-target)
run(
["firewall-cmd", f"--new-zone={zone_name}", "--permanent"],
sudo=True,
)
target = _normalize_target(zone_cfg.get("target", "DEFAULT"))
if target != "default":
run(
[
"firewall-cmd",
@@ -223,6 +229,8 @@ def _config_apply() -> dict[str, Any]:
)
# Step 4: Toggle masquerade if explicitly set (None means "don't change").
# Skip 'public' — Step 7 handles masquerade propagation for nftables.
if zone_name != "public":
mq = zone_cfg.get("masquerade", False)
if mq is not None:
action = "--add-masquerade" if mq else "--remove-masquerade"
@@ -296,6 +304,33 @@ def _config_apply() -> dict[str, Any]:
applied.append(zone_name)
# Step 7: Ensure masquerade propagation for nftables backend.
# With firewalld's nftables backend, POSTROUTING policy chains route traffic
# to the OUTPUT interface's zone chain. Traffic from internal zones (eth1)
# exiting through public (eth0) hits public's POSTROUTING chain, not
# internal's. If any non-public zone has masquerade enabled but the public
# zone doesn't, NAT silently fails — so propagate masquerade to public.
_any_non_public_mq = any(
z.get("masquerade", False) for zn, z in cfg_zones.items() if zn != "public"
)
_public_mq = cfg_zones.get("public", {}).get("masquerade", False)
if _any_non_public_mq and not _public_mq:
logger.info("Propagating masquerade to public zone for nftables compatibility")
run(
["firewall-cmd", "--zone=public", "--add-masquerade", "--permanent"],
sudo=True,
)
cfg.setdefault("zones", {}).setdefault("public", {})["masquerade"] = True
_save_config(cfg)
elif not _any_non_public_mq and _public_mq:
logger.info("No non-public zone needs masquerade, removing from public zone")
run(
["firewall-cmd", "--zone=public", "--remove-masquerade", "--permanent"],
sudo=True,
)
cfg.setdefault("zones", {}).setdefault("public", {})["masquerade"] = False
_save_config(cfg)
_reload()
full_state = {
"active_zones": {},
daemon/handlers/network.py
+9 -7
View File
@@ -214,16 +214,18 @@ def save_interface(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]
)
logger.info("Interface '%s' config saved (applied=%s)", name, deployed)
if deployed:
# Always stamp the hash so pending-changes detection stays current
# even when deployment fails (e.g. in containerized environments).
# The hash represents the JSON config state, not the system state.
cfg_after = get_config()
cfg_after[_APPLY_HASH_KEY] = config_hash(cfg_after)
save_config(cfg_after)
sync_result = bus.emit(
SyncEvent(
"network", "config_saved", {"action": "interface_saved", "interface": name}
"networkd", "config_saved", {"action": "interface_saved", "interface": name}
)
)
refresh_state(["network", *sync_result.affected_subsystems])
refresh_state(["networkd", *sync_result.affected_subsystems])
return {
"name": name,
"applied": deployed,
@@ -296,9 +298,9 @@ def apply_all(_request: Any, _body: Any) -> dict[str, Any]:
cfg_after[_APPLY_HASH_KEY] = config_hash(cfg_after)
save_config(cfg_after)
sync_result = bus.emit(
SyncEvent("network", "config_saved", {"action": "config_applied"})
SyncEvent("networkd", "config_saved", {"action": "config_applied"})
)
refresh_state(["network", *sync_result.affected_subsystems])
refresh_state(["networkd", *sync_result.affected_subsystems])
logger.info(
"Network config applied: %d interfaces, %d stale cleaned",
@@ -364,7 +366,7 @@ def set_sysctl(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]:
logger.info("sysctl %s set to %s", name, value)
sync_result = bus.emit(
SyncEvent("network", "config_saved", {"action": "sysctl_set", "name": name})
SyncEvent("networkd", "config_saved", {"action": "sysctl_set", "name": name})
)
refresh_state(["network", *sync_result.affected_subsystems])
refresh_state(["networkd", *sync_result.affected_subsystems])
return {"name": name, "value": value}
daemon/handlers/wireguard.py
+457 -139
View File
@@ -2,101 +2,73 @@
import logging
import os
from copy import deepcopy
from datetime import UTC, datetime
from pathlib import Path
from typing import Any
from jinja2 import Environment, FileSystemLoader
from daemon.iface import (
DELETE_WIREGUARD_CLASSES,
DELETE_WIREGUARD_CLASSES_DOWN,
DELETE_WIREGUARD_PEERS_REMOVE,
GET_WIREGUARD_CLASS_STATUS,
GET_WIREGUARD_CLASSES,
GET_WIREGUARD_CONFIG,
GET_WIREGUARD_PEER_STATUS,
GET_WIREGUARD_PEERS,
GET_WIREGUARD_STATUS,
PATCH_WIREGUARD_CLASSES,
PATCH_WIREGUARD_CONFIG,
POST_WIREGUARD_APPLY,
POST_WIREGUARD_CLASS_INIT_KEYS,
POST_WIREGUARD_CLASSES,
POST_WIREGUARD_CLASSES_UP,
POST_WIREGUARD_CONFIG,
POST_WIREGUARD_DOWN,
POST_WIREGUARD_GENERATE_CLIENT,
POST_WIREGUARD_INITIALIZE,
POST_WIREGUARD_PEERS_ADD,
)
from daemon.server import NotFoundError, refresh_state, registry
from daemon.server import ConflictError, NotFoundError, refresh_state, registry
from lib.common import (
_APPLY_HASH_KEY,
config_hash,
deep_merge,
load_json,
run,
run_proc,
save_json,
)
from lib.sync import SyncEvent, bus
from lib.wireguard import (
_class_interface_name,
_class_peers,
_ensure_access_classes,
_wg_conf_path,
generate_class_conf,
generate_class_keypair,
generate_conf,
generate_keypair,
)
from lib.wireguard import (
generate_client_conf as _gen_client_conf,
)
from lib.wireguard import (
get_config as _get_wireguard_config,
)
from lib.wireguard import (
get_peers as _get_wireguard_peers,
)
from lib.wireguard import (
save_config as _save_wireguard_config,
)
logger = logging.getLogger(__name__)
PROJECT_DIR = Path(__file__).resolve().parent.parent.parent
CONFIG_PATH = PROJECT_DIR / "config" / "wireguard" / "config.json"
WG_CONF_PATH = "/etc/wireguard/wg0.conf"
WG_QUICK_BIN = "wg-quick"
WG_BIN = "wg"
ENV = Environment(
loader=FileSystemLoader(str(PROJECT_DIR / "system")),
autoescape=False,
lstrip_blocks=True,
trim_blocks=True,
)
DEFAULT_CONFIG: dict[str, Any] = {
"interface": {
"name": "wg0",
"listen_port": 51820,
"private_key": "",
"public_key": "",
"addresses": ["10.137.0.1/24"],
"post_up": None,
"post_down": None,
},
"peers": {},
}
def _get_state() -> dict[str, Any] | None:
"""Retrieve cached WireGuard state from the global state store."""
from lib.state import state as state_store
return state_store.get("wireguard")
def _get_config() -> dict[str, Any]:
"""Load and merge the WireGuard config with defaults."""
return deep_merge(deepcopy(DEFAULT_CONFIG), load_json(CONFIG_PATH))
def _save_config(cfg: dict[str, Any]) -> None:
"""Persist the WireGuard config to disk."""
save_json(CONFIG_PATH, cfg)
def _generate_conf(cfg: dict[str, Any]) -> str:
"""Render the WireGuard server config file from Jinja template."""
tmpl = ENV.get_template("wireguard.conf")
return tmpl.render(
timestamp=datetime.now(UTC).strftime("%Y-%m-%dT%H:%M:%SZ"),
interface=cfg["interface"],
peers=cfg.get("peers", {}),
)
def _get_wg_state() -> dict[str, Any]:
"""Return cached WireGuard state, or empty dict if not yet loaded."""
wg = _get_state()
if wg is None:
return {}
return wg
from lib.state import state as state_store
wg = state_store.get("wireguard")
return {} if wg is None else wg
# ---------------------------------------------------------------------------
@@ -109,32 +81,52 @@ def get_config(_request: Any, _body: Any) -> dict[str, Any]:
wg = _get_wg_state()
if wg:
return wg.get("config", {})
cfg = _get_config()
cfg = _get_wireguard_config()
safe = {k: v for k, v in cfg.items() if k != _APPLY_HASH_KEY}
if "interface" in safe:
safe["interface"] = dict(safe["interface"])
safe["interface"].pop("private_key", None)
if "access_classes" in safe:
for ck, cv in safe["access_classes"].items():
if isinstance(cv, dict):
safe["access_classes"][ck] = dict(cv)
safe["access_classes"][ck].pop("private_key", None)
return safe
@registry.register(POST_WIREGUARD_CONFIG)
def save_config_handler(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]:
"""POST /wireguard/config — replace config, preserving existing private key.
"""POST /wireguard/config — replace config, preserving existing private keys.
Raises:
ValueError: When request body is missing.
"""
if not body:
raise ValueError("Request body required")
current = _get_config()
current = _get_wireguard_config()
current_key = current.get("interface", {}).get("private_key", "")
if "interface" in body:
body = dict(body)
body["interface"] = dict(body["interface"])
body["interface"].pop("private_key", None)
if current_key:
body.setdefault("interface", {})["private_key"] = current_key
_save_config(body)
# Preserve class private keys
if "access_classes" in body:
current_classes = current.get("access_classes", {})
for ck, cv in body.get("access_classes", {}).items():
if isinstance(cv, dict) and ck in current_classes:
cur_class_pk = current_classes[ck].get("private_key", "")
if cur_class_pk and ck in body["access_classes"]:
body["access_classes"][ck]["private_key"] = cur_class_pk
elif "access_classes" not in body:
body["access_classes"] = current.get("access_classes", {})
_save_wireguard_config(body)
sync_result = bus.emit(
SyncEvent("wireguard", "config_saved", {"action": "config_saved"})
)
@@ -151,13 +143,21 @@ def patch_config(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]:
"""
if not body:
raise ValueError("Request body required")
if "interface" in body:
body = dict(body)
body["interface"] = dict(body["interface"])
body["interface"].pop("private_key", None)
current = _get_config()
# Strip class private keys from patch body
if "access_classes" in body:
for _ck, cv in body["access_classes"].items():
if isinstance(cv, dict):
cv.pop("private_key", None)
current = _get_wireguard_config()
merged = deep_merge(current, body)
_save_config(merged)
_save_wireguard_config(merged)
sync_result = bus.emit(
SyncEvent("wireguard", "config_saved", {"action": "config_patched"})
)
@@ -167,36 +167,99 @@ def patch_config(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]:
@registry.register(POST_WIREGUARD_APPLY)
def apply(_request: Any, _body: Any) -> dict[str, Any]:
"""POST /wireguard/apply — render config, write to disk, bring up tunnel via sudo."""
cfg = _get_config()
conf_text = _generate_conf(cfg)
_save_config(cfg)
local_tmp = Path("/run/vacuum-wall/wg0.conf.tmp")
"""POST /wireguard/apply — render config, write to disk, bring up tunnels via sudo.
In multi-interface mode, applies each class with assigned peers
independently. Falls back to legacy single-interface mode.
"""
cfg = _get_wireguard_config()
classes = cfg.get("access_classes", {})
affected: list[str] = []
for class_key in classes:
class_cfg = classes.get(class_key)
if not class_cfg or not isinstance(class_cfg, dict):
continue
if not _class_peers(cfg, class_key):
continue
try:
conf_text = generate_class_conf(cfg, class_key)
if not conf_text:
continue
except ValueError as e:
logger.warning("Skipping class '%s' during apply: %s", class_key, e)
continue
ifname = _class_interface_name(class_key)
conf_path = _wg_conf_path(ifname)
local_tmp = Path(f"/run/vacuum-wall/{ifname}.conf.tmp")
local_tmp.parent.mkdir(exist_ok=True)
local_tmp.write_text(conf_text)
os.chmod(local_tmp, 0o600)
run(["cp", "--", str(local_tmp), WG_CONF_PATH], sudo=True)
run(["chown", "root:root", WG_CONF_PATH], sudo=True, check=False)
run(["cp", "--", str(local_tmp), conf_path], sudo=True)
run(["chown", "root:root", conf_path], sudo=True, check=False)
local_tmp.unlink(missing_ok=True)
run([WG_QUICK_BIN, "up", cfg["interface"]["name"]], sudo=True)
logger.info("WireGuard tunnel '%s' brought up", cfg["interface"]["name"])
cfg_after = _get_config()
run([WG_QUICK_BIN, "up", ifname], sudo=True, check=False)
logger.info("WireGuard tunnel '%s' (class '%s') brought up", ifname, class_key)
affected.append(f"{ifname}.conf")
if not affected:
# Legacy single-interface mode
conf_text = generate_conf(cfg)
ifname = cfg["interface"]["name"]
conf_path = _wg_conf_path(ifname)
local_tmp = Path(f"/run/vacuum-wall/{ifname}.conf.tmp")
local_tmp.parent.mkdir(exist_ok=True)
local_tmp.write_text(conf_text)
os.chmod(local_tmp, 0o600)
run(["cp", "--", str(local_tmp), conf_path], sudo=True)
run(["chown", "root:root", conf_path], sudo=True, check=False)
local_tmp.unlink(missing_ok=True)
run([WG_QUICK_BIN, "up", ifname], sudo=True, check=False)
logger.info("WireGuard tunnel '%s' brought up", ifname)
cfg_after = _get_wireguard_config()
cfg_after[_APPLY_HASH_KEY] = config_hash(cfg_after)
_save_config(cfg_after)
_save_wireguard_config(cfg_after)
sync_result = bus.emit(
SyncEvent("wireguard", "config_saved", {"action": "config_applied"})
)
refresh_state(["wireguard", *sync_result.affected_subsystems])
return {"applied": True, "synced": sync_result.affected_subsystems}
return {
"applied": True,
"synced": sync_result.affected_subsystems,
"interfaces": affected,
}
@registry.register(POST_WIREGUARD_DOWN)
def down(_request: Any, _body: Any) -> dict[str, Any]:
"""POST /wireguard/down — bring down the WireGuard tunnel via sudo."""
cfg = _get_config()
name = cfg["interface"]["name"]
run([WG_QUICK_BIN, "down", name], sudo=True)
logger.info("WireGuard tunnel '%s' brought down", name)
"""POST /wireguard/down — bring down all WireGuard tunnel interfaces."""
cfg = _get_wireguard_config()
classes = cfg.get("access_classes", {})
for class_key in classes:
class_cfg = classes.get(class_key)
if not class_cfg or not isinstance(class_cfg, dict):
continue
ifname = _class_interface_name(class_key)
try:
run([WG_QUICK_BIN, "down", ifname], sudo=True)
logger.info("WireGuard tunnel '%s' brought down", ifname)
except Exception:
pass
# Legacy interface (skip if name matches any class interface)
ifname = cfg["interface"].get("name", "")
if ifname:
class_names = {_class_interface_name(k) for k in classes}
if ifname not in class_names:
try:
run([WG_QUICK_BIN, "down", ifname], sudo=True)
logger.info("WireGuard tunnel '%s' brought down", ifname)
except Exception:
pass
sync_result = bus.emit(
SyncEvent("wireguard", "config_saved", {"action": "tunnel_down"})
)
@@ -204,39 +267,160 @@ def down(_request: Any, _body: Any) -> dict[str, Any]:
return {"down": True}
@registry.register(POST_WIREGUARD_CLASSES_UP)
def class_up(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]:
"""POST /wireguard/classes/<key>/up — bring up a single class's tunnel.
Raises:
ValueError: When body or key is missing.
NotFoundError: When class does not exist.
"""
if not body:
raise ValueError("Request body required")
class_key = body.get("class_key", "").strip()
if not class_key:
raise ValueError("'class_key' is required")
cfg = _get_wireguard_config()
class_cfg = cfg.get("access_classes", {}).get(class_key)
if not class_cfg:
raise NotFoundError(f"Access class '{class_key}' not found")
conf_text = generate_class_conf(cfg, class_key)
if not conf_text:
raise ValueError(f"No peers assigned to class '{class_key}'")
ifname = _class_interface_name(class_key)
conf_path = _wg_conf_path(ifname)
local_tmp = Path(f"/run/vacuum-wall/{ifname}.conf.tmp")
local_tmp.parent.mkdir(exist_ok=True)
local_tmp.write_text(conf_text)
os.chmod(local_tmp, 0o600)
run(["cp", "--", str(local_tmp), conf_path], sudo=True)
run(["chown", "root:root", conf_path], sudo=True, check=False)
local_tmp.unlink(missing_ok=True)
run([WG_QUICK_BIN, "up", ifname], sudo=True, check=False)
logger.info("WireGuard class '%s' tunnel '%s' brought up", class_key, ifname)
sync_result = bus.emit(
SyncEvent("wireguard", "config_saved", {"action": "class_up", "class_key": class_key})
)
refresh_state(["wireguard", *sync_result.affected_subsystems])
return {"up": True, "interface": ifname}
@registry.register(DELETE_WIREGUARD_CLASSES_DOWN)
def class_down(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]:
"""DELETE /wireguard/classes/<key>/down — bring down a single class's tunnel.
Raises:
ValueError: When body or key is missing.
"""
if not body:
raise ValueError("Request body required")
class_key = body.get("class_key", "").strip()
if not class_key:
raise ValueError("'class_key' is required")
cfg = _get_wireguard_config()
if class_key not in cfg.get("access_classes", {}):
raise NotFoundError(f"Access class '{class_key}' not found")
ifname = _class_interface_name(class_key)
try:
run([WG_QUICK_BIN, "down", ifname], sudo=True)
logger.info("WireGuard class '%s' tunnel '%s' brought down", class_key, ifname)
except Exception:
pass
sync_result = bus.emit(
SyncEvent("wireguard", "config_saved", {"action": "class_down", "class_key": class_key})
)
refresh_state(["wireguard", *sync_result.affected_subsystems])
return {"down": True, "interface": ifname}
@registry.register(GET_WIREGUARD_STATUS)
def status(_request: Any, _body: Any) -> dict[str, Any]:
"""GET /wireguard/status — return current WireGuard status from cache."""
wg = _get_wg_state()
if wg:
return wg.get("status", {"up": False, "interface": {}, "peers": []})
return {"up": False, "interface": {}, "peers": []}
return wg.get(
"status", {"up": False, "interface": {}, "peers": [], "classes": {}}
)
return {"up": False, "interface": {}, "peers": [], "classes": {}}
@registry.register(POST_WIREGUARD_INITIALIZE)
def initialize(_request: Any, _body: Any) -> dict[str, Any]:
"""POST /wireguard/initialize — generate keypair and store in config (idempotent)."""
cfg = _get_config()
"""POST /wireguard/initialize — generate keypair and store in config (idempotent).
Also generates key pairs for each access class interface.
"""
cfg = _get_wireguard_config()
if cfg["interface"].get("private_key"):
_ensure_access_classes(cfg)
# Generate keys for classes that need them (idempotent, saves internally)
for class_key in cfg.get("access_classes", {}):
generate_class_keypair(class_key)
return {"initialized": False, "reason": "already initialized"}
res = run_proc([WG_BIN, "genkey"], sudo=False)
private_key = res.stdout.strip()
res2 = run_proc([WG_BIN, "pubkey"], sudo=False, input=private_key)
public_key = res2.stdout.strip()
cfg["interface"]["private_key"] = private_key
cfg["interface"]["public_key"] = public_key
_save_config(cfg)
logger.info("WireGuard initialised (pubkey=%s...)", public_key[:16])
# Fresh init
priv, pub = generate_keypair()
cfg["interface"]["private_key"] = priv
cfg["interface"]["public_key"] = pub
_ensure_access_classes(cfg)
# Generate class keys
for class_key in cfg.get("access_classes", {}):
generate_class_keypair(class_key)
_save_wireguard_config(cfg)
logger.info("WireGuard initialised (pubkey=%s...)", pub[:16])
sync_result = bus.emit(
SyncEvent("wireguard", "config_saved", {"action": "initialized"})
)
refresh_state(["wireguard", *sync_result.affected_subsystems])
safe = dict(cfg)
safe["interface"] = dict(safe["interface"])
safe["interface"].pop("private_key", None)
for ck, cv in safe.get("access_classes", {}).items():
if isinstance(cv, dict):
safe["access_classes"][ck] = dict(cv)
safe["access_classes"][ck].pop("private_key", None)
return {"initialized": True, "config": safe}
@registry.register(POST_WIREGUARD_CLASS_INIT_KEYS)
def init_class_keys(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]:
"""POST /wireguard/classes/keys/<key> — generate keypair for a class.
Raises:
ValueError: When body or key is missing.
NotFoundError: When class does not exist.
"""
if not body:
raise ValueError("Request body required")
class_key = body.get("class_key", "").strip()
if not class_key:
raise ValueError("'class_key' is required")
cfg = _get_wireguard_config()
if class_key not in cfg.get("access_classes", {}):
raise NotFoundError(f"Access class '{class_key}' not found")
class_cfg = cfg["access_classes"][class_key]
if class_cfg.get("private_key"):
return {
"generated": False,
"class_key": class_key,
"reason": "already has keys",
}
_, pub = generate_class_keypair(class_key)
return {"generated": True, "class_key": class_key, "public_key": pub}
@registry.register(POST_WIREGUARD_PEERS_ADD)
def add_peer(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]:
"""POST /wireguard/peers/add — add new peer or update existing one.
@@ -249,34 +433,39 @@ def add_peer(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]:
name = body.get("name", "").strip()
if not name:
raise ValueError("'name' is required")
cfg = _get_config()
cfg = _get_wireguard_config()
peers = cfg.setdefault("peers", {})
allowed_ips = body.get("allowed_ips", [])
if name in peers:
peer = peers[name]
peer["endpoint"] = body.get("endpoint")
peer["allowed_ips"] = allowed_ips
peer["persistent_keepalive"] = body.get("persistent_keepalive")
if body.get("preshared_key") is not None:
if "endpoint" in body:
peer["endpoint"] = body["endpoint"]
if "allowed_ips" in body:
peer["allowed_ips"] = body["allowed_ips"]
if "persistent_keepalive" in body:
peer["persistent_keepalive"] = body["persistent_keepalive"]
if "preshared_key" in body:
peer["preshared_key"] = body["preshared_key"]
if "description" in body:
peer["description"] = body["description"]
if "access_class" in body:
peer["access_class"] = body["access_class"]
logger.info("WireGuard peer '%s' updated", name)
_peer_action = "peer_updated"
else:
res = run_proc([WG_BIN, "genkey"], sudo=True)
priv = res.stdout.strip()
res2 = run_proc([WG_BIN, "pubkey"], sudo=True, input=priv)
pub = res2.stdout.strip()
priv, pub = generate_keypair()
peers[name] = {
"public_key": pub,
"private_key": priv,
"endpoint": body.get("endpoint"),
"allowed_ips": allowed_ips,
"allowed_ips": body.get("allowed_ips", []),
"persistent_keepalive": body.get("persistent_keepalive"),
"preshared_key": body.get("preshared_key"),
"description": body.get("description", ""),
"access_class": body.get("access_class"),
}
logger.info("WireGuard peer '%s' added", name)
_peer_action = "peer_added"
_save_config(cfg)
_save_wireguard_config(cfg)
sync_result = bus.emit(
SyncEvent(
"wireguard", "config_saved", {"action": _peer_action, "peer_name": name}
@@ -301,12 +490,12 @@ def remove_peer(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]:
name = body.get("name", "").strip()
if not name:
raise ValueError("'name' is required")
cfg = _get_config()
cfg = _get_wireguard_config()
peers = cfg.setdefault("peers", {})
if name not in peers:
raise NotFoundError(f"Peer '{name}' not found")
del peers[name]
_save_config(cfg)
_save_wireguard_config(cfg)
logger.info("WireGuard peer '%s' removed", name)
sync_result = bus.emit(
SyncEvent(
@@ -323,14 +512,7 @@ def list_peers(_request: Any, _body: Any) -> list[dict[str, Any]]:
wg = _get_wg_state()
if wg:
return wg.get("peers", [])
cfg = _get_config()
result: list[dict[str, Any]] = []
for name, info in cfg.get("peers", {}).items():
entry = dict(info)
entry["name"] = name
entry.pop("private_key", None)
result.append(entry)
return result
return _get_wireguard_peers()
@registry.register(GET_WIREGUARD_PEER_STATUS)
@@ -342,10 +524,32 @@ def get_peer_status(_request: Any, _body: Any) -> list[dict[str, Any]]:
return []
@registry.register(GET_WIREGUARD_CLASS_STATUS)
def get_class_status(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]:
"""GET /wireguard/classes/<key>/status — return status for a specific class interface.
Raises:
NotFoundError: When class does not exist.
"""
wg = _get_wg_state()
if wg:
classes = wg.get("status", {}).get("classes", {})
if body:
key = body.get("class_key", "")
if key and key not in classes:
raise NotFoundError(f"Access class '{key}' not found")
return classes.get(key, {"up": False, "interface": {}, "peers": []})
return classes
return {"up": False, "interface": {}, "peers": []}
@registry.register(POST_WIREGUARD_GENERATE_CLIENT)
def generate_client_conf(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]:
"""POST /wireguard/generate-client — render client-side WireGuard config for a peer.
Uses the peer's access class subnet and port to derive the correct
server address and endpoint port.
Raises:
ValueError: When body, name, or server_endpoint is missing.
NotFoundError: When peer does not exist or has no private key.
@@ -358,30 +562,144 @@ def generate_client_conf(_request: Any, body: dict[str, Any] | None) -> dict[str
server_endpoint = body.get("server_endpoint", "")
if not server_endpoint:
raise ValueError("'server_endpoint' is required")
cfg = _get_config()
cfg = _get_wireguard_config()
if name not in cfg.get("peers", {}):
raise NotFoundError(f"Peer '{name}' not found")
peer = cfg["peers"][name]
client_priv = peer.get("private_key", "")
if not client_priv:
if not peer.get("private_key"):
raise NotFoundError(f"Peer '{name}' has no private key")
iface = cfg["interface"]
sorted_peers = sorted(cfg.get("peers", {}).keys())
peer_index = sorted_peers.index(name) + 2
srv_addr = iface["addresses"][0] if iface["addresses"] else "10.137.0.1/24"
addr_part, prefix = srv_addr.rsplit("/", 1)
prefix_base = addr_part.rsplit(".", 1)[0]
client_addr = f"{prefix_base}.{peer_index}/{prefix}"
tmpl = ENV.get_template("wireguard-client.conf")
conf = tmpl.render(
timestamp=datetime.now(UTC).strftime("%Y-%m-%dT%H:%M:%SZ"),
conf = _gen_client_conf(
peer_name=name,
client_priv=client_priv,
client_addr=client_addr,
server_pubkey=iface.get("public_key", ""),
server_endpoint=server_endpoint,
allowed_ips=peer.get("allowed_ips", ["0.0.0.0/0"]),
preshared_key=peer.get("preshared_key"),
persistent_keepalive=peer.get("persistent_keepalive"),
server_pubkey=cfg["interface"].get("public_key"),
)
return {"config": conf}
# ---------------------------------------------------------------------------
# Access Classes
@registry.register(GET_WIREGUARD_CLASSES)
def list_classes(_request: Any, _body: Any) -> dict[str, Any]:
"""GET /wireguard/classes — return access classes (with private keys stripped)."""
cfg = _get_wireguard_config()
classes = cfg.get("access_classes", {})
safe: dict[str, Any] = {}
for k, v in classes.items():
if isinstance(v, dict):
entry = dict(v)
entry.pop("private_key", None)
safe[k] = entry
else:
safe[k] = v
return safe
@registry.register(POST_WIREGUARD_CLASSES)
def create_class(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]:
"""POST /wireguard/classes — create a new access class with phase-2 fields.
Raises:
ValueError: When body is missing or key conflicts.
"""
if not body:
raise ValueError("Request body required")
key = body.get("key", "").strip()
if not key:
raise ValueError("'key' is required")
if not key.isalnum() or not key.islower():
raise ValueError("'key' must be lowercase alphanumeric")
name = body.get("name", key)
description = body.get("description", "")
cfg = _get_wireguard_config()
classes = cfg.setdefault("access_classes", {})
if key in classes:
raise ConflictError(f"Access class '{key}' already exists")
classes[key] = {
"name": name,
"description": description,
"subnet": body.get("subnet"),
"listen_port": body.get("listen_port"),
"lan_access": body.get("lan_access", False),
"private_key": "",
"public_key": "",
}
_save_wireguard_config(cfg)
sync_result = bus.emit(
SyncEvent("wireguard", "config_saved", {"action": "class_created"})
)
refresh_state(["wireguard", *sync_result.affected_subsystems])
out = dict(classes[key])
out.pop("private_key", None)
return out
@registry.register(PATCH_WIREGUARD_CLASSES)
def update_class(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]:
"""PATCH /wireguard/classes/<key> — update an access class.
Raises:
ValueError: When body is missing.
NotFoundError: When class does not exist.
"""
if not body:
raise ValueError("Request body required")
key = body.get("key", "").strip()
if not key:
raise ValueError("'key' is required")
cfg = _get_wireguard_config()
classes = cfg.setdefault("access_classes", {})
if key not in classes:
raise NotFoundError(f"Access class '{key}' not found")
class_cfg = classes[key]
for field in ("name", "description", "subnet", "listen_port", "lan_access"):
if field in body:
class_cfg[field] = body[field]
_save_wireguard_config(cfg)
sync_result = bus.emit(
SyncEvent("wireguard", "config_saved", {"action": "class_updated"})
)
refresh_state(["wireguard", *sync_result.affected_subsystems])
out = dict(classes[key])
out.pop("private_key", None)
return {"key": key, **out}
@registry.register(DELETE_WIREGUARD_CLASSES)
def delete_class(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]:
"""DELETE /wireguard/classes/<key> — remove an access class.
Raises:
ValueError: When body is missing.
NotFoundError: When class does not exist.
ConflictError: When peers still reference the class.
"""
if not body:
raise ValueError("Request body required")
key = body.get("key", "").strip()
if not key:
raise ValueError("'key' is required")
cfg = _get_wireguard_config()
classes = cfg.setdefault("access_classes", {})
if key not in classes:
raise NotFoundError(f"Access class '{key}' not found")
# Check if any peers reference this class
peers_reusing = [
name
for name, info in cfg.get("peers", {}).items()
if info.get("access_class") == key
]
if peers_reusing:
raise ConflictError(
f"Cannot delete class '{key}': {len(peers_reusing)} peer(s) reference it: {', '.join(peers_reusing)}"
)
del classes[key]
_save_wireguard_config(cfg)
sync_result = bus.emit(
SyncEvent("wireguard", "config_saved", {"action": "class_deleted"})
)
refresh_state(["wireguard", *sync_result.affected_subsystems])
return {"key": key}
daemon/iface.py
+14
View File
@@ -99,6 +99,20 @@ DELETE_WIREGUARD_PEERS_REMOVE: Endpoint = _ep("DELETE", "/wireguard/peers/remove
GET_WIREGUARD_PEERS: Endpoint = _ep("GET", "/wireguard/peers")
GET_WIREGUARD_PEER_STATUS: Endpoint = _ep("GET", "/wireguard/peer-status")
POST_WIREGUARD_GENERATE_CLIENT: Endpoint = _ep("POST", "/wireguard/generate-client")
GET_WIREGUARD_CLASSES: Endpoint = _ep("GET", "/wireguard/classes")
POST_WIREGUARD_CLASSES: Endpoint = _ep("POST", "/wireguard/classes")
PATCH_WIREGUARD_CLASSES: Endpoint = _ep("PATCH", "/wireguard/classes/<key>")
DELETE_WIREGUARD_CLASSES: Endpoint = _ep("DELETE", "/wireguard/classes/<key>")
POST_WIREGUARD_CLASSES_UP: Endpoint = _ep("POST", "/wireguard/classes/<class_key>/up")
DELETE_WIREGUARD_CLASSES_DOWN: Endpoint = _ep(
"DELETE", "/wireguard/classes/<class_key>/down"
)
GET_WIREGUARD_CLASS_STATUS: Endpoint = _ep(
"GET", "/wireguard/classes/<class_key>/status"
)
POST_WIREGUARD_CLASS_INIT_KEYS: Endpoint = _ep(
"POST", "/wireguard/classes/keys/<class_key>"
)
# ---- ACME / Certs ----
GET_ACME_LIST: Endpoint = _ep("GET", "/acme/list")
docs/api.md
+80
View File
@@ -1320,6 +1320,86 @@ This is the only endpoint that returns a WireGuard private key. All other endpoi
Returns HTTP `404` if the peer is not found.
### Access Classes
Manage VPN access classes that categorize peers by access level (e.g., full LAN access, internet-only).
#### List Access Classes
```
GET /api/wireguard/classes
```
Return all configured access classes.
**Response (`data`):**
Object keyed by class identifier, each with `name` and `description` fields.
#### Create Access Class
```
POST /api/wireguard/classes
```
Create a new access class.
**Request Body:**
| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `key` | `string` | Yes | Class identifier (alphanumeric) |
| `name` | `string` | No | Display name (defaults to key) |
| `description` | `string` | No | Description text |
**Response (`data`):**
| Field | Type | Description |
|-------|------|-------------|
| `key` | `string` | Class key |
| `name` | `string` | Display name |
| `description` | `string` | Description |
Returns HTTP `409` if the key already exists.
#### Update Access Class
```
PATCH /api/wireguard/classes
```
Update an existing access class.
**Request Body:**
| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `key` | `string` | Yes | Class identifier |
| `name` | `string` | No | New display name |
| `description` | `string` | No | New description |
**Response (`data`):** Updated class object with `key`, `name`, `description`.
Returns HTTP `404` if the class is not found.
#### Delete Access Class
```
DELETE /api/wireguard/classes
```
Remove an access class. Cannot delete a class that has peers assigned to it.
**Request Body:**
| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `key` | `string` | Yes | Class identifier |
**Response (`data`):** `{ "key": "<key>" }`
Returns HTTP `404` if the class is not found. Returns HTTP `409` if peers reference the class.
---
## Network API
docs/config.md
+59 -3
View File
@@ -268,7 +268,7 @@ The application reads `.account.conf` to determine registration status. If the f
**File**: `config/wireguard/config.json`
This file defines the WireGuard server interface and all connected peers. The application renders it into `/etc/wireguard/wg0.conf` and applies it with `wg-quick`. The file is created automatically when `initialize()` generates the server key pair via `wg genkey` / `wg pubkey`.
This file defines the WireGuard server interface, access classes, and all connected peers. The application renders it into `/etc/wireguard/wg0.conf` and applies it with `wg-quick`. The file is created automatically when `initialize()` generates the server key pair and pre-seeds default access classes.
