wireguard

package

v0.2.0 Latest Latest Go to latest Published: Jul 5, 2026 License: MIT Imports: 7 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/LatticeNet/lattice-server

Links

Open Source Insights

Documentation ¶

Overview ¶

Package wireguard generates per-node WireGuard configuration for a cluster mesh. The server is the topology brain: given each node's public key, mesh IP, and (optional) public endpoint, it emits a wg0.conf for a target node with one Peer per other node, AllowedIPs pinned to each peer's /32 (so a node can only impersonate its own mesh IP), and a keepalive so NAT-bound nodes hold the tunnel open. The node's private key never reaches the server; the emitted config carries the PrivateKeyPlaceholder token, which the agent substitutes from its local key file at apply time.

Index ¶

Constants
func BuildMesh(nodes []model.Node, target model.Node, listenPort int) (Interface, []Peer, error)
func GenerateConfig(iface Interface, peers []Peer) (string, error)
func ValidateEndpoint(endpoint string) error
func ValidatePublicKey(key string) bool
type Interface
type Peer

Constants ¶

View Source

const PrivateKeyPlaceholder = "__LATTICE_WG_PRIVATE_KEY__"

PrivateKeyPlaceholder is replaced by the agent with the node's local private key when the config is applied. It is safe to display in an approval diff.

Variables ¶

This section is empty.

Functions ¶

func BuildMesh ¶

func BuildMesh(nodes []model.Node, target model.Node, listenPort int) (Interface, []Peer, error)

BuildMesh computes the interface and peer list for target from the cluster's nodes. Nodes without a public key or mesh IP, and the target itself, are skipped. listenPort overrides the target's reported port when > 0.

func GenerateConfig ¶

func GenerateConfig(iface Interface, peers []Peer) (string, error)

GenerateConfig renders a wg0.conf. It validates keys and the interface name so attacker-influenced metadata cannot break out of the config structure.

func ValidateEndpoint ¶

func ValidateEndpoint(endpoint string) error

func ValidatePublicKey ¶

func ValidatePublicKey(key string) bool

Types ¶

type Interface ¶

type Interface struct {
	Name       string
	Address    string // mesh address, e.g. 10.66.0.1/24
	ListenPort int
}

Interface is the Interface section for the target node.

type Peer ¶

type Peer struct {
	Name       string // comment only
	PublicKey  string
	AllowedIPs string // typically <mesh-ip>/32
	Endpoint   string // host:port, empty for dial-out-only nodes
	Keepalive  int
}

Peer is one Peer section.

Source Files ¶

View all Source files

wireguard.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL