239 lines
7.3 KiB
Python
239 lines
7.3 KiB
Python
"""
|
|
webui/api/wireguard.py - WireGuard tunnel management API blueprint.
|
|
|
|
Exposed at /api/wireguard/* and delegates to lib.wireguard.
|
|
"""
|
|
|
|
import logging
|
|
|
|
from flask import Blueprint, request
|
|
|
|
from lib.common import deep_merge
|
|
from lib.wireguard import (
|
|
add_peer,
|
|
apply,
|
|
down,
|
|
generate_client_conf,
|
|
get_config,
|
|
get_peer_status,
|
|
get_peers,
|
|
initialize,
|
|
remove_peer,
|
|
save_config,
|
|
status,
|
|
)
|
|
from webui.api.common import _error, _ok
|
|
|
|
logger = logging.getLogger(__name__)
|
|
bp = Blueprint("wireguard", __name__)
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Config
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
@bp.route("/config", methods=["GET"])
|
|
def get_config_bp():
|
|
try:
|
|
cfg = get_config()
|
|
safe = dict(cfg)
|
|
if "interface" in safe:
|
|
safe["interface"] = dict(safe["interface"])
|
|
safe["interface"].pop("private_key", None)
|
|
return _ok(safe)
|
|
except RuntimeError as exc:
|
|
logger.error("Failed to read WireGuard config: %s", exc)
|
|
return _error(str(exc), 500)
|
|
|
|
|
|
@bp.route("/config", methods=["POST"])
|
|
def post_config():
|
|
body = request.get_json(silent=True) or {}
|
|
if not isinstance(body, dict):
|
|
return _error("Request body must be a JSON object", 400)
|
|
try:
|
|
if "interface" in body:
|
|
body["interface"] = dict(body["interface"])
|
|
body["interface"].pop("private_key", None)
|
|
save_config(body)
|
|
return _ok(None)
|
|
except RuntimeError as exc:
|
|
logger.error("Failed to save WireGuard config: %s", exc)
|
|
return _error(str(exc), 500)
|
|
|
|
|
|
@bp.route("/config", methods=["PATCH"])
|
|
def patch_config():
|
|
body = request.get_json(silent=True) or {}
|
|
if not isinstance(body, dict):
|
|
return _error("Request body must be a JSON object", 400)
|
|
try:
|
|
if "interface" in body:
|
|
body["interface"] = dict(body["interface"])
|
|
body["interface"].pop("private_key", None)
|
|
current = get_config()
|
|
merged = deep_merge(current, body)
|
|
save_config(merged)
|
|
logger.info("WireGuard config patched: %s", sorted(body.keys()))
|
|
return _ok(None)
|
|
except RuntimeError as exc:
|
|
logger.error("Failed to patch WireGuard config: %s", exc)
|
|
return _error(str(exc), 500)
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Apply / down
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
@bp.route("/apply", methods=["POST"])
|
|
def apply_bp():
|
|
try:
|
|
apply()
|
|
logger.info("WireGuard tunnel applied via API")
|
|
return _ok(None)
|
|
except RuntimeError as exc:
|
|
logger.error("Failed to apply WireGuard config: %s", exc)
|
|
return _error(str(exc), 500)
|
|
|
|
|
|
@bp.route("/up", methods=["POST"])
|
|
def up_bp():
|
|
try:
|
|
apply()
|
|
logger.info("WireGuard tunnel started via API")
|
|
return _ok(None)
|
|
except RuntimeError as exc:
|
|
logger.error("Failed to start WireGuard tunnel: %s", exc)
|
|
return _error(str(exc), 500)
|
|
|
|
|
|
@bp.route("/down", methods=["POST"])
|
|
def down_bp():
|
|
try:
|
|
down()
|
|
logger.info("WireGuard tunnel brought down via API")
|
|
return _ok(None)
|
|
except RuntimeError as exc:
|
|
logger.error("Failed to bring down WireGuard tunnel: %s", exc)
|
|
return _error(str(exc), 500)
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Status
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
@bp.route("/status", methods=["GET"])