```json
{
@@ -278,9 +278,31 @@ This file defines the WireGuard server interface and all connected peers. The ap
"private_key": "<generated>",
"public_key": "<generated>",
"addresses": ["10.137.0.1/24"],
"server_endpoint": "vpn.example.com:51820",
"description": "Main WireGuard server",
"post_up": null,
"post_down": null
},
"access_classes": {
"full": {
"name": "Full LAN Access",
"description": "Peers get full access to internal networks",
"subnet": "10.137.0.0/24",
"listen_port": 51820,
"lan_access": true,
"private_key": "<generated>",
"public_key": "<generated>"
},
"internet": {
"name": "Internet Only",
"description": "Peers can only reach the internet",
"subnet": "10.137.1.0/24",
"listen_port": 51821,
"lan_access": false,
"private_key": "<generated>",
"public_key": "<generated>"
}
},
"peers": {
"alice": {
"public_key": "<auto-generated>",
@@ -288,7 +310,9 @@ This file defines the WireGuard server interface and all connected peers. The ap
"endpoint": "203.0.113.1:51820",
"allowed_ips": ["0.0.0.0/0"],
"persistent_keepalive": 25,
"preshared_key": null
"preshared_key": null,
"description": "Alice's office laptop",
"access_class": "full"
}
}
}
@@ -303,9 +327,39 @@ This file defines the WireGuard server interface and all connected peers. The ap
| `private_key` | string | Yes (after init) | Base64-encoded private key for the server interface. Generated automatically by `initialize()` via `wg genkey`. |
| `public_key` | string | Yes (after init) | Corresponding public key. Generated automatically by `initialize()` via `wg pubkey`. |
| `addresses` | array | No | IP address(es) assigned to the server interface in CIDR notation (e.g., `10.137.0.1/24`). Default: `["10.137.0.1/24"]`. |
| `server_endpoint` | string | No | External hostname:port for client connection. Used in generated client configs. Default: `""`. |
| `description` | string | No | Free-text description of the WireGuard server. Default: `""`. |
| `post_up` | string | No | Shell command to run after the interface is brought up. Common uses: adding NAT rules, enabling IP forwarding for the tunnel. Set to `null` to omit. Default: `null`. |
| `post_down` | string | No | Shell command to run after the interface is brought down. Used to clean up rules added by `post_up`. Set to `null` to omit. Default: `null`. |
### Access Classes
Access classes define categories of VPN access. Each class gets its own WireGuard interface (``wg-<key>``), firewall zone (``vpn-<key>``), subnet, and listen port. Peers are assigned to a class and their config is rendered to that class's interface. Pre-seeded with `full` and `internet` defaults on first initialization. Manageable via `GET/POST/PATCH/DELETE /api/wireguard/classes`. Per-class tunnel lifecycle: `POST /api/wireguard/classes/<key>/up`, `POST /api/wireguard/classes/<key>/down`.
| Field | Type | Required | Description |
|---|---|---|---|
| `name` | string | Yes | Human-readable display name for the class. |
| `description` | string | No | Optional description of what access level this class provides. Default: `""`. |
| `subnet` | string | Yes | CIDR subnet for the class's WireGuard interface (e.g., ``10.137.0.0/24``). Server address is derived as ``<base>.1/<prefix>``. |
| `listen_port` | integer | Yes | UDP port for the class's WireGuard interface. Must be unique per class. |
| `lan_access` | boolean | No | When ``true``, the sync subscriber adds inter-zone accept rules for internal subnets, allowing peers to reach the LAN. When ``false``, peers can only reach the internet via masquerade. Default: ``false``. |
| `private_key` | string | Yes (auto) | Base64-encoded private key for the class's WireGuard interface. Auto-generated via ``POST /api/wireguard/classes/keys/<key>``. |
| `public_key` | string | Yes (auto) | Corresponding public key. Auto-generated with ``private_key``. |
### Multi-Interface Behavior
When peers are assigned to an access class, the daemon:
1. Renders a separate ``wg-<key>.conf`` for each class that has assigned peers.
2. Each class interface gets its own private/public key pair.
3. The sync subscriber creates a ``vpn-<key>`` firewall zone per class with masquerade enabled.
4. Classes with ``lan_access=true`` get additional inter-zone rules for internal subnets.
5. ``apply`` brings up all class interfaces independently. Per-class ``up``/``down`` endpoints control individual tunnels.
### Legacy Single-Interface Mode
When no peers are assigned to any access class, the system falls back to the legacy single-interface mode where all peers share ``wg0``.
### Peer Fields
Peers are stored in an object keyed by a human-readable identifier (e.g., `alice`, `office-laptop`). Each peer entry defines a WireGuard peer configuration. When `add_peer()` is called, the peer's key pair is auto-generated. The `private_key` is stored for client configuration generation but stripped from all API responses.
@@ -318,6 +372,8 @@ Peers are stored in an object keyed by a human-readable identifier (e.g., `alice
| `allowed_ips` | array | No | CIDR blocks that traffic from this peer is allowed to route. Default: `[]` (no routing restrictions from the server side). `["0.0.0.0/0"]` allows all traffic. `["10.137.0.0/16"]` restricts traffic to the VPN subnet. |
| `persistent_keepalive` | integer | No | Keepalive interval in seconds. `25` is recommended for peers behind NAT. Set to `0` or `null` to disable. Default: `null`. |
| `preshared_key` | string | No | Optional pre-shared key for post-quantum resistance. Use `wg genpsk` to generate. Default: `null`. |
| `description` | string | No | Optional description for the peer. Default: `""`. |
| `access_class` | string | No | Key of the access class this peer belongs to (e.g., `"full"`, `"internet"`). `null` means unassigned. Default: `null`. |
### Client Configuration Generation
@@ -488,7 +544,7 @@ are updated automatically through the event bus.
| Trigger Subsystem | Affected Subsystem | What Happens |
|---|---|---|
| dnsmasq (DHCP range) | firewall | Zone gains `dhcp`/`dns` services. Removing the last range removes them. DHCP ranges also back-propagate gateway (interface IP) so clients receive their default route. |
| wireguard (peer add/remove) | firewall | `vpn` zone is created or maintained with `wg0` interface, masquerade, UDP 51820 rule, and inter-zone accept rules for each peer's allowed_ips subnets. Cleanup runs when no active peers exist. |
| wireguard (peer add/remove) | firewall | Per-class `vpn-<key>` zones are created with `wg-<key>` interface, masquerade, UDP port rule, and inter-zone accept rules (only when ``lan_access=true``). Falls back to single `vpn` zone in legacy mode. Cleanup removes stale rules when classes have no peers. |
| firewall (zone changes) | dnsmasq | Stale DHCP ranges (for interfaces no longer in any zone) are automatically removed. Masquerade-enabled zones ensure DHCP ranges carry the gateway. Zones with dhcp service but no range are logged as warnings. |
| network (interface config) | firewall | Zone interface assignments in firewall config are updated — new interfaces are flagged, stale ones removed. |
| network (interface config) | dnsmasq | Suggested DHCP ranges are logged when an interface has a static IP but no DHCP range. |
lib/state.py
+176 -66
View File
@@ -279,52 +279,40 @@ def _strip_volatile(
for k in pop_keys:
stripped.pop(k, None)
for vpath in volatile:
# Determine if this path uses list-of-dicts pattern (e.g. "peers[].transfer").
# The [] marker signals that the parent key holds a list of dicts, and we
# must strip the volatile sub-key from each dict in the list.
list_marker = vpath.index("[]") if "[]" in vpath else -1
if list_marker != -1:
# Split into prefix (path before []), item keys (path after []).
# e.g. "status.peers[].transfer_received" → prefix=["status","peers"],
# item_keys=["transfer_received"]
prefix = vpath[:list_marker].split(".")
item_keys = (
vpath[list_marker + 3 :].split(".")
if list_marker + 3 < len(vpath)
else []
)
# Navigate to the list container via the prefix path
parent = stripped
for seg in prefix:
if isinstance(parent, dict) and seg in parent:
parent = parent[seg]
else:
break
if isinstance(parent, list):
items = parent
elif isinstance(parent, dict):
logger.debug(
"_strip_volatile: %s resolved to dict, falling back to .values()",
vpath,
)
items = parent.values()
else:
continue
_strip_volatile_path(stripped, vpath)
return stripped
for item in items:
# parent should now be a list; iterate each dict and strip sub-keys
if isinstance(item, dict):
curr = item
for i, ik in enumerate(item_keys):
if i == len(item_keys) - 1:
curr[ik] = None
def _strip_volatile_item(item: dict[str, Any], keys: list[str]) -> None:
"""Recursively strip volatile keys from *item*, handling nested ``[]`` markers."""
for i, k in enumerate(keys):
if "[]" in k:
base_key = k.replace("[]", "")
rest = keys[i + 1 :]
target = item.get(base_key, [])
if isinstance(target, list):
for t in target:
if isinstance(t, dict):
_strip_volatile_item(t, rest)
elif isinstance(target, dict):
for v in target.values():
if isinstance(v, dict):
_strip_volatile_item(v, rest)
return
elif i == len(keys) - 1:
item[k] = None
return
else:
if isinstance(curr, dict) and ik in curr:
curr = curr[ik]
if isinstance(item, dict) and k in item:
item = item[k]
else:
break
else:
# Scalar/dict path: navigate via segments and set final key to None
return
def _strip_volatile_path(stripped: dict[str, Any], vpath: str) -> None:
"""Strip a single volatile path from *stripped*, supporting nested ``[]`` markers."""
list_marker = vpath.index("[]") if "[]" in vpath else -1
if list_marker == -1:
segments = vpath.split(".")
parent = stripped
for i, seg in enumerate(segments):
@@ -335,8 +323,28 @@ def _strip_volatile(
if isinstance(parent, dict) and seg in parent:
parent = parent[seg]
else:
break
return stripped
return
return
# Split into prefix and item keys.
prefix = vpath[:list_marker].split(".")
item_keys = (
vpath[list_marker + 3 :].split(".") if list_marker + 3 < len(vpath) else []
)
parent = stripped
for seg in prefix:
if isinstance(parent, dict) and seg in parent:
parent = parent[seg]
else:
return
if isinstance(parent, list):
items = parent
elif isinstance(parent, dict):
items = list(parent.values())
else:
return
for item in items:
if isinstance(item, dict) and item_keys:
_strip_volatile_item(item, item_keys)
def _diff_layers(
@@ -872,10 +880,11 @@ register_collector("acme", _collect_acme)
def _collect_wireguard() -> dict[str, Any]:
"""Collect WireGuard config, status, and peers.
"""Collect WireGuard config, per-class status, and peers.
Returns:
Dict containing interface config, runtime status, and peers.
Dict containing interface config, per-class runtime status,
combined peers, and overall tunnel status.
"""
CONFIG_PATH = PROJECT_DIR / "config" / "wireguard" / "config.json"
@@ -886,9 +895,12 @@ def _collect_wireguard() -> dict[str, Any]:
"private_key": "",
"public_key": "",
"addresses": ["10.137.0.1/24"],
"server_endpoint": "",
"description": "",
"post_up": None,
"post_down": None,
},
"access_classes": {},
"peers": {},
}
@@ -907,11 +919,18 @@ def _collect_wireguard() -> dict[str, Any]:
cfg
)
# Safe config (strip private key and internal hash)
# Safe config (strip private keys from interface and access classes)
safe = {k: v for k, v in cfg.items() if k != _APPLY_HASH_KEY}
if "interface" in safe:
safe["interface"] = dict(safe["interface"])
safe["interface"].pop("private_key", None)
if "access_classes" in safe:
safe["access_classes"] = {}
for ck, cv in cfg.get("access_classes", {}).items():
if isinstance(cv, dict):
entry = dict(cv)
entry.pop("private_key", None)
safe["access_classes"][ck] = entry
# Peers list (safe)
peers: list[dict[str, Any]] = []
@@ -921,35 +940,49 @@ def _collect_wireguard() -> dict[str, Any]:
entry.pop("private_key", None)
peers.append(entry)
# Runtime status
status: dict[str, Any] = {"up": False, "interface": {}, "peers": []}
name = cfg["interface"]["name"]
peer_name = name if isinstance(name, str) else "wg0"
# Runtime status — per-class interfaces
status: dict[str, Any] = {
"up": False,
"interface": {},
"peers": [],
"classes": {},
}
classes = cfg.get("access_classes", {})
any_up = False
for class_key in classes:
class_cfg = classes.get(class_key)
if not isinstance(class_cfg, dict):
continue
ifname = f"wg-{class_key}"
try:
res = run_proc(["wg", "show", peer_name], sudo=True, check=False)
if res.returncode == 0:
res = run_proc(["wg", "show", ifname], sudo=True, check=False)
if res.returncode != 0:
status["classes"][class_key] = {
"up": False,
"interface": {},
"peers": [],
}
continue
raw = res.stdout.strip()
current_peer: dict[str, Any] | None = None
status_peers: list[dict[str, Any]] = []
class_peers: list[dict[str, Any]] = []
cls_up = False
cls_iface: dict[str, Any] = {}
for line in raw.splitlines():
line = line.strip()
if not line:
continue
if line.startswith("interface:"):
status["up"] = True
status["interface"] = {}
cls_up = True
cls_iface = {}
current_peer = None
continue
if line.startswith("public key:"):
status["interface"]["public_key"] = line.split(":", 1)[1].strip()
cls_iface["public_key"] = line.split(":", 1)[1].strip()
continue
if line.startswith("listening port:"):
status["interface"]["listen_port"] = int(
line.split(":", 1)[1].strip()
)
continue
if line.startswith("fwmark:"):
status["interface"]["fwmark"] = line.split(":", 1)[1].strip()
cls_iface["listen_port"] = int(line.split(":", 1)[1].strip())
continue
if line.startswith("peer:"):
cur_key = line.split(":", 1)[1].strip()
@@ -962,7 +995,7 @@ def _collect_wireguard() -> dict[str, Any]:
"transfer_sent": "0",
"persistent_keepalive": None,
}
status_peers.append(current_peer)
class_peers.append(current_peer)
continue
if current_peer is None:
continue
@@ -985,10 +1018,84 @@ def _collect_wireguard() -> dict[str, Any]:
current_peer["persistent_keepalive"] = int(
line.split(":", 1)[1].strip()
)
status["peers"] = status_peers
status["classes"][class_key] = {
"up": cls_up,
"interface": cls_iface,
"peers": class_peers,
}
if cls_up:
any_up = True
except Exception:
status["classes"][class_key] = {"up": False, "interface": {}, "peers": []}
# Also collect legacy single-interface status
try:
ifname = cfg["interface"].get("name", "wg0")
legacy_peers: list[dict[str, Any]] = []
current_peer: dict[str, Any] | None = None
res = run_proc(["wg", "show", ifname], sudo=True, check=False)
if res.returncode == 0:
raw = res.stdout.strip()
status["up"] = True
status["interface"] = {}
for line in raw.splitlines():
line = line.strip()
if not line:
continue
if line.startswith("interface:"):
status["interface"] = {}
current_peer = None
continue
if line.startswith("public key:"):
status["interface"]["public_key"] = line.split(":", 1)[1].strip()
continue
if line.startswith("listening port:"):
status["interface"]["listen_port"] = int(
line.split(":", 1)[1].strip()
)
continue
if line.startswith("peer:"):
cur_key = line.split(":", 1)[1].strip()
current_peer = {
"public_key": cur_key,
"endpoint": None,
"allowed_ips": [],
"latest_handshake": None,
"transfer_received": "0",
"transfer_sent": "0",
"persistent_keepalive": None,
}
legacy_peers.append(current_peer)
continue
if current_peer is None:
continue
if line.startswith("endpoint:"):
current_peer["endpoint"] = line.split(":", 1)[1].strip()
elif line.startswith("allowed ips:"):
current_peer["allowed_ips"] = (
line.split(":", 1)[1].strip().split(", ")
)
elif line.startswith("latest handshake:"):
current_peer["latest_handshake"] = line.split(":", 1)[1].strip()
elif line.startswith("transfer:"):
rest = line.split(":", 1)[1].strip().split(", ")
if rest:
current_peer["transfer_received"] = rest[0].strip()
if len(rest) > 1:
current_peer["transfer_sent"] = rest[1].strip()
elif line.startswith("persistent-keepalive:"):
with contextlib.suppress(ValueError):
current_peer["persistent_keepalive"] = int(
line.split(":", 1)[1].strip()
)
status["peers"] = legacy_peers
any_up = True
except Exception:
pass
if any_up:
status["up"] = True
status["pending_changes"] = pending_changes
return {
"config": safe,
@@ -1006,6 +1113,9 @@ register_volatile(
"status.peers[].transfer_received",
"status.peers[].transfer_sent",
"status.peers[].latest_handshake",
"status.classes[].peers[].transfer_received",
"status.classes[].peers[].transfer_sent",
"status.classes[].peers[].latest_handshake",
}
),
)
lib/sync.py
+200 -52
View File
@@ -11,6 +11,7 @@ from dataclasses import dataclass, field
from typing import Any
from lib.common import get_interface_ip
from lib.state import state as _state_store
logger = logging.getLogger(__name__)
@@ -392,8 +393,6 @@ class DnsToFirewallSync:
changes: list[str],
) -> None:
"""Ensure DHCP ranges for *zone_ifaces* carry the gateway (interface IP)."""
from lib.common import get_interface_ip
ranges = dnsmasq_cfg.get("dhcp", {}).get("ranges", [])
for r in ranges:
iface = r.get("interface", "")
@@ -410,7 +409,23 @@ class DnsToFirewallSync:
class WgToFirewallSync:
"""Sync subscriber: wireguard config_saved → update firewall config."""
"""Sync subscriber: wireguard config_saved → update firewall zones per access class.
Each access class with peers gets its own firewall zone (``vpn-<key>``).
Classes with ``lan_access=True`` get inter-zone accept rules for all
internal subnets. Classes with ``lan_access=False`` (internet-only) get
no internal subnet rules.
"""
@staticmethod
def _wg_class_interface_name(class_key: str) -> str:
"""Derive interface name for an access class."""
return f"wg-{class_key}"
@staticmethod
def _wg_class_zone_name(class_key: str) -> str:
"""Derive firewall zone name for an access class."""
return f"vpn-{class_key}"
@staticmethod
def _sync_allowed_ips(
@@ -419,15 +434,9 @@ class WgToFirewallSync:
zones: dict[str, Any],
changes: list[str],
) -> None:
"""Ensure inter-zone rich rules exist for peer allowed_ips subnets.
For each peer's allowed_ips subnet that is not already covered
by a vpn-zone rich rule, adds a destination accept rule so
traffic from the VPN can reach those subnets.
"""
"""Add inter-zone rich rules for peer allowed_ips subnets."""
import re
# Collect all unique allowed_ips subnets across peers
all_subnets: set[str] = set()
for _name, peer_info in wg_cfg.get("peers", {}).items():
if not isinstance(peer_info, dict):
@@ -436,7 +445,6 @@ class WgToFirewallSync:
if isinstance(item, str) and item.strip():
all_subnets.add(item.strip())
# Parse existing rule strings to find which subnets are already covered
existing_rules = vpn_zone.get("rich_rules", [])
covered_subnets: set[str] = set()
for rule_entry in existing_rules:
@@ -445,19 +453,15 @@ class WgToFirewallSync:
if isinstance(rule_entry, dict)
else str(rule_entry)
)
match = re.search(
r'destination\s+address="([^"]+)"',
str(rule_str),
)
match = re.search(r'destination\s+address="([^"]+)"', str(rule_str))
if match:
covered_subnets.add(match.group(1))
# Add rules for uncovered subnets
for subnet in sorted(all_subnets):
if subnet in covered_subnets:
continue
rule_entry = {
"rule": (f'rule family="ipv4" destination address="{subnet}" accept'),
"rule": f'rule family="ipv4" destination address="{subnet}" accept',
"_source": "wg",
}
vpn_zone.setdefault("rich_rules", []).append(rule_entry)
@@ -467,13 +471,17 @@ class WgToFirewallSync:
@classmethod
def on_wireguard_config_saved(cls, event: SyncEvent) -> SyncResult | None:
"""Sync subscriber: wireguard config_saved → update firewall config.
"""Sync subscriber: wireguard config_saved → update firewall zones per class.
When WireGuard is active (has peers and interface), this subscriber
ensures the ``vpn`` zone exists with the WG interface assigned,
masquerade enabled, UDP 51820 accept rule, and inter-zone rich rules
for peer allowed_ips subnets. When WireGuard becomes inactive,
cleans up WireGuard-created entries from the vpn zone.
For each access class with peers, ensures a ``vpn-<key>`` zone exists
with the WG interface assigned, masquerade enabled, and a UDP port
accept rule. Classes with ``lan_access=True`` also get inter-zone
accept rules for internal subnets.
Also handles legacy single-interface mode: when no classes have peers
but peers exist without access_class, manages a single ``vpn`` zone.
Cleans up zones/classes when empty.
Skips processing if event originated as a cascade from ``firewall``.
@@ -482,7 +490,7 @@ class WgToFirewallSync:
Returns:
SyncResult listing firewall as affected subsystem with change
descriptions. ``None`` if skipped due to cascade guard.
descriptions. ``None`` if skipped due cascade guard.
"""
if event.payload.get("_cascade") == "firewall":
return None
@@ -496,54 +504,148 @@ class WgToFirewallSync:
fw_cfg = _get_fw_cfg()
zones = fw_cfg.get("zones", {})
wg_iface = wg_cfg.get("interface", {}).get("name", "")
peers = wg_cfg.get("peers", {})
is_active = bool(peers) and bool(wg_iface)
changes: list[str] = []
active_class_keys: set[str] = set()
if is_active:
# --- Per-class zone management ---
classes = wg_cfg.get("access_classes", {})
for class_key, class_cfg in classes.items():
if not isinstance(class_cfg, dict):
continue
class_peers = {
n: p
for n, p in wg_cfg.get("peers", {}).items()
if isinstance(p, dict) and p.get("access_class") == class_key
}
if not class_peers:
continue
active_class_keys.add(class_key)
zone_name = cls._wg_class_zone_name(class_key)
iface_name = cls._wg_class_interface_name(class_key)
listen_port = class_cfg.get("listen_port", 51820)
lan_access = class_cfg.get("lan_access", False)
zone = zones.setdefault(zone_name, {})
if not isinstance(zone, dict):
zones[zone_name] = zone = {}
# Ensure interface assigned
current_ifaces = list(zone.get("interfaces", []))
if iface_name not in current_ifaces:
current_ifaces.append(iface_name)
zone["interfaces"] = current_ifaces
changes.append(
f"Assigned interface '{iface_name}' to zone '{zone_name}'"
)
# Ensure masquerade
if not zone.get("masquerade"):
zone["masquerade"] = True
changes.append(f"Enabled masquerade on zone '{zone_name}'")
# Ensure UDP port rule
rich_rules = list(zone.get("rich_rules", []))
udp_rule_str = f'rule family="ipv4" port protocol="udp" port="{listen_port}" accept'
udp_rule = {
"rule": udp_rule_str,
"_source": "wg",
}
rule_strings = {r.get("rule") for r in rich_rules}
if udp_rule_str not in rule_strings:
rich_rules.append(udp_rule)
zone["rich_rules"] = rich_rules
changes.append(
f"Added UDP {listen_port} accept rule to zone '{zone_name}'"
)
# LAN access rules: add inter-zone accept rules for internal
# subnets derived from firewall zones that have masquerade=false
if lan_access:
cls._add_lan_rules(zone, fw_cfg, changes, zone_name)
zones[zone_name] = zone
# --- Legacy single-interface zone (back compat) ---
# When peers exist without access_class, manage a "vpn" zone
unassigned_peers = {
n: p
for n, p in wg_cfg.get("peers", {}).items()
if isinstance(p, dict) and not p.get("access_class")
}
wg_iface = wg_cfg.get("interface", {}).get("name", "wg0")
if unassigned_peers:
vpn_zone = zones.get("vpn", {})
if not isinstance(vpn_zone, dict):
vpn_zone = {}
zones["vpn"] = vpn_zone
# Ensure interface is assigned
current_ifaces = list(vpn_zone.get("interfaces", []))
if wg_iface not in current_ifaces:
current_ifaces.append(wg_iface)
vpn_zone["interfaces"] = current_ifaces
changes.append(f"Assigned interface '{wg_iface}' to zone 'vpn'")
# Ensure masquerade
if not vpn_zone.get("masquerade"):
vpn_zone["masquerade"] = True
changes.append("Enabled masquerade on zone 'vpn'")
# Ensure UDP 51820 rich rule exists
rich_rules = list(vpn_zone.get("rich_rules", []))
expected_rule = {
"rule": 'rule family="ipv4" port protocol="udp" port="51820" accept',
"_source": "wg",
}
udp_rule_str = (
'rule family="ipv4" port protocol="udp" port="51820" accept'
)
udp_rule = {"rule": udp_rule_str, "_source": "wg"}
rule_strings = {r.get("rule") for r in rich_rules}
if expected_rule["rule"] not in rule_strings:
rich_rules.append(expected_rule)
if udp_rule_str not in rule_strings:
rich_rules.append(udp_rule)
vpn_zone["rich_rules"] = rich_rules
changes.append("Added UDP 51820 accept rich rule to zone 'vpn'")
changes.append("Added UDP 51820 accept rule to zone 'vpn'")
zones["vpn"] = vpn_zone
# Add inter-zone rules for peer allowed_ips subnets
cls._sync_allowed_ips(wg_cfg, vpn_zone, zones, changes)
zones["vpn"] = vpn_zone
else:
# Not active — selectively clean up WireGuard-created entries
# from the vpn zone without removing the zone itself.
# --- Cleanup: remove empty class zones ---
has_any_peers = bool(wg_cfg.get("peers"))
if has_any_peers:
for zone_name in list(zones.keys()):
if not zone_name.startswith("vpn-"):
continue
ckey = zone_name[4:]
if ckey and ckey not in active_class_keys:
zone = zones[zone_name]
if isinstance(zone, dict):
rules = [
r
for r in zone.get("rich_rules", [])
if not (
isinstance(r, dict) and r.get("_source") == "wg"
)
]
cleaned = False
if len(rules) < len(zone.get("rich_rules", [])):
zone["rich_rules"] = rules
cleaned = True
if zone.get("masquerade"):
zone["masquerade"] = False
cleaned = True
if zone.get("interfaces"):
zone["interfaces"] = []
cleaned = True
if cleaned:
changes.append(
f"Cleaned up stale rules from zone '{zone_name}'"
)
elif not unassigned_peers and not active_class_keys:
# WireGuard inactive — clean up legacy vpn zone
vpn_zone = zones.get("vpn")
if not isinstance(vpn_zone, dict):
pass
else:
# Remove wg interface from vpn zone
wg_iface = wg_cfg.get("interface", {}).get("name", "")
current_ifaces = list(vpn_zone.get("interfaces", []))
if wg_iface and wg_iface in current_ifaces:
current_ifaces.remove(wg_iface)
@@ -551,19 +653,15 @@ class WgToFirewallSync:
changes.append(
f"Removed interface '{wg_iface}' from zone 'vpn'"
)
# Also clean up any residual wg0 that was in the original vpn zone but
# is no longer the configured WireGuard interface
if "wg0" in current_ifaces and (wg_iface or "") != "wg0":
if "wg0" in current_ifaces and wg_iface != "wg0":
current_ifaces.remove("wg0")
vpn_zone["interfaces"] = current_ifaces
changes.append("Removed interface 'wg0' from zone 'vpn'")
# Disable masquerade (only WireGuard relied on it)
if vpn_zone.get("masquerade"):
vpn_zone["masquerade"] = False
changes.append("Disabled masquerade on zone 'vpn'")
# Remove WireGuard-specific rich rules (only those with _source="wg")
rich_rules = list(vpn_zone.get("rich_rules", []))
wg_rule_ids: set[int] = set()
for idx, r in enumerate(rich_rules):
@@ -575,11 +673,12 @@ class WgToFirewallSync:
]
vpn_zone["rich_rules"] = rich_rules
changes.append(
f"Removed {len(wg_rule_ids)} WireGuard rich rule(s) from zone 'vpn'"
f"Removed {len(wg_rule_ids)} WireGuard rich rule(s) "
f"from zone 'vpn'"
)
if changes:
fw_cfg["zones"] = zones
if changes:
_save_fw_cfg(fw_cfg)
return SyncResult(
affected_subsystems=["firewall"],
@@ -590,6 +689,55 @@ class WgToFirewallSync:
logger.exception("WgToFirewallSync failed")
return SyncResult()
@staticmethod
def _add_lan_rules(
zone: dict[str, Any],
fw_cfg: dict[str, Any],
changes: list[str],
zone_name: str,
) -> None:
"""Add inter-zone accept rules for internal LAN subnets."""
rich_rules = list(zone.get("rich_rules", []))
rule_strings = {r.get("rule") for r in rich_rules}
# Collect internal subnets from zones without masquerade (except VPN zones)
for zname, zdata in fw_cfg.get("zones", {}).items():
if not isinstance(zdata, dict):
continue
if zname.startswith("vpn"):
continue
if zdata.get("masquerade"):
continue
for iface_name in zdata.get("interfaces", []):
# Try to get the subnet from network state
net_state = _state_store.get("networkd")
if net_state:
for if_key, if_data in net_state.get("interfaces", {}).items():
if isinstance(if_data, dict) and if_key == iface_name:
for addr in if_data.get("addresses", []):
if isinstance(addr, dict):
addr_str = addr.get("address", "")
else:
addr_str = str(addr)
if "/" in addr_str:
rule_str = (
f'rule family="ipv4" destination '
f'address="{addr_str}" accept'
)
if rule_str not in rule_strings:
rule_entry = {
"rule": rule_str,
"_source": "wg",
}
rich_rules.append(rule_entry)
rule_strings.add(rule_str)
changes.append(
f"Added inter-zone rule for '{addr_str}' "
f"to zone '{zone_name}' (LAN access)"
)
zone["rich_rules"] = rich_rules
class FirewallToDhcpSync:
"""Sync subscriber: firewall config_saved → sync dnsmasq DHCP ranges.
@@ -878,7 +1026,7 @@ _bus.subscribe(
targets={"dnsmasq"},
)
_bus.subscribe(
"network",
"networkd",
"config_saved",
NetworkToAllSync.on_network_config_saved,
targets={"firewall", "dnsmasq"},
lib/wireguard.py
+413 -86
View File
@@ -1,7 +1,8 @@
"""WireGuard Manager for Vacuum Wall SSL Proxy Firewall.
Generates wg-quick configurations, manages peers, and controls
the WireGuard tunnel interface.
the WireGuard tunnel interface. Supports multi-interface mode where
each access class gets its own WireGuard interface.
"""
import logging
@@ -19,7 +20,6 @@ logger = logging.getLogger(__name__)
PROJECT_DIR = Path(__file__).resolve().parent.parent
CONFIG_PATH = PROJECT_DIR / "config" / "wireguard" / "config.json"
WG_CONF_PATH = "/etc/wireguard/wg0.conf"
WG_QUICK_BIN = "wg-quick"
WG_BIN = "wg"
@@ -30,6 +30,25 @@ ENV = Environment(
trim_blocks=True,
)
def _wg_conf_path(ifname: str) -> str:
"""Return the system WG conf path for an interface name."""
return f"/etc/wireguard/{ifname}.conf"
def _default_class_fields() -> dict[str, Any]:
"""Return the default set of fields for an access class entry."""
return {
"name": "",
"description": "",
"subnet": None,
"listen_port": None,
"lan_access": False,
"private_key": "",
"public_key": "",
}
DEFAULT_CONFIG: dict[str, Any] = {
"interface": {
"name": "wg0",
@@ -37,9 +56,31 @@ DEFAULT_CONFIG: dict[str, Any] = {
"private_key": "",
"public_key": "",
"addresses": ["10.137.0.1/24"],
"server_endpoint": "",
"description": "",
"post_up": None,
"post_down": None,
},
"access_classes": {
"full": {
"name": "Full LAN Access",
"description": "Peers get full access to internal networks",
"subnet": "10.137.0.0/24",
"listen_port": 51820,
"lan_access": True,
"private_key": "",
"public_key": "",
},
"internet": {
"name": "Internet Only",
"description": "Peers can only reach the internet",
"subnet": "10.137.1.0/24",
"listen_port": 51821,
"lan_access": False,
"private_key": "",
"public_key": "",
},
},
"peers": {},
}
@@ -62,23 +103,114 @@ def save_config(cfg: dict[str, Any]) -> None:
def generate_keypair() -> tuple[str, str]:
"""Generate a WireGuard private/public key pair using ``wg`` CLI."""
res = run_proc([WG_BIN, "genkey"], sudo=True)
res = run_proc([WG_BIN, "genkey"], sudo=False)
private_key = res.stdout.strip()
res2 = run_proc([WG_BIN, "pubkey"], sudo=True, input=private_key)
res2 = run_proc([WG_BIN, "pubkey"], sudo=False, input=private_key)
public_key = res2.stdout.strip()
return private_key, public_key
# --- wg0.conf generation ---
# --- Helpers ---
def _class_interface_name(class_key: str) -> str:
"""Derive interface name for an access class key."""
return f"wg-{class_key}"
def _class_zone_name(class_key: str) -> str:
"""Derive firewall zone name for an access class key."""
return f"vpn-{class_key}"
def get_class_interface_name(class_key: str) -> str:
"""Public wrapper for `_class_interface_name`."""
return _class_interface_name(class_key)
def get_class_zone_name(class_key: str) -> str:
"""Public wrapper for `_class_zone_name`."""
return _class_zone_name(class_key)
def _class_peers(cfg: dict[str, Any], class_key: str) -> dict[str, Any]:
"""Return peers assigned to a given access class."""
return {
name: info
for name, info in cfg.get("peers", {}).items()
if isinstance(info, dict) and info.get("access_class") == class_key
}
# --- wg-<class>.conf generation ---
def generate_class_conf(cfg: dict[str, Any], class_key: str) -> str | None:
"""Render a wg-quick config file for a single access class.
Returns ``None`` when the class has no peers assigned.
"""
classes = cfg.get("access_classes", {})
class_cfg = classes.get(class_key)
if not class_cfg or not isinstance(class_cfg, dict):
return None
peers = _class_peers(cfg, class_key)
if not peers:
return None
ifname = _class_interface_name(class_key)
subnet = class_cfg.get("subnet")
if not subnet:
subnet = "10.137.0.0/24"
_, prefix = subnet.rsplit("/", 1)
base = subnet.rsplit(".", 1)[0]
addr = f"{base}.1/{prefix}"
listen_port = class_cfg.get("listen_port")
if not listen_port:
listen_port = 51820
private_key = class_cfg.get("private_key", "")
if not private_key:
raise ValueError(
f"Access class '{class_key}' has no private key — generate one first."
)
class_iface = {
"name": ifname,
"listen_port": listen_port,
"private_key": private_key,
"addresses": [addr],
"post_up": cfg.get("interface", {}).get("post_up"),
"post_down": cfg.get("interface", {}).get("post_down"),
}
tmpl = ENV.get_template("wireguard.conf")
return tmpl.render(
timestamp=datetime.now(UTC).strftime("%Y-%m-%dT%H:%M:%SZ"),
interface=class_iface,
peers=peers,
)
def generate_conf(cfg: dict[str, Any]) -> str:
"""Render a valid wg-quick config file from *cfg* using Jinja2."""
"""Render a valid wg-quick config file from *cfg* using Jinja2.
Legacy single-interface mode — uses the top-level ``interface`` block
and peers without an ``access_class`` assigned.
"""
fallback_peers = {
n: p
for n, p in cfg.get("peers", {}).items()
if isinstance(p, dict) and not p.get("access_class")
}
tmpl = ENV.get_template("wireguard.conf")
return tmpl.render(
timestamp=datetime.now(UTC).strftime("%Y-%m-%dT%H:%M:%SZ"),
interface=cfg["interface"],
peers=cfg.get("peers", {}),
peers=fallback_peers if fallback_peers else {},
)
@@ -86,55 +218,187 @@ def generate_conf(cfg: dict[str, Any]) -> str:
def apply() -> None:
"""Write the current config to disk and bring the tunnel up with wg-quick."""
cfg = get_config()
conf_text = generate_conf(cfg)
save_config(cfg)
"""Write the current config to disk and bring tunnels up with wg-quick.
In multi-interface mode, applies each access class's interface independently.
Falls back to legacy single-interface mode when no classes have peers.
