Documentation
¶
Overview ¶
Package wireguard generates per-node WireGuard configuration for a cluster mesh. The server is the topology brain: given each node's public key, mesh IP, and (optional) public endpoint, it emits a wg0.conf for a target node with one Peer per other node, AllowedIPs pinned to each peer's /32 (so a node can only impersonate its own mesh IP), and a keepalive so NAT-bound nodes hold the tunnel open. The node's private key never reaches the server; the emitted config carries the PrivateKeyPlaceholder token, which the agent substitutes from its local key file at apply time.
Index ¶
- Constants
- Variables
- func BuildMesh(nodes []model.Node, target model.Node, listenPort int) (Interface, []Peer, error)
- func BuildTopology(network model.WGNetwork, memberships []model.WGMembership, nodes []model.Node, ...) (Interface, []Peer, error)
- func GenerateConfig(iface Interface, peers []Peer) (string, error)
- func MeshFromNodes(nodes []model.Node, listenPort int) (model.WGNetwork, []model.WGMembership)
- func ValidateEndpoint(endpoint string) error
- func ValidatePublicKey(key string) bool
- type Interface
- type Peer
Constants ¶
const PrivateKeyPlaceholder = "__LATTICE_WG_PRIVATE_KEY__"
PrivateKeyPlaceholder is replaced by the agent with the node's local private key when the config is applied. It is safe to display in an approval diff.
Variables ¶
var ErrCustomTopology = errors.New("custom topology is not implemented; use mesh or hub-and-spoke")
ErrCustomTopology marks the not-yet-implemented explicit-edge mode. It fails closed rather than silently degrading to mesh, which would quietly widen a deliberately restricted topology.
Functions ¶
func BuildMesh ¶
BuildMesh computes the interface and peer list for target from the cluster's nodes. Nodes without a public key or mesh IP, and the target itself, are skipped. listenPort overrides the target's reported port when > 0.
func BuildTopology ¶ added in v0.2.1
func BuildTopology( network model.WGNetwork, memberships []model.WGMembership, nodes []model.Node, targetNodeID string, ) (Interface, []Peer, error)
BuildTopology computes the interface and peers for one member of a network. nodes supplies the public keys and fallback endpoints; memberships define the topology roles and addresses.
func GenerateConfig ¶
GenerateConfig renders a wg0.conf. It validates keys and the interface name so attacker-influenced metadata cannot break out of the config structure.
func MeshFromNodes ¶ added in v0.2.1
MeshFromNodes converts the existing implicit fleet mesh — the one encoded in Node.WireGuard* fields — into a named network plus memberships. It is the migration bridge: BuildTopology over its output must render identically to BuildMesh over the same nodes.
Source Files