Documentation
¶
Index ¶
- Constants
- func ReconcileHandler(mgr *Manager) reconcile.ReconcileHandler
- type Config
- type Manager
- func (m *Manager) AddPeer(peer api.Peer) error
- func (m *Manager) ConfigurePeers(ctx context.Context, peers []api.Peer) error
- func (m *Manager) PeerIndex() *PeerIndex
- func (m *Manager) RemovePeer(publicKey []byte) error
- func (m *Manager) RemovePeerByID(peerID string) error
- func (m *Manager) Setup(ctx context.Context, identity *registration.NodeIdentity) error
- func (m *Manager) Teardown() error
- func (m *Manager) UpdatePeer(peer api.Peer) error
- func (m *Manager) UpdatePrivateKey(privateKey []byte) error
- type NetlinkController
- func (c *NetlinkController) AddPeer(iface string, cfg PeerConfig) error
- func (c *NetlinkController) ConfigureAddress(name string, address string) error
- func (c *NetlinkController) CreateInterface(name string, privateKey []byte, listenPort int) error
- func (c *NetlinkController) DeleteInterface(name string) error
- func (c *NetlinkController) RemovePeer(iface string, publicKey []byte) error
- func (c *NetlinkController) SetInterfaceUp(name string) error
- func (c *NetlinkController) SetMTU(name string, mtu int) error
- func (c *NetlinkController) SetPrivateKey(name string, privateKey []byte) error
- type PeerConfig
- type PeerIndex
- func (p *PeerIndex) Add(peerID, publicKey string)
- func (p *PeerIndex) Count() int
- func (p *PeerIndex) LoadFromPeers(peers []api.Peer)
- func (p *PeerIndex) Lookup(peerID string) (publicKey string, ok bool)
- func (p *PeerIndex) Remove(peerID string)
- func (p *PeerIndex) Update(peerID, newPublicKey string)
- type WGController
Constants ¶
const DefaultInterfaceName = "plexd0"
DefaultInterfaceName is the default WireGuard interface name.
const DefaultListenPort = 51820
DefaultListenPort is the default WireGuard UDP listen port.
Variables ¶
This section is empty.
Functions ¶
func ReconcileHandler ¶
func ReconcileHandler(mgr *Manager) reconcile.ReconcileHandler
ReconcileHandler returns a reconcile.ReconcileHandler that applies peer changes from the StateDiff to the WireGuard interface via the Manager. PeersToRemove are node IDs resolved through the peer index; adds and updates are converted from the snapshot shape via peerFromSnapshot. Order: removes first, then updates, then adds. Individual failures are logged and collected; an aggregated error is returned.
Types ¶
type Config ¶
type Config struct {
// InterfaceName is the WireGuard network interface name.
// Default: "plexd0"
InterfaceName string `yaml:"interface_name"`
// ListenPort is the UDP port WireGuard listens on.
// Default: 51820
ListenPort int `yaml:"listen_port"`
// MTU is the interface MTU. 0 means system default.
MTU int `yaml:"mtu"`
}
Config holds the configuration for WireGuard tunnel management. Config is passed as a constructor argument — no file I/O in this package.
func (*Config) ApplyDefaults ¶
func (c *Config) ApplyDefaults()
ApplyDefaults sets default values for zero-valued fields.
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager manages the WireGuard interface and peer configuration.
func NewManager ¶
func NewManager(ctrl WGController, cfg Config, logger *slog.Logger) *Manager
NewManager creates a new Manager. Config defaults are applied automatically.
func (*Manager) AddPeer ¶
AddPeer adds a peer to the WireGuard interface and updates the peer index.
func (*Manager) ConfigurePeers ¶
ConfigurePeers bulk-configures all peers. Individual errors are logged but not returned.
func (*Manager) RemovePeer ¶
RemovePeer removes a peer from the WireGuard interface by public key.
func (*Manager) RemovePeerByID ¶
RemovePeerByID removes a peer by its peer ID, looking up the public key in the index.
func (*Manager) Setup ¶
func (m *Manager) Setup(ctx context.Context, identity *registration.NodeIdentity) error
Setup creates and configures the WireGuard interface using the node identity.