"""
cfg = get_config()
classes = cfg.get("access_classes", {})
applied = False
for class_key in classes:
class_cfg = classes.get(class_key)
if not class_cfg or not isinstance(class_cfg, dict):
continue
if not _class_peers(cfg, class_key):
continue
try:
conf_text = generate_class_conf(cfg, class_key)
if not conf_text:
continue
except ValueError:
continue
ifname = _class_interface_name(class_key)
conf_path = _wg_conf_path(ifname)
local_dir = PROJECT_DIR / "data" / "wireguard"
local_dir.mkdir(parents=True, exist_ok=True)
local_tmp = local_dir / "wg0.conf.tmp"
local_tmp = local_dir / f"{ifname}.conf.tmp"
with open(local_tmp, "w") as f:
f.write(conf_text)
os.chmod(local_tmp, 0o600)
run(["cp", "--", str(local_tmp), WG_CONF_PATH], sudo=True)
run(["chown", "root:root", WG_CONF_PATH], sudo=True, check=False)
run(["cp", "--", str(local_tmp), conf_path], sudo=True)
run(["chown", "root:root", conf_path], sudo=True, check=False)
local_tmp.unlink(missing_ok=True)
run([WG_QUICK_BIN, "up", ifname], sudo=True)
logger.info("WireGuard tunnel '%s' (class '%s') brought up", ifname, class_key)
applied = True
run([WG_QUICK_BIN, "up", cfg["interface"]["name"]], sudo=True)
logger.info("WireGuard tunnel '%s' brought up", cfg["interface"]["name"])
if applied:
save_config(cfg)
elif applied is False:
# Legacy single-interface fallback
legacy_apply(cfg)
def legacy_apply(cfg: dict[str, Any]) -> None:
"""Legacy single-interface apply."""
conf_text = generate_conf(cfg)
save_config(cfg)
ifname = cfg["interface"]["name"]
conf_path = _wg_conf_path(ifname)
local_dir = PROJECT_DIR / "data" / "wireguard"
local_dir.mkdir(parents=True, exist_ok=True)
local_tmp = local_dir / f"{ifname}.conf.tmp"
with open(local_tmp, "w") as f:
f.write(conf_text)
os.chmod(local_tmp, 0o600)
run(["cp", "--", str(local_tmp), conf_path], sudo=True)
run(["chown", "root:root", conf_path], sudo=True, check=False)
local_tmp.unlink(missing_ok=True)
run([WG_QUICK_BIN, "up", ifname], sudo=True)
logger.info("WireGuard tunnel '%s' brought up", ifname)
def apply_class(class_key: str) -> None:
"""Apply config for a single access class interface."""
cfg = get_config()
class_cfg = cfg.get("access_classes", {}).get(class_key)
if not class_cfg or not isinstance(class_cfg, dict):
raise ValueError(f"Access class '{class_key}' not found")
conf_text = generate_class_conf(cfg, class_key)
if not conf_text:
raise ValueError(f"No peers assigned to class '{class_key}'")
ifname = _class_interface_name(class_key)
conf_path = _wg_conf_path(ifname)
local_dir = PROJECT_DIR / "data" / "wireguard"
local_dir.mkdir(parents=True, exist_ok=True)
local_tmp = local_dir / f"{ifname}.conf.tmp"
with open(local_tmp, "w") as f:
f.write(conf_text)
os.chmod(local_tmp, 0o600)
run(["cp", "--", str(local_tmp), conf_path], sudo=True)
run(["chown", "root:root", conf_path], sudo=True, check=False)
local_tmp.unlink(missing_ok=True)
run([WG_QUICK_BIN, "up", ifname], sudo=True)
save_config(cfg)
logger.info("WireGuard tunnel '%s' (class '%s') brought up", ifname, class_key)
def down() -> None:
"""Bring the WireGuard tunnel interface down."""
"""Bring all WireGuard tunnel interfaces down.
In multi-interface mode, brings down each class interface with peers.
"""
cfg = get_config()
name = cfg["interface"]["name"]
run([WG_QUICK_BIN, "down", name], sudo=True)
logger.info("WireGuard tunnel '%s' brought down", name)
classes = cfg.get("access_classes", {})
for class_key in classes:
class_cfg = classes.get(class_key)
if not class_cfg or not isinstance(class_cfg, dict):
continue
if ifname := _class_interface_name(class_key):
try:
run([WG_QUICK_BIN, "down", ifname], sudo=True)
logger.info("WireGuard tunnel '%s' brought down", ifname)
except Exception:
pass
# Also try legacy interface (skip if name matches any class interface)
ifname = cfg["interface"].get("name", "")
if ifname:
class_names = {_class_interface_name(k) for k in classes}
if ifname not in class_names:
try:
run([WG_QUICK_BIN, "down", ifname], sudo=True)
logger.info("WireGuard tunnel '%s' brought down", ifname)
except Exception:
pass
def down_class(class_key: str) -> None:
"""Bring down a single access class interface."""
ifname = _class_interface_name(class_key)
run([WG_QUICK_BIN, "down", ifname], sudo=True)
logger.info("WireGuard tunnel '%s' brought down", ifname)
# --- Status ---
def status() -> dict[str, Any]:
"""Query the live tunnel state via ``wg show``."""
"""Query the live tunnel state via ``wg show``.
In multi-interface mode, collects status for all class interfaces.
Returns combined status dict keyed by interface name.
"""
cfg = get_config()
name = cfg["interface"]["name"]
result: dict[str, Any] = {
"up": False,
"interface": {},
"peers": [],
"classes": {},
}
# Collect per-class status
classes = cfg.get("access_classes", {})
for class_key in classes:
ifname = _class_interface_name(class_key)
try:
res = run_proc([WG_BIN, "show", ifname], sudo=True, check=False)
if res.returncode != 0:
result["classes"][class_key] = {"up": False, "peers": []}
continue
class_status = _parse_wg_show_output(res.stdout.strip())
result["classes"][class_key] = class_status
if class_status["up"]:
result["up"] = True
except Exception:
result["classes"][class_key] = {"up": False, "peers": []}
# Legacy single-interface status (still collected for backward compat)
try:
ifname = cfg["interface"].get("name", "wg0")
res = run_proc([WG_BIN, "show", ifname], sudo=True, check=False)
if res.returncode == 0:
parsed = _parse_wg_show_output(res.stdout.strip())
result["up"] = parsed["up"]
result["interface"] = parsed.get("interface", {})
result["peers"] = parsed.get("peers", [])
except Exception:
pass
return result
def _parse_wg_show_output(raw: str) -> dict[str, Any]:
"""Parse ``wg show`` output into structured dict."""
result: dict[str, Any] = {
"up": False,
"interface": {},
"peers": [],
}
try:
res = run_proc([WG_BIN, "show", name], sudo=True, check=False)
if res.returncode != 0:
return result
raw = res.stdout.strip()
except Exception:
return result
current_peer: dict[str, Any] | None = None
peers: list[dict[str, Any]] = []
@@ -169,8 +433,8 @@ def status() -> dict[str, Any]:
"endpoint": None,
"allowed_ips": [],
"latest_handshake": None,
"transfer_received": 0,
"transfer_sent": 0,
"transfer_received": "0",
"transfer_sent": "0",
"persistent_keepalive": None,
}
peers.append(current_peer)
@@ -214,36 +478,50 @@ def status() -> dict[str, Any]:
# --- Peer management ---
_UNSET = object()
def add_peer(
name: str,
endpoint: str | None = None,
allowed_ips: list[str] | None = None,
persistent_keepalive: int | None = None,
endpoint: str | None | object = _UNSET,
allowed_ips: list[str] | None | object = _UNSET,
persistent_keepalive: int | None | object = _UNSET,
preshared_key: str | None = None,
description: str | None = None,
access_class: str | None = None,
) -> dict[str, Any]:
"""Add (or update) a peer in the configuration."""
cfg = get_config()
peers = cfg.setdefault("peers", {})
allowed_ips = allowed_ips or []
if name in peers:
peer = peers[name]
if endpoint is not _UNSET:
peer["endpoint"] = endpoint
peer["allowed_ips"] = allowed_ips
if allowed_ips is not _UNSET:
peer["allowed_ips"] = allowed_ips if allowed_ips is not None else []
if persistent_keepalive is not _UNSET:
peer["persistent_keepalive"] = persistent_keepalive
if preshared_key is not None:
peer["preshared_key"] = preshared_key
if description is not None:
peer["description"] = description
if access_class is not None:
peer["access_class"] = access_class
logger.info("WireGuard peer '%s' updated", name)
else:
priv, pub = generate_keypair()
peer = {
"public_key": pub,
"private_key": priv,
"endpoint": endpoint,
"allowed_ips": allowed_ips,
"persistent_keepalive": persistent_keepalive,
"endpoint": endpoint if endpoint is not _UNSET else None,
"allowed_ips": allowed_ips if allowed_ips is not _UNSET else [],
"persistent_keepalive": persistent_keepalive
if persistent_keepalive is not _UNSET
else None,
"preshared_key": preshared_key,
"description": description,
"access_class": access_class,
}
peers[name] = peer
logger.info("WireGuard peer '%s' added (pubkey=%s...)", name, pub[:16])
@@ -275,9 +553,17 @@ def get_peers() -> list[dict[str, Any]]:
def get_peer_status() -> list[dict[str, Any]]:
"""Return live peer status from ``wg show``."""
"""Return live peer status from ``wg show`` for all interfaces."""
st = status()
return st.get("peers", [])
all_peers: list[dict[str, Any]] = []
for _class_key, class_st in st.get("classes", {}).items():
for p in class_st.get("peers", []):
merged = dict(p)
merged["access_class"] = _class_key
all_peers.append(merged)
if not all_peers:
all_peers = st.get("peers", [])
return all_peers
# --- Client config generation ---
@@ -286,9 +572,13 @@ def get_peer_status() -> list[dict[str, Any]]:
def generate_client_conf(
peer_name: str,
server_endpoint: str,
server_pubkey: str,
server_pubkey: str | None = None,
) -> str:
"""Build a client-side wg-quick config snippet for *peer_name*."""
"""Build a client-side wg-quick config snippet for *peer_name*.
Uses the peer's access class to derive server address from the class
subnet and the class's listen port.
"""
cfg = get_config()
iface = cfg["interface"]
peer = cfg["peers"].get(peer_name)
@@ -301,12 +591,30 @@ def generate_client_conf(
f"Peer '{peer_name}' has no private key — cannot generate client config."
)
# Determine class info for address/port
access_class = peer.get("access_class")
sorted_peers = sorted(cfg.get("peers", {}).keys())
peer_index = sorted_peers.index(peer_name) + 2
srv_addr = iface["addresses"][0] if iface["addresses"] else "10.137.0.1/24"
addr_part, prefix = srv_addr.rsplit("/", 1)
prefix_base = addr_part.rsplit(".", 1)[0]
client_addr = f"{prefix_base}.{peer_index}/{prefix}"
if access_class and access_class in cfg.get("access_classes", {}):
class_cfg = cfg["access_classes"][access_class]
subnet = class_cfg.get("subnet", "10.137.0.0/24")
listen_port = class_cfg.get("listen_port", 51820)
else:
subnet = iface.get("addresses", ["10.137.0.1/24"])[0]
listen_port = iface.get("listen_port", 51820)
if "/" not in subnet:
subnet = f"{subnet}/24"
addr = subnet.rsplit(".", 1)[0]
prefix = subnet.rsplit("/", 1)[1]
client_addr = f"{addr}.{peer_index}/{prefix}"
sk = server_pubkey or iface.get("public_key", "")
ep = server_endpoint or iface.get("server_endpoint", "")
if ep and listen_port:
host = ep.split(":")[0]
ep = f"{host}:{listen_port}"
tmpl = ENV.get_template("wireguard-client.conf")
conf = tmpl.render(
@@ -314,8 +622,8 @@ def generate_client_conf(
peer_name=peer_name,
client_priv=client_priv,
client_addr=client_addr,
server_pubkey=server_pubkey,
server_endpoint=server_endpoint,
server_pubkey=sk,
server_endpoint=ep,
allowed_ips=peer.get("allowed_ips", ["0.0.0.0/0"]),
preshared_key=peer.get("preshared_key"),
persistent_keepalive=peer.get("persistent_keepalive"),
@@ -351,66 +659,85 @@ def set_post_down(cmd: str | None) -> None:
save_config(cfg)
# --- Class key generation ---
def generate_class_keypair(class_key: str) -> tuple[str, str]:
"""Generate a key pair for an access class interface."""
cfg = get_config()
classes = cfg.setdefault("access_classes", {})
if class_key not in classes:
raise ValueError(f"Access class '{class_key}' not found")
class_cfg = classes[class_key]
if class_cfg.get("private_key"):
return class_cfg["private_key"], class_cfg["public_key"]
priv, pub = generate_keypair()
class_cfg["private_key"] = priv
class_cfg["public_key"] = pub
save_config(cfg)
logger.info("Key pair generated for class '%s'", class_key)
return priv, pub
# --- Initialise ---
def _ensure_class_defaults(cfg: dict[str, Any]) -> None:
"""Ensure access classes have required Phase-2 fields."""
classes = cfg.setdefault("access_classes", {})
for _key, c in classes.items():
if not isinstance(c, dict):
continue
for field, default in _default_class_fields().items():
if field not in c:
c[field] = default
def _ensure_access_classes(cfg: dict[str, Any]) -> None:
"""Pre-seed default access classes if missing or empty (idempotent).
Also upgrades existing classes with Phase-2 fields.
"""
classes = cfg.setdefault("access_classes", {})
if not classes:
full_defaults = deepcopy(DEFAULT_CONFIG["access_classes"])
classes.update(full_defaults)
return
_ensure_class_defaults(cfg)
def initialize() -> dict[str, Any]:
"""Perform first-time WireGuard setup."""
cfg = get_config()
if cfg["interface"].get("private_key"):
_ensure_access_classes(cfg)
save_config(cfg)
return cfg
priv, pub = generate_keypair()
cfg["interface"]["private_key"] = priv
cfg["interface"]["public_key"] = pub
_ensure_access_classes(cfg)
save_config(cfg)
logger.info("WireGuard initialised (pubkey=%s...)", pub[:16])
return cfg
# --- Utility: parse wg show into structured peer map ---
def _parse_wg_show(output: str) -> dict[str, Any]:
"""Internal parser for ``wg show`` multiline output."""