|
|
def status_bp():
|
|
try:
|
|
return _ok(status())
|
|
except RuntimeError as exc:
|
|
logger.error("Failed to get WireGuard status: %s", exc)
|
|
return _error(str(exc), 500)
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Initialize (first-time setup)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
@bp.route("/initialize", methods=["POST"])
|
|
def initialize_bp():
|
|
try:
|
|
initialize()
|
|
logger.info("WireGuard initialized via API")
|
|
return _ok(None)
|
|
except RuntimeError as exc:
|
|
logger.error("Failed to initialize WireGuard: %s", exc)
|
|
return _error(str(exc), 500)
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Peer management
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
@bp.route("/peers", methods=["POST"])
|
|
def add_peer_bp():
|
|
body = request.get_json(silent=True) or {}
|
|
name = body.get("name", "").strip()
|
|
if not name:
|
|
return _error("'name' is required", 400)
|
|
try:
|
|
peer = add_peer(
|
|
name=name,
|
|
endpoint=body.get("endpoint"),
|
|
allowed_ips=body.get("allowed_ips", []),
|
|
persistent_keepalive=body.get("persistent_keepalive"),
|
|
preshared_key=body.get("preshared_key"),
|
|
)
|
|
logger.info("WireGuard peer '%s' added via API", name)
|
|
return _ok(peer)
|
|
except RuntimeError as exc:
|
|
logger.error("Failed to add peer '%s': %s", name, exc)
|
|
return _error(str(exc), 500)
|
|
|
|
|
|
@bp.route("/peers/<name>", methods=["DELETE"])
|
|
def remove_peer_bp(name):
|
|
try:
|
|
cfg = get_config()
|
|
if name not in cfg.get("peers", {}):
|
|
return _error(f"Peer '{name}' not found", 404)
|
|
remove_peer(name)
|
|
logger.info("WireGuard peer '%s' removed via API", name)
|
|
return _ok({"name": name})
|
|
except RuntimeError as exc:
|
|
logger.error("Failed to remove peer '%s': %s", name, exc)
|
|
return _error(str(exc), 500)
|
|
|
|
|
|
@bp.route("/peers", methods=["GET"])
|
|
def peers_bp():
|
|
try:
|
|
return _ok(get_peers())
|
|
except RuntimeError as exc:
|
|
logger.error("Failed to list WireGuard peers: %s", exc)
|
|
return _error(str(exc), 500)
|
|
|
|
|
|
@bp.route("/peer-status", methods=["GET"])
|
|
def peer_status_bp():
|
|
try:
|
|
return _ok(get_peer_status())
|
|
except RuntimeError as exc:
|
|
logger.error("Failed to get WireGuard peer status: %s", exc)
|
|
return _error(str(exc), 500)
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Client config generation
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
@bp.route("/generate-client", methods=["POST"])
|
|
def generate_client_bp():
|
|
body = request.get_json(silent=True) or {}
|
|
name = body.get("name", "").strip()
|
|
if not name:
|
|
return _error("Field 'name' is required", 400)
|
|
try:
|
|
cfg = get_config()
|
|
if name not in cfg.get("peers", {}):
|
|
return _error(f"Peer '{name}' not found", 404)
|
|
server_endpoint = body.get("server_endpoint", "")
|
|
server_pubkey = cfg["interface"].get("public_key", "")
|
|
if not server_endpoint:
|
|
return _error(
|
|
"Field 'server_endpoint' is required (e.g., '203.0.113.1:51820')", 400
|
|
)
|
|
conf_text = generate_client_conf(name, server_endpoint, server_pubkey)
|
|
logger.info("Client config generated for peer '%s' via API", name)
|
|
return _ok({"config": conf_text})
|
|
except (KeyError, ValueError, RuntimeError) as exc:
|
|
code = 404 if isinstance(exc, (KeyError, ValueError)) else 500
|
|
logger.error("Failed to generate client config for '%s': %s", name, exc)
|
|
return _error(str(exc), code)
|