func (*Manager) UpdatePeer ¶
UpdatePeer updates a peer configuration. WireGuard AddPeer is idempotent (upsert).
func (*Manager) UpdatePrivateKey ¶ added in v0.2.0
UpdatePrivateKey installs a rotated private key on the managed interface.
type NetlinkController ¶
type NetlinkController struct {
// contains filtered or unexported fields
}
NetlinkController implements WGController using Linux netlink and wgctrl.
func NewNetlinkController ¶
func NewNetlinkController(logger *slog.Logger) *NetlinkController
NewNetlinkController returns a new NetlinkController.
func (*NetlinkController) AddPeer ¶
func (c *NetlinkController) AddPeer(iface string, cfg PeerConfig) error
AddPeer adds or updates a peer on the named WireGuard interface. A new wgctrl client is created per call to avoid stale netlink socket issues across long-lived controller instances. The creation cost is negligible.
func (*NetlinkController) ConfigureAddress ¶
func (c *NetlinkController) ConfigureAddress(name string, address string) error
ConfigureAddress adds a CIDR address to the named interface.
func (*NetlinkController) CreateInterface ¶
func (c *NetlinkController) CreateInterface(name string, privateKey []byte, listenPort int) error
CreateInterface creates a WireGuard interface with the given name, configures it with the provided private key and listen port.
func (*NetlinkController) DeleteInterface ¶
func (c *NetlinkController) DeleteInterface(name string) error
DeleteInterface deletes the named WireGuard interface. It is idempotent: deleting a non-existent interface returns nil.
func (*NetlinkController) RemovePeer ¶
func (c *NetlinkController) RemovePeer(iface string, publicKey []byte) error
RemovePeer removes a peer from the named WireGuard interface by public key.
func (*NetlinkController) SetInterfaceUp ¶
func (c *NetlinkController) SetInterfaceUp(name string) error
SetInterfaceUp brings the named interface up.
func (*NetlinkController) SetMTU ¶
func (c *NetlinkController) SetMTU(name string, mtu int) error
SetMTU sets the MTU on the named interface.
func (*NetlinkController) SetPrivateKey ¶ added in v0.2.0
func (c *NetlinkController) SetPrivateKey(name string, privateKey []byte) error
SetPrivateKey replaces the named device's private key without touching its listen port or peers.
type PeerConfig ¶
type PeerConfig struct {
PublicKey []byte
Endpoint string
AllowedIPs []string
PSK []byte // nil if no PSK
PersistentKeepalive int
}
PeerConfig holds the WireGuard-native configuration for a single peer.
func PeerConfigFromAPI ¶
func PeerConfigFromAPI(peer api.Peer) (PeerConfig, error)
PeerConfigFromAPI translates an api.Peer to a WireGuard PeerConfig. PublicKey and PSK are decoded from base64; an empty PSK is allowed.
type PeerIndex ¶
type PeerIndex struct {
// contains filtered or unexported fields
}
PeerIndex maintains a thread-safe mapping from peer IDs to base64-encoded public keys. This bridges the gap between the control plane (which uses peer IDs) and WireGuard (which uses public keys).
func (*PeerIndex) LoadFromPeers ¶
LoadFromPeers bulk-populates the index from a slice of api.Peer. It clears all existing entries before adding the new ones.
func (*PeerIndex) Lookup ¶
Lookup returns the public key for the given peerID and whether it was found.
type WGController ¶
type WGController interface {
CreateInterface(name string, privateKey []byte, listenPort int) error
// DeleteInterface deletes the named WireGuard interface.
// Implementations must be idempotent: deleting a non-existent interface must return nil.
DeleteInterface(name string) error
ConfigureAddress(name string, address string) error
SetInterfaceUp(name string) error
SetMTU(name string, mtu int) error
AddPeer(iface string, cfg PeerConfig) error
RemovePeer(iface string, publicKey []byte) error
// SetPrivateKey replaces the named device's private key without touching
// its listen port or peers.
SetPrivateKey(name string, privateKey []byte) error
}
WGController abstracts OS-level WireGuard operations for testability.