peers: dict[str, dict[str, Any]] = {}
current: dict[str, Any] | None = None
for line in output.splitlines():
line = line.strip()
if line.startswith("peer:"):
key = line.split(":", 1)[1].strip()
current = {"_key": key}
peers[key] = current
continue
if current is None:
continue
if line.startswith("endpoint:"):
val = line.split(":", 1)[1].strip()
current["endpoint"] = val
elif line.startswith("allowed ips:"):
current["allowed_ips"] = line.split(":", 1)[1].strip()
elif line.startswith("latest handshake:"):
current["latest_handshake"] = line.split(":", 1)[1].strip()
elif line.startswith("transfer:"):
current["transfer_raw"] = line.split(":", 1)[1].strip()
elif line.startswith("persistent-keepalive:"):
current["persistent_keepalive"] = line.split(":", 1)[1].strip()
return peers
__all__ = [
"DEFAULT_CONFIG",
"add_peer",
"apply",
"apply_class",
"down",
"down_class",
"generate_class_conf",
"generate_class_keypair",
"generate_client_conf",
"generate_conf",
"generate_keypair",
"get_class_interface_name",
"get_class_zone_name",
"get_config",
"get_peer_status",
"get_peers",
tests/test_handler_network.py
+16
View File
@@ -160,10 +160,14 @@ class TestApplyAll:
}
)
runtime_dir = tmp_network / "run" / "vacuum-wall"
runtime_dir.mkdir(parents=True)
with (
patch("daemon.handlers.network.generate_network_files") as mock_gen,
patch("daemon.handlers.network.run") as mock_run,
patch("daemon.handlers.network.collect_upstream_dns", return_value=[]),
patch("daemon.handlers.network.RUNTIME_DIR", runtime_dir),
):
mock_gen.return_value = {
"generated": [_net.DATA_DIR / "99-eth0.network"],
@@ -188,11 +192,15 @@ class TestApplyAll:
}
)
runtime_dir = tmp_network / "run" / "vacuum-wall"
runtime_dir.mkdir(parents=True)
with (
patch("daemon.handlers.network.generate_network_files") as mock_gen,
patch("daemon.handlers.network.run") as mock_run,
patch("daemon.handlers.network.set_upstreams") as mock_set_upstreams,
patch("daemon.handlers.network.collect_upstream_dns") as mock_collect,
patch("daemon.handlers.network.RUNTIME_DIR", runtime_dir),
):
mock_gen.return_value = {
"generated": [_net.DATA_DIR / "99-eth0.network"],
@@ -208,6 +216,9 @@ class TestApplyAll:
def test_apply_all_handles_dns_sync_failure(self, tmp_network):
_net.save_config({"interfaces": {"eth0": {"dns": ["8.8.8.8"]}}})
runtime_dir = tmp_network / "run" / "vacuum-wall"
runtime_dir.mkdir(parents=True)
with (
patch("daemon.handlers.network.generate_network_files") as mock_gen,
patch("daemon.handlers.network.run") as mock_run,
@@ -216,6 +227,7 @@ class TestApplyAll:
side_effect=RuntimeError("fail"),
),
patch("daemon.handlers.network.collect_upstream_dns") as mock_collect,
patch("daemon.handlers.network.RUNTIME_DIR", runtime_dir),
):
mock_gen.return_value = {
"generated": [_net.DATA_DIR / "99-eth0.network"],
@@ -233,10 +245,14 @@ class TestApplyAll:
sys_dir.mkdir(parents=True)
(sys_dir / "stale-file.network").write_text("[Match]\nName=old\n")
runtime_dir = tmp_network / "run" / "vacuum-wall"
runtime_dir.mkdir(parents=True)
with (
patch("daemon.handlers.network.generate_network_files") as mock_gen,
patch("daemon.handlers.network.run") as mock_run,
patch("daemon.handlers.network.collect_upstream_dns", return_value=[]),
patch("daemon.handlers.network.RUNTIME_DIR", runtime_dir),
):
mock_gen.return_value = {
"generated": [_net.DATA_DIR / "99-eth0.network"],
tests/test_system_import.py
+5 -1
View File
@@ -580,7 +580,11 @@ class TestImportFirewall:
class TestImportAll:
def test_all_missing(self, temp_project):
def test_all_missing(self, temp_project, tmp_path):
from unittest.mock import MagicMock, patch
mock_run = MagicMock(side_effect=RuntimeError("command not found"))
with patch.object(system_import, "run", mock_run):
result = system_import.import_all()
assert result == []
tests/test_wireguard.py
+277 -6
View File
@@ -23,6 +23,13 @@ class TestDefaultConfig:
assert cfg["interface"]["private_key"] == ""
assert cfg["peers"] == {}
def test_classes_have_phase2_fields(self):
cfg = wireguard.DEFAULT_CONFIG
for ck, cv in cfg["access_classes"].items():
assert "subnet" in cv, f"Class {ck} missing subnet"
assert "listen_port" in cv, f"Class {ck} missing listen_port"
assert "lan_access" in cv, f"Class {ck} missing lan_access"
class TestGetConfig:
def test_returns_default_when_no_file(self, temp_config):
@@ -74,6 +81,92 @@ class TestGenerateKeyPair:
assert mock_run.call_args_list[1].kwargs.get("input") == "private-key"
class TestClassHelpers:
def test_class_interface_name(self):
assert wireguard.get_class_interface_name("full") == "wg-full"
assert wireguard.get_class_interface_name("internet") == "wg-internet"
assert wireguard.get_class_interface_name("custom") == "wg-custom"
def test_class_zone_name(self):
assert wireguard.get_class_zone_name("full") == "vpn-full"
assert wireguard.get_class_zone_name("internet") == "vpn-internet"
def test_class_peers(self):
cfg = {
"peers": {
"alice": {"access_class": "full", "public_key": "pk1"},
"bob": {"access_class": "internet", "public_key": "pk2"},
"carol": {"access_class": None, "public_key": "pk3"},
}
}
full_peers = wireguard._class_peers(cfg, "full")
assert len(full_peers) == 1
assert "alice" in full_peers
int_peers = wireguard._class_peers(cfg, "internet")
assert len(int_peers) == 1
assert "bob" in int_peers
class TestGenerateClassConf:
def test_returns_none_when_no_peers(self, temp_config):
cfg = deepcopy(wireguard.DEFAULT_CONFIG)
cfg["access_classes"]["full"]["private_key"] = "test-key"
result = wireguard.generate_class_conf(cfg, "full")
assert result is None
@patch("lib.wireguard.ENV")
def test_renders_template_per_class(self, mock_env, temp_config):
mock_tmpl = MagicMock()
mock_tmpl.render.return_value = "[Interface]\nPrivateKey = x\n"
mock_env.get_template.return_value = mock_tmpl
cfg = deepcopy(wireguard.DEFAULT_CONFIG)
cfg["access_classes"]["full"]["private_key"] = "test-key"
cfg["peers"]["alice"] = {
"access_class": "full",
"public_key": "pub1",
"private_key": "priv1",
"allowed_ips": ["0.0.0.0/0"],
}
result = wireguard.generate_class_conf(cfg, "full")
assert result is not None
assert mock_tmpl.render.call_count == 1
call_kwargs = mock_tmpl.render.call_args.kwargs
assert call_kwargs["interface"]["name"] == "wg-full"
assert call_kwargs["interface"]["private_key"] == "test-key"
assert "alice" in call_kwargs["peers"]
def test_raises_when_no_private_key(self, temp_config):
cfg = {
"interface": {
"name": "wg0",
"listen_port": 51820,
"private_key": "",
"addresses": ["10.137.0.1/24"],
},
"access_classes": {
"full": {
"name": "Full LAN Access",
"description": "Full access",
"subnet": "10.137.0.0/24",
"listen_port": 51820,
"lan_access": True,
},
},
"peers": {
"alice": {
"access_class": "full",
"public_key": "pub1",
},
},
}
wireguard.save_config(cfg)
cfg = wireguard.get_config()
with pytest.raises(ValueError, match="no private key"):
wireguard.generate_class_conf(cfg, "full")
class TestGetPeers:
def test_empty_peers(self, temp_config):
peers = wireguard.get_peers()
@@ -238,12 +331,190 @@ class TestStatus:
class TestGenerateWgShowParser:
def test_parses_peer_output(self):
output = (
"peer: PUBKEY1\n endpoint: 203.0.113.1:51820\n allowed ips: 10.0.0.0/24\n"
"interface: wg0\n"
" public key: IFACE-PUB\n"
" listening port: 51820\n"
" peer: PUBKEY1\n endpoint: 203.0.113.1:51820\n allowed ips: 10.0.0.0/24\n"
)
result = wireguard._parse_wg_show(output)
assert "PUBKEY1" in result
assert result["PUBKEY1"]["endpoint"] == "203.0.113.1:51820"
result = wireguard._parse_wg_show_output(output)
assert result["up"] is True
assert result["interface"]["public_key"] == "IFACE-PUB"
assert result["interface"]["listen_port"] == 51820
assert len(result["peers"]) == 1
assert result["peers"][0]["public_key"] == "PUBKEY1"
assert result["peers"][0]["endpoint"] == "203.0.113.1:51820"
assert result["peers"][0]["allowed_ips"] == ["10.0.0.0/24"]
def test_empty_output(self):
result = wireguard._parse_wg_show("")
assert result == {}
result = wireguard._parse_wg_show_output("")
assert result["up"] is False
assert result["peers"] == []
class TestAccessClasses:
def test_default_config_has_access_classes(self):
cfg = wireguard.DEFAULT_CONFIG
assert "access_classes" in cfg
assert "full" in cfg["access_classes"]
assert "internet" in cfg["access_classes"]
def test_ensure_access_classes_empty(self, temp_config):
cfg = {"interface": {}, "access_classes": {}, "peers": {}}
wireguard._ensure_access_classes(cfg)
assert "full" in cfg["access_classes"]
assert "internet" in cfg["access_classes"]
def test_ensure_access_classes_preserves_existing(self, temp_config):
cfg = {
"interface": {},
"access_classes": {"custom": {"name": "Custom"}},
"peers": {},
}
wireguard._ensure_access_classes(cfg)
assert "custom" in cfg["access_classes"]
assert "full" not in cfg["access_classes"]
def test_ensure_class_defaults_adds_phase2_fields(self, temp_config):
cfg = {"interface": {}, "access_classes": {"old": {"name": "Old"}}, "peers": {}}
wireguard._ensure_access_classes(cfg)
c = cfg["access_classes"]["old"]
assert "subnet" in c
assert "listen_port" in c
assert "lan_access" in c
assert "private_key" in c
assert "public_key" in c
class TestAddPeerWithNewFields:
@patch("lib.wireguard.generate_keypair")
def test_add_peer_with_description_and_access_class(self, mock_gen, temp_config):
mock_gen.return_value = ("priv", "pub")
result = wireguard.add_peer(
"test-peer",
description="Test peer",
access_class="full",
)
assert result["description"] == "Test peer"
assert result["access_class"] == "full"
cfg = wireguard.get_config()
assert cfg["peers"]["test-peer"]["description"] == "Test peer"
assert cfg["peers"]["test-peer"]["access_class"] == "full"
@patch("lib.wireguard.generate_keypair")
def test_update_peer_preserves_existing_fields(self, mock_gen, temp_config):
mock_gen.return_value = ("priv", "pub")
wireguard.add_peer("p1", description="original", access_class="full")
wireguard.add_peer("p1", endpoint="1.2.3.4:51820")
cfg = wireguard.get_config()
assert cfg["peers"]["p1"]["endpoint"] == "1.2.3.4:51820"
assert cfg["peers"]["p1"]["description"] == "original"
assert cfg["peers"]["p1"]["access_class"] == "full"
class TestInterfaceHasNewFields:
def test_default_has_server_endpoint(self):
assert wireguard.DEFAULT_CONFIG["interface"].get("server_endpoint") == ""
def test_default_has_description(self):
assert wireguard.DEFAULT_CONFIG["interface"].get("description") == ""
class TestClassKeyGeneration:
@patch("lib.wireguard.run_proc")
def test_generates_keypair_for_class(self, mock_run, temp_config):
mock_run.side_effect = [
MagicMock(returncode=0, stdout="class-priv\n"),
MagicMock(returncode=0, stdout="class-pub\n"),
]
# Create config with a fresh class (no prior keys, no auto-merge from file)
cfg = {
"interface": {
"name": "wg0",
"private_key": "existing",
"public_key": "pub",
},
"access_classes": {"fresh": {"name": "Fresh", "description": "New class"}},
"peers": {},
}
wireguard.save_config(cfg)
priv, pub = wireguard.generate_class_keypair("fresh")
assert priv == "class-priv"
assert pub == "class-pub"
loaded = wireguard.get_config()
assert loaded["access_classes"]["fresh"]["private_key"] == "class-priv"
assert loaded["access_classes"]["fresh"]["public_key"] == "class-pub"
@patch("lib.wireguard.run_proc")
def test_returns_existing_keys(self, mock_run, temp_config):
cfg = deepcopy(wireguard.DEFAULT_CONFIG)
cfg["access_classes"]["full"]["private_key"] = "existing-priv"
cfg["access_classes"]["full"]["public_key"] = "existing-pub"
wireguard.save_config(cfg)
priv, pub = wireguard.generate_class_keypair("full")
assert priv == "existing-priv"
assert pub == "existing-pub"
mock_run.assert_not_called()
def test_raises_for_missing_class(self, temp_config):
with pytest.raises(ValueError, match="not found"):
wireguard.generate_class_keypair("nonexistent")
class TestGetPeerStatusMultiInterface:
@patch("lib.wireguard.run_proc")
def test_aggregates_peers_across_classes(self, mock_run, temp_config):
def side_effect(cmd, **kwargs):
iface = cmd[-1]
if iface == "wg-full":
return MagicMock(
returncode=0,
stdout="interface:\n public key: FULL-PUB\n\npeer: PUB1\n",
)
if iface == "wg-internet":
return MagicMock(
returncode=0,
stdout="interface:\n public key: INT-PUB\n\npeer: PUB2\n",
)
# Legacy interface
if iface == "wg0":
return MagicMock(returncode=1, stdout="")
return MagicMock(returncode=1, stdout="")
cfg = deepcopy(wireguard.DEFAULT_CONFIG)
cfg["access_classes"]["full"]["private_key"] = "full-priv"
cfg["access_classes"]["internet"]["private_key"] = "int-priv"
wireguard.save_config(cfg)
mock_run.side_effect = side_effect
peers = wireguard.get_peer_status()
assert len(peers) == 2
assert peers[0]["public_key"] == "PUB1"
assert peers[0]["access_class"] == "full"
assert peers[1]["public_key"] == "PUB2"
assert peers[1]["access_class"] == "internet"
class TestApplyClass:
@patch("lib.wireguard.run")
@patch("lib.wireguard.run_proc")
@patch("lib.wireguard.ENV")
def test_apply_class_writes_and_up(
self, mock_env, mock_proc, mock_run, temp_config
):
mock_tmpl = MagicMock()
mock_tmpl.render.return_value = "[Interface]\nPrivateKey = x\n"
mock_env.get_template.return_value = mock_tmpl
cfg = deepcopy(wireguard.DEFAULT_CONFIG)
cfg["access_classes"]["full"]["private_key"] = "test-key"
cfg["peers"]["alice"] = {
"access_class": "full",
"public_key": "pub1",
"private_key": "priv1",
"allowed_ips": ["0.0.0.0/0"],
}
wireguard.save_config(cfg)
wireguard.apply_class("full")
# Should call wg-quick up
mock_run.assert_any_call(["wg-quick", "up", "wg-full"], sudo=True)
webui/api/dhcp.py
+31
View File
@@ -19,6 +19,7 @@ from daemon.iface import (
POST_DNSMASQ_APPLY,
POST_DNSMASQ_CONFIG,
POST_DNSMASQ_DNS_RECORD_ADD,
POST_DNSMASQ_DOMAIN,
POST_DNSMASQ_RANGES_ADD,
POST_DNSMASQ_STATIC_LEASE_ADD,
)
@@ -306,6 +307,36 @@ def add_dns_record_bp():
return _error(str(exc), 500)
# ---------------------------------------------------------------------------
# DNS domain
# ---------------------------------------------------------------------------
@bp.route("/domain", methods=["POST"])
def set_domain_bp():
"""POST /api/dhcp/domain — Set or clear the DNS search domain.
Args:
request: JSON body with `domain` field (string or null to clear).
Returns:
JSON response with success status or an error.
"""
body = request.get_json(silent=True) or {}
if not isinstance(body, dict):
return _error("Request body must be a JSON object", 400)
try:
post(POST_DNSMASQ_DOMAIN, {"domain": body.get("domain")})
logger.info("DNS domain updated via API: %s", body.get("domain"))
return _ok(None)
except BadRequest as exc:
logger.info("Set DNS domain rejected: %s", exc)
return _error(str(exc), 400)
except RuntimeError as exc:
logger.error("Failed to set DNS domain: %s", exc)
return _error(str(exc), 500)
@bp.route("/dns-record/<name>", methods=["DELETE"])
def remove_dns_record_bp(name):
"""DELETE /api/dhcp/dns-record/<name> — Remove a DNS record by name.
webui/api/wireguard.py
+164 -1
View File
@@ -7,15 +7,23 @@ import logging
from flask import Blueprint, request
from daemon.client import BadRequest, NotFound, delete, get, patch, post
from daemon.client import BadRequest, Conflict, NotFound, delete, get, patch, post
from daemon.iface import (
DELETE_WIREGUARD_CLASSES,
DELETE_WIREGUARD_CLASSES_DOWN,
DELETE_WIREGUARD_PEERS_REMOVE,
GET_WIREGUARD_CLASS_STATUS,
GET_WIREGUARD_CLASSES,
GET_WIREGUARD_CONFIG,
GET_WIREGUARD_PEER_STATUS,
GET_WIREGUARD_PEERS,
GET_WIREGUARD_STATUS,
PATCH_WIREGUARD_CLASSES,
PATCH_WIREGUARD_CONFIG,
POST_WIREGUARD_APPLY,
POST_WIREGUARD_CLASS_INIT_KEYS,
POST_WIREGUARD_CLASSES,
POST_WIREGUARD_CLASSES_UP,
POST_WIREGUARD_CONFIG,
POST_WIREGUARD_DOWN,
POST_WIREGUARD_GENERATE_CLIENT,
@@ -229,6 +237,8 @@ def add_peer_bp():
"allowed_ips": body.get("allowed_ips", []),
"persistent_keepalive": body.get("persistent_keepalive"),
"preshared_key": body.get("preshared_key"),
"description": body.get("description"),
"access_class": body.get("access_class"),
},
)
logger.info("WireGuard peer '%s' added via API", name)
@@ -337,3 +347,156 @@ def generate_client_bp():
except RuntimeError as exc:
logger.error("Failed to generate client config for '%s': %s", name, exc)
return _error(str(exc), 500)
@bp.route("/classes", methods=["GET"])
def list_classes_bp():
"""List all access classes.
Endpoint: GET /api/wireguard/classes
"""
try:
return _ok(get(GET_WIREGUARD_CLASSES))
except RuntimeError as exc:
logger.error("Failed to list access classes: %s", exc)
return _error(str(exc), 500)
@bp.route("/classes", methods=["POST"])
def create_class_bp():
"""Create a new access class.
Endpoint: POST /api/wireguard/classes
"""
body = request.get_json(silent=True) or {}
if not isinstance(body, dict):
return _error("Request body must be a JSON object", 400)
key = body.get("key", "").strip()
if not key:
return _error("'key' is required", 400)
try:
result = post(POST_WIREGUARD_CLASSES, body)
return _ok(result)
except BadRequest as exc:
logger.info("Create access class rejected: %s", exc)
return _error(str(exc), 400)
except Conflict as exc:
logger.info("Create access class conflict: %s", exc)
return _error(str(exc), 409)
except RuntimeError as exc:
logger.error("Failed to create access class: %s", exc)
return _error(str(exc), 500)
@bp.route("/classes", methods=["PATCH"])
def update_class_bp():
"""Update an access class.
Endpoint: PATCH /api/wireguard/classes
"""
body = request.get_json(silent=True) or {}
if not isinstance(body, dict):
return _error("Request body must be a JSON object", 400)
key = body.get("key", "").strip()
if not key:
return _error("'key' is required", 400)
try:
result = patch(PATCH_WIREGUARD_CLASSES, body)
return _ok(result)
except BadRequest as exc:
logger.info("Update access class rejected: %s", exc)
return _error(str(exc), 400)
except NotFound as exc:
logger.info("Access class not found: %s", exc)
return _error(str(exc), 404)
except RuntimeError as exc:
logger.error("Failed to update access class: %s", exc)
return _error(str(exc), 500)
@bp.route("/classes", methods=["DELETE"])
def delete_class_bp():
"""Delete an access class.
Endpoint: DELETE /api/wireguard/classes
"""
body = request.get_json(silent=True) or {}
if not isinstance(body, dict):
return _error("Request body must be a JSON object", 400)
key = body.get("key", "").strip()
if not key:
return _error("'key' is required", 400)
try:
result = delete(DELETE_WIREGUARD_CLASSES, {"key": key})
logger.info("Access class '%s' deleted via API", key)
return _ok(result)
except NotFound as exc:
logger.info("Access class not found: %s", exc)
return _error(str(exc), 404)
except Conflict as exc:
logger.info("Delete access class conflict: %s", exc)
return _error(str(exc), 409)
except RuntimeError as exc:
logger.error("Failed to delete access class: %s", exc)
return _error(str(exc), 500)
@bp.route("/classes/<key>/up", methods=["POST"])
def class_up_bp(key):
"""Bring up a single access class's WireGuard tunnel.
Endpoint: POST /api/wireguard/classes/<key>/up
"""
try:
post(POST_WIREGUARD_CLASSES_UP, {"class_key": key})
logger.info("WireGuard class '%s' tunnel brought up via API", key)
return _ok(None)
except RuntimeError as exc:
logger.error("Failed to bring up class '%s': %s", key, exc)
return _error(str(exc), 500)
@bp.route("/classes/<key>/down", methods=["POST"])
def class_down_bp(key):
"""Bring down a single access class's WireGuard tunnel.
Endpoint: POST /api/wireguard/classes/<key>/down
"""
try:
delete(DELETE_WIREGUARD_CLASSES_DOWN, {"class_key": key})
logger.info("WireGuard class '%s' tunnel brought down via API", key)
return _ok(None)
except RuntimeError as exc:
logger.error("Failed to bring down class '%s': %s", key, exc)
return _error(str(exc), 500)
@bp.route("/classes/<key>/status", methods=["GET"])
def class_status_bp(key):
"""Get status for a single access class's tunnel.
Endpoint: GET /api/wireguard/classes/<key>/status
"""
try:
return _ok(get(GET_WIREGUARD_CLASS_STATUS, {"class_key": key}))
except RuntimeError as exc:
logger.error("Failed to get class '%s' status: %s", key, exc)
return _error(str(exc), 500)
@bp.route("/classes/keys/<key>", methods=["POST"])
def class_init_keys_bp(key):
"""Generate key pair for a single access class.
Endpoint: POST /api/wireguard/classes/keys/<key>
"""
try:
post(POST_WIREGUARD_CLASS_INIT_KEYS, {"class_key": key})
logger.info("WireGuard class '%s' keys generated via API", key)
return _ok(None)
except NotFound as exc:
logger.info("Class '%s' not found for keys: %s", key, exc)
return _error(str(exc), 404)
except RuntimeError as exc:
logger.error("Failed to generate keys for class '%s': %s", key, exc)
return _error(str(exc), 500)
webui/static/hoover/components/qr.js
+154
View File
@@ -0,0 +1,154 @@
/**
* Hoover — components/qr.js
*
* QR code SVG renderer with optional logo overlay.
* Uses qrcode-svg library for generation.
*/
import { h } from '../vdom.js?v=9';
import { esc } from '../helpers.js?v=9';
import QRCode from '../../../vendor/qrcode-svg-1.1.0.js';
/**
* Generate a QR code SVG string from text content.
*
* @param {object} props
* @param {string} props.text - Text to encode
* @param {number} [props.size=200] - QR code size in px
* @param {number} [props.margin=2] - Quiet zone margin
* @param {string} [props.ecLevel='Q'] - Error correction level (L/M/Q/H)
* @param {string} [props.logo] - Base64 data URL for center logo
* @param {number} [props.logoSize=40] - Logo size in px (when overlaying)
* @param {string} [props.color] - Foreground color (default: #000000)
* @param {string} [props.background] - Background color (default: #ffffff)
* @returns {string} SVG markup string
*/
export function qrSVG(props = {}) {
const {
text,
size = 200,
margin = 2,
ecLevel = 'Q',
logo,
logoSize = 40,
color = '#000000',
background = '#ffffff',
} = props;
if (!text) return '';
const qr = new QRCode({
content: text,
container: 'svg',
margin: margin,
padding: 0,
width: size,
height: size,
color: color,
background: background,
ecl: ecLevel,
creambo: false,
prettyprint: false,
});
let svg = qr.svg();
// Add center logo overlay if provided
if (logo) {
const halfSize = size / 2;
const halfLogo = logoSize / 2;
const ns = 'http://www.w3.org/2000/svg';
const parser = new DOMParser();
const doc = parser.parseFromString(svg, 'image/svg+xml');
const rootSvg = doc.documentElement;
const viewBox = rootSvg.getAttribute('viewBox') || `0 0 ${size} ${size}`;
const newSvg = doc.createElementNS(ns, 'svg');
newSvg.setAttribute('xmlns', ns);
newSvg.setAttribute('xmlns:xlink', 'http://www.w3.org/1999/xlink');
newSvg.setAttribute('width', size);
newSvg.setAttribute('height', size);
newSvg.setAttribute('viewBox', viewBox);
// Clone original content
const clone = rootSvg.cloneNode(true);
while (clone.firstChild) {
newSvg.appendChild(clone.firstChild);
}
// White background behind logo
const bgRect = doc.createElementNS(ns, 'rect');
bgRect.setAttribute('x', halfSize - halfLogo - 4);
bgRect.setAttribute('y', halfSize - halfLogo - 4);
bgRect.setAttribute('width', logoSize + 8);
bgRect.setAttribute('height', logoSize + 8);
bgRect.setAttribute('fill', background);
newSvg.appendChild(bgRect);
// Logo image overlay
const img = doc.createElementNS(ns, 'image');
img.setAttributeNS('http://www.w3.org/1999/xlink', 'xlink:href', logo);
img.setAttribute('x', halfSize - halfLogo);
img.setAttribute('y', halfSize - halfLogo);
img.setAttribute('width', logoSize);
img.setAttribute('height', logoSize);
newSvg.appendChild(img);
const serializer = new XMLSerializer();
svg = serializer.serializeToString(newSvg);
}
return svg;
}
/**
* Render a QR code as a VNode with innerHTML for the SVG.
*
* @param {object} props
* @param {string} props.text - Text to encode
* @param {number} [props.size=200] - QR code size
* @param {string} [props.logo] - Base64 data URL for logo
* @param {number} [props.logoSize=40] - Logo overlay size
* @returns {object} VNode
*/
export function QRCodeVNode(props = {}) {
const svgString = qrSVG(props);
if (!svgString) {
return h('div', {}, h('span', { class: 'text-muted' }, 'No content'));
}
return h('div', {
class: 'qr-code-container text-center',
innerHTML: svgString,
});
}
/**
* Logo upload widget — file input that produces base64 data URL.
*
* @param {object} props
* @param {string} props.id - Input element ID
* @param {function} props.onChange - Callback(logoBase64) on file select
*/
export function LogoUpload(props = {}) {
const inputId = props.id || 'qr-logo-input';
return h('div', { class: 'mb-2' }, [
h('label', { class: 'form-label' }, 'Logo (optional)'),
h('input', {
type: 'file',
id: inputId,
accept: 'image/*',
class: 'form-control',
onChange: function (e) {
const file = e.target.files?.[0];
if (!file || !props.onChange) return;
const reader = new FileReader();
reader.onload = function (ev) {
props.onChange(ev.target.result);
};
reader.readAsDataURL(file);
},
}),
]);
}
webui/static/hoover/index.js
+3
View File
@@ -48,3 +48,6 @@ export { ApplyConfirm } from './components/applyconfirm.js?v=9';
/* ── UI Components: Toast ────────────────────────────────────── */
export { ToastContainer } from './components/toast.js?v=9';
/* ── UI Components: QR Code ──────────────────────────────────── */
export { qrSVG, QRCodeVNode, LogoUpload } from './components/qr.js?v=9';
webui/static/pages/dhcp.js
+28 -1
View File
@@ -172,6 +172,30 @@ export default definePage({
</td>
</tr>`);
const _setDomain = async (domain) => {
const res = await apiFetch('/api/dhcp/domain', {
method: 'POST',
body: { domain },
});
if (res.ok) {
toast('DNS domain updated', 'success');
modelFetch('dnsmasq');
} else {
toast(res.error || 'Failed to update', 'error');
}
};
const currentDomain = dnsCfg.domain || null;
const domainSection = html`<div class="domain-config" style="margin-bottom: 1rem;">
<label style="font-weight: 600;">Search Domain</label>
<p class="text-sm" style="margin: 0.25rem 0 0.5rem;">${currentDomain ? esc(currentDomain) : '<span class="text-muted">(not set)</span>'}</p>
<div class="form-inline" style="display: flex; gap: 0.5rem; align-items: center;">
<input id="domain-input" class="input" placeholder="example.local" />
<button class="btn btn-outline" onClick=${() => _setDomain(($val('domain-input') || '').trim())}>Set</button>
<button class="btn btn-outline" onClick=${() => _setDomain(null)}>Clear</button>
</div>
</div>`;
const tabNames = ['ranges', 'leases', 'dns', 'active'];
const actions = ActionGroup(
html`<button class="btn btn-primary" onClick=${() => makeAddRange(state.firewall.data?.zones?.active, state.firewall.data?.interfaces)(state)}>Add Range</button>`,
@@ -222,7 +246,10 @@ export default definePage({
state.activeTab === 'leases'
? Table({ columns: ['MAC', 'IP', 'Hostname', 'Action'], rows: leaseRows, emptyText: 'No static leases' }) : null,
state.activeTab === 'dns'
? Table({ columns: ['Name', 'Address', 'Action'], rows: dnsRows, emptyText: 'No custom DNS records' }) : null,
? [
domainSection,
Table({ columns: ['Name', 'Address', 'Action'], rows: dnsRows, emptyText: 'No custom DNS records' })
] : null,
leaseTable,
];
},
webui/static/pages/nat.js
+24 -5
View File
@@ -38,13 +38,16 @@ export default definePage({
const zoneData = cfg.zones || {};
const sIface = (state.firewall.data?.state || {}).interfaces || [];
const masqZones = new Set(
// With nftables, masquerade is propagated to the public zone at runtime for
// POSTROUTING to work. The config-side masquerade flag indicates which
// zones source NAT traffic (LAN / internal), not where traffic exits (WAN).
const lanZones = new Set(
Object.entries(zoneData)
.filter(([, zcfg]) => !!zcfg.masquerade)
.map(([z]) => z)
);
const wanIface = sIface.filter((i) => i.zone && masqZones.has(i.zone));
const lanIface = sIface.filter((i) => i.zone && !masqZones.has(i.zone));
const wanIface = sIface.filter((i) => i.zone && !lanZones.has(i.zone));
const lanIface = sIface.filter((i) => i.zone && lanZones.has(i.zone));
const ifaceRows = (ifaces) =>
ifaces.map((iface) => html`<tr key=${'ii-' + iface.name}>
@@ -60,10 +63,26 @@ export default definePage({
<td><${Badge} text=${iface.zone || '—'} variant="secondary" /></td>
</tr>`);
const masqRows = Object.entries(zoneData)
// Build set of non-public zones with masquerade — determines if public is auto-propagated
const anyNonPublicMasq = Object.entries(zoneData)
.filter(([zone]) => zone !== "public")
.some(([, zcfg]) => !!zcfg.masquerade);
const masqRows = Object.entries(zoneData)
.map(([zone, zcfg]) => {
const masq = !!zcfg.masquerade;
const isPublic = zone === "public";
// Public zone masquerade is auto-propagated when any non-public zone
// has it enabled (nftables backend dispatches POSTROUTING to the
// output interface's zone chain). Show it read-only with a note.
if (isPublic) {
const effective = masq || anyNonPublicMasq;
return html`<tr key=${'m-' + zone}>
<td><strong>${zone}</strong> <span class="text-muted">(auto)</span></td>
<td><${Badge} text=${effective ? 'Enabled' : 'Disabled'} variant=${effective ? 'success' : 'info'} /></td>
<td><span class="text-muted">${anyNonPublicMasq ? 'Propagated from other zones' : 'Not needed'}</span></td>
</tr>`;
}
return html`<tr key=${'m-' + zone}>
<td><strong>${zone}</strong></td>
<td><${Badge} text=${masq ? 'Enabled' : 'Disabled'} variant=${masq ? 'success' : 'info'} /></td>
@@ -109,7 +128,7 @@ export default definePage({
title: 'WAN / External',
columns: ['Interface', 'IPv4', 'IPv6', 'MAC', 'Zone'],
rows: ifaceRows(wanIface),
emptyText: 'No WAN interfaces with masquerade enabled',
emptyText: 'No WAN interfaces',
}),
DataTableSection({
title: 'Internal / LAN',
webui/static/pages/wireguard.js
+491 -36
View File
@@ -1,48 +1,219 @@
import { html, PageHeader, Badge, StatusDot, Empty, Table, ServiceStatus, renderGuard, esc, enc, $val, apiFetch, toast, openModal, closeModal, formModal, definePage, getModel, modelFetch, ActionButton, ActionCell, MonoText, ActionGroup, QuickModal, downloadBlob, formAction } from '/static/hoover/index.js?v=9';
/** WireGuard page — tunnel & peer management. */
import { html, PageHeader, Badge, StatusDot, Empty, Table, ServiceStatus, renderGuard, esc, enc, $val, apiFetch, toast, openModal, closeModal, formModal, definePage, getModel, modelFetch, ActionButton, ActionCell, MonoText, ActionGroup, QuickModal, downloadBlob, formAction, ApplyConfirm, qrSVG } from '/static/hoover/index.js?v=9';
/* ── LAN detection helper ────────────────────────────────────── */
function getLanSubnets() {
try {
const fw = getModel('firewall');
if (!fw?.data) return [];
const subnets = [];
for (const iface of (fw.data.interfaces || [])) {
if (!iface.zone) continue;
const zone = fw.data.zones?.[iface.zone];
if (!zone || zone.masquerade) continue;
for (const ip of (iface.ips || [])) {
if (!ip.includes('/')) continue;
if (!subnets.includes(ip)) subnets.push(ip);
}
}
return subnets;
} catch {
return [];
}
}
/* ── Allowed IPs helper ──────────────────────────────────────── */
function parseAllowedIps(value) {
if (!value || !value.trim()) return [];
return value.split(',').map(s => s.trim()).filter(Boolean);
}
/* ── Color helpers ────────────────────────────────────────────── */
function classColor(classKey) {
if (!classKey) return '';
const h = classKey.split('').reduce((a, c) => a + c.charCodeAt(0), 0);
return '#' + ((h * 137) % 256).toString(16).padStart(2, '0')
+ '55' + ((h * 71) % 256).toString(16).padStart(2, '0');
}
/* ── Access classes helper to check keys initialized ──────── */
function classHasKeys(cls) {
return cls && cls.public_key && cls.public_key.length > 0;
}
/* ── Add Peer Modal ──────────────────────────────────────────── */
const addPeer = QuickModal({
title: 'Add WireGuard Peer',
fields: [
{ label: 'Name', id: 'wg-name', placeholder: 'client-name' },
{ label: 'Endpoint (optional)', id: 'wg-endpoint', placeholder: '1.2.3.4:51820' },
{ label: 'Allowed IPs (optional)', id: 'wg-allowed', placeholder: '10.0.0.2/32' },
{ label: 'Description (optional)', id: 'wg-description', placeholder: 'Peer label' },
{ label: 'Access Class *', id: 'wg-class', tag: 'select' },
{ label: 'Allowed IPs Preset', id: 'wg-allowed-preset', tag: 'select', value: 'all' },
{ label: 'Allowed IPs (custom)', id: 'wg-allowed', placeholder: '0.0.0.0/0' },
{ label: 'Persistent Keepalive (optional)', id: 'wg-keepalive', type: 'number', placeholder: '25' },
],
submit: {
url: '/api/wireguard/peers',
body: () => ({
body: (data) => {
const preset = ($val('wg-allowed-preset') || 'all');
let allowed_ips;
if (preset === 'lan') {
allowed_ips = getLanSubnets();
} else if (preset === 'none') {
allowed_ips = [];
} else if (preset === 'custom') {
allowed_ips = parseAllowedIps($val('wg-allowed'));
} else {
allowed_ips = ['0.0.0.0/0'];
}
return {
name: ($val('wg-name') || '').trim(),
endpoint: ($val('wg-endpoint') || '').trim() || undefined,
allowed_ips: ($val('wg-allowed') || '').trim() ? [($val('wg-allowed') || '').trim()] : [],
description: ($val('wg-description') || '').trim() || undefined,
access_class: ($val('wg-class') || '').trim() || undefined,
allowed_ips,
persistent_keepalive: $val('wg-keepalive') ? parseInt($val('wg-keepalive')) : undefined,
}),
validate: (b) => !b.name ? 'Name is required' : null,
};
},
validate: (b) => !b.name ? 'Name is required' :
!b.access_class ? 'Access Class is required' : null,
successMsg: 'Peer added',
},
refresh: 'wireguard',
postRender: (inner, data) => {
const presetEl = document.getElementById('wg-allowed-preset');
if (presetEl) {
const customField = inner.querySelector('.form-group:has(#wg-allowed)');
const toggle = () => {
customField.style.display = presetEl.value === 'custom' ? '' : 'none';
};
presetEl.onchange = toggle;
toggle();
}
},
});
function updateAddPeerOptions(wireguardState) {
const classes = wireguardState?.access_classes || {};
updateClassDropdown(classes);
updateLanOptions();
}
function updateClassDropdown(classes) {
const selectEl = document.getElementById('wg-class');
if (!selectEl) return;
selectEl.innerHTML = Object.entries(classes).map(([k, v]) =>
`<option value="${esc(k)}">${esc(v.name || k)}</option>`
).join('');
}
function updateLanOptions() {
const selectEl = document.getElementById('wg-allowed-preset');
if (!selectEl) return;
const subnets = getLanSubnets();
selectEl.innerHTML =
'<option value="all">Route all traffic (default)</option>' +
(subnets.length
? `<option value="lan">Route LAN only (${esc(subnets.join(', '))})</option>`
: '<option value="lan">Route LAN only (detecting\u2026)</option>') +
'<option value="none">Route nothing (peer-initiated only)</option>' +
'<option value="custom">Custom</option>';
}
/* ── Download Config + QR Modal ──────────────────────────────── */
function downloadConfigModal(peerName, config, state) {
const peer = (config?.peers || {})[peerName];
const ak = peer?.access_class;
let listenPort = 51820;
if (ak && config?.access_classes?.[ak]) {
listenPort = config.access_classes[ak].listen_port || 51820;
}
const baseHost = (config?.interface?.server_endpoint || '').split(':')[0];
const endpoint = baseHost ? baseHost + ':' + listenPort : '';
let generatedConfig = null;
let logoBase64 = null;
const renderQrView = (innerEl, modalIdx) => {
const svgStr = qrSVG({ text: generatedConfig, size: 256, logo: logoBase64, logoSize: 48 });
innerEl.innerHTML = `
<h4 class="mb-3">Peer Config: ${esc(peerName)}</h4>
<div class="text-center mb-3">${svgStr}</div>
<div class="mb-3">
<label class="form-label">Logo overlay (rescans QR)</label>
<input type="file" id="qr-logo-input" accept="image/*" class="form-control mb-1">
<small class="text-muted">Upload a logo to overlay on the QR code.</small>
</div>
<div class="mb-3">
<label class="form-label">Config Text</label>
<pre class="code" style="max-height:200px;overflow:auto;font-size:0.8rem;">${esc(generatedConfig)}</pre>
</div>
<div class="d-flex justify-content-end gap-2 mt-3">
<button class="btn btn-sm btn-outline" id="qr-restart">Regenerate</button>
<button class="btn btn-sm btn-outline" id="qr-download">Download .conf</button>
<button class="btn btn-sm btn-primary" id="qr-close">Close</button>
</div>
`;
innerEl.querySelector('#qr-logo-input').addEventListener('change', (e) => {
const file = e.target.files?.[0];
if (!file) return;
const reader = new FileReader();
reader.onload = (ev) => {
logoBase64 = ev.target.result;
renderQrView(innerEl, modalIdx);
};
reader.readAsDataURL(file);
});
innerEl.querySelector('#qr-restart').addEventListener('click', () => {
generatedConfig = null;
logoBase64 = null;
openModal((inn, i) => downloadConfigModal(peerName, config, state), modalIdx);
});
innerEl.querySelector('#qr-download').addEventListener('click', () => {
downloadBlob(new Blob([generatedConfig], { type: 'text/plain' }), peerName + '.conf');
toast('Config downloaded', 'success');
closeModal(modalIdx);
});
innerEl.querySelector('#qr-close').addEventListener('click', () => closeModal(modalIdx));
};
openModal((inner, idx) => {
formModal(inner, 'Download Config for ' + peerName,
[{ label: 'Server Endpoint', id: 'wg-srv-endpoint', placeholder: 'vpn.example.com:51820' }],
if (generatedConfig) {
renderQrView(inner, idx);
return;
}
formModal(inner, 'Peer Config: ' + peerName,
[
{ label: 'Server Endpoint', id: 'wg-srv-endpoint', placeholder: 'vpn.example.com:51820', value: endpoint },
],
[
{ label: 'Cancel', cls: 'btn-outline', action: 'c', handler: () => closeModal(idx) },
{
label: 'Generate', cls: 'btn-primary', action: 's',
handler: formAction(async () => {
const endpoint = ($val('wg-srv-endpoint') || '').trim();
if (!endpoint) throw 'Server endpoint is required';
const ep = ($val('wg-srv-endpoint') || '').trim();
if (!ep) throw 'Server endpoint is required';
const resp = await apiFetch('/api/wireguard/generate-client', {
method: 'POST',
body: { name: peerName, server_endpoint: endpoint },
body: { name: peerName, server_endpoint: ep },
});
if (!resp.ok) throw resp.error || 'Failed';
const configContent = resp.data?.config;
if (!configContent) throw 'No config returned';
downloadBlob(new Blob([configContent], { type: 'text/plain' }), peerName + '.conf');
toast('Config downloaded', 'success');
closeModal(idx);
generatedConfig = configContent;
// Re-render modal with QR view
openModal((inn, i) => downloadConfigModal(peerName, config, state), idx);
}),
},
],
@@ -50,37 +221,287 @@ function downloadConfigModal(peerName, config, state) {
});
}
/* ── Interface Settings Modal ────────────────────────────────── */
function settingsModal(wireguardData, state) {
const iface = wireguardData?.config?.interface || {};
openModal((inner, idx) => {
formModal(inner, 'WireGuard Settings',
[
{ label: 'Listen Port', id: 'wg-port', type: 'number', value: iface.listen_port || 51820, placeholder: '51820' },
{ label: 'Addresses (comma-separated CIDR)', id: 'wg-addrs', value: (iface.addresses || []).join(', ') || '10.137.0.1/24' },
{ label: 'Server Endpoint', id: 'wg-srv-endpoint', placeholder: 'vpn.example.com:51820', value: iface.server_endpoint || '' },
{ label: 'Description', id: 'wg-desc', value: iface.description || '', placeholder: 'Optional label' },
{ label: 'PostUp (advanced)', id: 'wg-post-up', tag: 'textarea', value: iface.post_up || '', placeholder: 'Shell command after interface up' },
{ label: 'PostDown (advanced)', id: 'wg-post-down', tag: 'textarea', value: iface.post_down || '', placeholder: 'Shell command after interface down' },
],
[
{ label: 'Cancel', cls: 'btn-outline', action: 'c', handler: () => closeModal(idx) },
{
label: 'Save', cls: 'btn-primary', action: 's',
handler: formAction(async () => {
const port = parseInt($val('wg-port'), 10);
if (isNaN(port) || port < 1 || port > 65535) throw 'Invalid port';
const addresses = ($val('wg-addrs') || '').split(',').map(s => s.trim()).filter(Boolean);
if (!addresses.length) throw 'At least one address required';
const body = {
interface: {
listen_port: port,
addresses,
server_endpoint: ($val('wg-srv-endpoint') || '').trim() || undefined,
description: ($val('wg-desc') || '').trim() || undefined,
post_up: ($val('wg-post-up') || '').trim() || null,
post_down: ($val('wg-post-down') || '').trim() || null,
},
};
const resp = await apiFetch('/api/wireguard/config', {
method: 'PATCH',
body,
});
if (!resp.ok) throw resp.error || 'Failed to save';
toast('Settings saved', 'success');
closeModal(idx);
modelFetch('wireguard');
}),
},
],
);
});
}
/* ── Class Settings Modal ────────────────────────────────────── */
const addClass = QuickModal({
title: 'Add Access Class',
fields: [
{ label: 'Key', id: 'wc-key', placeholder: 'my-class' },
{ label: 'Name', id: 'wc-name', placeholder: 'Display Name' },
{ label: 'Description', id: 'wc-desc', placeholder: 'Optional' },
{ label: 'Subnet (CIDR)', id: 'wc-subnet', placeholder: '10.137.2.0/24' },
{ label: 'Listen Port', id: 'wc-port', type: 'number', placeholder: '51822' },
{ label: 'LAN Access', id: 'wc-lan', tag: 'select', value: '0' },
],
submit: {
url: '/api/wireguard/classes',
body: () => ({
key: ($val('wc-key') || '').trim(),
name: ($val('wc-name') || '').trim(),
description: ($val('wc-desc') || '').trim(),
subnet: ($val('wc-subnet') || '').trim() || undefined,
listen_port: parseInt($val('wc-port'), 10) || 0,
lan_access: $val('wc-lan') === '1',
}),
validate: (b) => !b.key ? 'Key is required' :
!/^[a-z0-9]+$/.test(b.key) ? 'Key must be lowercase alphanumeric' :
!b.subnet ? 'Subnet is required' :
!b.listen_port ? 'Listen port is required' : null,
successMsg: 'Class added',
},
refresh: 'wireguard',
postRender: (inner) => {
const sel = document.getElementById('wc-lan');
if (sel) {
sel.innerHTML = '<option value="1">Yes (Full LAN Access)</option><option value="0">No (Internet Only)</option>';
}
},
});
function editClassModal(key, cls, peerCount) {
openModal((inner, idx) => {
formModal(inner, 'Edit Access Class: ' + key,
[
{ label: 'Key', id: 'wc-key', value: key, disabled: true },
{ label: 'Name', id: 'wc-name', value: cls?.name || '' },
{ label: 'Description', id: 'wc-desc', value: cls?.description || '' },
{ label: 'Subnet (CIDR)', id: 'wc-subnet', value: cls?.subnet || '', placeholder: '10.137.2.0/24' },
{ label: 'Listen Port', id: 'wc-port', type: 'number', value: cls?.listen_port || '', placeholder: '51822' },
{ label: 'LAN Access', id: 'wc-lan', tag: 'select', value: cls?.lan_access ? '1' : '0' },
],
[
{ label: 'Cancel', cls: 'btn-outline', action: 'c', handler: () => closeModal(idx) },
{
label: 'Save', cls: 'btn-primary', action: 's',
handler: formAction(async () => {
const resp = await apiFetch('/api/wireguard/classes', {
method: 'PATCH',
body: {
key,
name: ($val('wc-name') || '').trim() || key,
description: ($val('wc-desc') || '').trim(),
subnet: ($val('wc-subnet') || '').trim() || undefined,
listen_port: parseInt($val('wc-port'), 10) || undefined,
lan_access: $val('wc-lan') === '1',
},
});
if (!resp.ok) throw resp.error || 'Failed';
toast('Class updated', 'success');
closeModal(idx);
modelFetch('wireguard');
}),
},
],
);
});
}
async function initClassKeys(classKey) {
const resp = await apiFetch('/api/wireguard/classes/keys/' + enc(classKey), {
method: 'POST',
});
if (!resp.ok) {
toast(resp.error || 'Failed to generate keys', 'error');
return;
}
toast('Keys generated for class "' + classKey + '"', 'success');
modelFetch('wireguard');
}
async function deleteAccessClass(key) {
if (!confirm(`Delete access class '${key}'?`)) return;
const resp = await apiFetch('/api/wireguard/classes', {
method: 'DELETE',
body: { key },
});
if (!resp.ok) {
toast(resp.error || 'Failed to delete class', 'error');
return;
}
toast('Class deleted', 'success');
modelFetch('wireguard');
}
async function toggleClassTunnel(classKey, isUp) {
const url = '/api/wireguard/classes/' + enc(classKey) + '/' + (isUp ? 'down' : 'up');
const resp = await apiFetch(url, { method: 'POST' });
if (!resp.ok) {
toast(resp.error || 'Failed', 'error');
return;
}
toast('Tunnel ' + (isUp ? 'stopped' : 'started'), 'success');
modelFetch('wireguard');
}
/* ── Access Classes Section ──────────────────────────────────── */
function renderAccessClasses(config, status) {
const classes = config?.access_classes || {};
const entries = Object.entries(classes);
if (!entries.length) return null;
const peerCountMap = {};
for (const [pname, pinfo] of Object.entries(config?.peers || {})) {
const ac = pinfo?.access_class;
if (ac) {
peerCountMap[ac] = (peerCountMap[ac] || 0) + 1;
}
}
const classStatuses = status?.classes || {};
const rows = entries.map(([k, v]) => {
const pCount = peerCountMap[k] || 0;
const clsStatus = classStatuses[k] || { up: false };
const isUp = clsStatus.up;
const hasKeys = classHasKeys(v);
const color = classColor(k);
return html`<tr key=${k}>
<td style="border-left: 3px solid ${color}"><strong>${esc(k)}</strong></td>
<td>${esc(v.name || k)}</td>
<td class="text-sm">${esc(v.description || '-')}</td>
<td class="text-sm">${esc(v.subnet || '-')}</td>
<td class="text-sm">${v.listen_port || '-'}</td>
<td class="text-sm">${v.lan_access ? 'Yes' : 'No'}</td>
<td>${pCount}</td>
<td class="text-sm">
<${StatusDot} status=${isUp ? 'success' : 'danger'} />
</td>
<td>
${!hasKeys
? html`<button class="btn btn-sm btn-warning" onClick=${() => initClassKeys(k)} title="Generate keys">Keys</button>`
: ''}
<button class="btn btn-sm btn-outline" onClick=${() => editClassModal(k, v, pCount)}>Edit</button>
<button class="btn btn-sm btn-outline" onClick=${() => toggleClassTunnel(k, isUp)}>${isUp ? 'Stop' : 'Start'}</button>
${(pCount > 0)
? html`<button class="btn btn-sm btn-outline" disabled title="Peers reference this class">Delete</button>`
: html`<button class="btn btn-sm btn-outline" onClick=${() => deleteAccessClass(k)}>Delete</button>`}
</td>
</tr>`;
});
return html`<div class="mt-4">
<div class="d-flex justify-content-between align-items-center mb-2">
<h4 class="section-title m-0">Access Classes</h4>
<button class="btn btn-sm btn-primary" onClick=${() => addClass()}>Add Class</button>
</div>
<table class="table table-sm"><thead><tr>
<th>Key</th><th>Name</th><th>Description</th><th>Subnet</th><th>Port</th><th>LAN</th><th>Peers</th><th>Status</th><th>Actions</th>
</tr></thead><tbody>${rows}</tbody></table>
</div>`;
}
/* ── Main Page ───────────────────────────────────────────────── */
export default definePage({
init() {
return {
wireguard: getModel('wireguard'),
};
},
subscribe(state) {
// Update add-peer modal options when state changes
if (state.wireguard?.data) {
updateAddPeerOptions(state.wireguard.data.config);
}
},
render(state) {
const guard = renderGuard(state.wireguard, 'WireGuard', 'Tunnel & peer management', state.wireguard.data);
const guard = renderGuard(state.wireguard, 'WireGuard', 'Tunnel & peer management', state.wireguard.data?.config);
if (guard) return guard;
const st = state.wireguard.data?.status || {};
const wgData = state.wireguard.data;
const st = wgData?.status || {};
const config = wgData?.config || {};
const isUp = st.up || false;
const listenPort = (state.wireguard.data?.config?.interface || {}).listen_port || '-';
const listenPort = config.interface?.listen_port || '-';
const serverEndpoint = config.interface?.server_endpoint || '';
const peerRows = (state.wireguard.data?.peers || []).map(p => {
const hasHandshake = !!p.latest_handshake;
return html`<tr key=${p.name}>
// Build merged peer rows: configured peers + live status
const configuredPeers = wgData?.peers || [];
const statusPeersMap = {};
for (const [cKey, cSt] of Object.entries(st.classes || {})) {
for (const sp of (cSt.peers || [])) {
statusPeersMap[sp.public_key] = { ...sp, _class: cKey };
}
}
// Also check legacy status peers
for (const sp of (st.peers || [])) {
statusPeersMap[sp.public_key] = sp;
}
const peersByClass = config?.access_classes || {};
const peerRows = configuredPeers.map(p => {
const sp = statusPeersMap[p.public_key];
const isConnected = sp && !!sp.latest_handshake;
const accessClass = p.access_class;
const classInfo = accessClass ? (peersByClass[accessClass] || null) : null;
const borderColor = classInfo ? ' style="border-left: 3px solid ' + classColor(accessClass) + '"' : '';
return html`<tr key=${p.name}${borderColor}>
<td>
<${StatusDot} status=${hasHandshake ? 'success' : 'danger'} />
<${StatusDot} status=${isConnected ? 'success' : 'danger'} />
<strong>${esc(p.name || 'unnamed')}</strong>
${p.description ? html`<br/><span class="text-muted text-sm">${esc(p.description)}</span>` : ''}
</td>
<td><${MonoText} text=${p.public_key || 'N/A'} maxLength=20 /></td>
<td class="text-sm">${esc(p.allowed_ips || '-')}</td>
<td class="text-sm">${esc((p.allowed_ips || []).join(', ') || '-')}</td>
<td class="text-sm">${esc(p.endpoint || '-')}</td>
<td class="text-sm">${esc(p.latest_handshake || 'Never')}</td>
<td class="text-sm">
Recv: ${esc(p.transfer_recv || '0')}<br/>
Sent: ${esc(p.transfer_sent || '0')}
${classInfo
? html`<${Badge} text=${esc(classInfo.name)} cls="bg-info text-white" />`
: html`<${Badge} text="Unassigned" cls="bg-secondary text-white" />`}
</td>
<td class="text-sm">${esc(sp?.latest_handshake || 'Never')}</td>
<td class="text-sm">
Recv: ${esc(sp?.transfer_received || '0')}<br/>
Sent: ${esc(sp?.transfer_sent || '0')}
</td>
<${ActionCell}
editLabel="Config" editClick=${() => downloadConfigModal(p.name, state.wireguard.data?.config, state)}
editLabel="Config" editClick=${() => downloadConfigModal(p.name, config, state)}
removeUrl=${'/api/wireguard/peers/' + enc(p.name)}
removeMessage=${'Remove peer ' + p.name + '?'}
removeSuccess="Peer removed"
@@ -89,35 +510,69 @@ export default definePage({
</tr>`;
});
// Per-class summary
const classEntries = Object.entries(config?.access_classes || {});
let classSummaryCards = null;
if (classEntries.length) {
const cards = classEntries.map(([k, v]) => {
const cSt = (st.classes || {})[k] || { up: false, peers: [] };
const isUp = cSt.up;
const pCount = (wgData?.peers || []).filter(p => p.access_class === k).length;
const color = classColor(k);
return html`<div key=${k} class="card" style="border-left: 3px solid ${color}">
<div class="card-header d-flex justify-content-between align-items-center">
<span><${StatusDot} status=${isUp ? 'success' : 'danger'} /> <strong>${esc(v.name || k)}</strong> <span class="text-muted">(${esc(k)})</span></span>
<span class="text-sm">${pCount} peer(s), port ${v.listen_port || '-'}</span>
</div>
<div class="card-body text-sm">
<div class="d-flex justify-content-between">
<span>Subnet: ${esc(v.subnet || '-')}</span>
<span>LAN: ${v.lan_access ? 'Yes' : 'No'}</span>
<span>Keys: ${classHasKeys(v) ? 'Ready' : html`<button class="btn btn-xs btn-warning" onClick=${() => initClassKeys(k)}>Generate</button>`}</span>
</div>
<div style="margin-top: 4px;">
<button class="btn btn-xs btn-outline" onClick=${() => toggleClassTunnel(k, isUp)}>${isUp ? 'Stop' : 'Start'}</button>
</div>
</div>
</div>`;
});
classSummaryCards = html`<div class="mt-2 mb-2 d-flex gap-2 flex-wrap">${cards}</div>`;
}
const actions = ActionGroup(
html`<button class="btn btn-primary" onClick=${() => addPeer(state)}>Add Peer</button>`,
html`<button class="btn btn-primary" onClick=${() => addPeer()}>Add Peer</button>`,
html`<button class="btn btn-outline" onClick=${() => settingsModal(wgData, state)} title="Interface Settings">\u{1F527}</button>`,
ActionButton({
url: '/api/wireguard/' + (isUp ? 'down' : 'up'),
labelOn: 'Stop', labelOff: 'Start', condition: isUp,
labelOn: 'Stop All', labelOff: 'Start All', condition: isUp,
successMsg: 'Tunnel ' + (isUp ? 'stopped' : 'started'),
refresh: 'wireguard',
}),
ActionButton({
url: '/api/wireguard/apply',
successMsg: 'Config applied',
label: 'Apply',
refresh: 'wireguard',
ApplyConfirm({
pending: st.pending_changes || false,
successMsg: 'WireGuard applied',
refresh: ['wireguard', 'firewall'],
}),
);
const subtitleParts = ['Tunnel: ' + (isUp ? 'up' : 'down'), 'Listen: ' + listenPort];
if (serverEndpoint) subtitleParts.push('Endpoint: ' + serverEndpoint);
return [
PageHeader({
title: 'WireGuard',
subtitle: 'Tunnel: ' + (st.up ? 'up' : 'down') + ', Listen: ' + listenPort,
subtitle: subtitleParts.join(' | '),
actions,
}),
ServiceStatus({ state: st.up ? 'up' : 'down' }),
ServiceStatus({ state: isUp ? 'up' : 'down' }),
classSummaryCards,
peerRows.length
? Table({
columns: ['Peer', 'Public Key', 'Allowed IPs', 'Endpoint', 'Handshake', 'Transfer', 'Actions'],
columns: ['Peer', 'Public Key', 'Allowed IPs', 'Endpoint', 'Class', 'Handshake', 'Transfer', 'Actions'],
rows: peerRows,
})
: Empty({ text: 'No peers configured. Add a peer above.' }),
renderAccessClasses(config, st),
];
},
});