wireguard

package
v0.5.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 3, 2026 License: Apache-2.0 Imports: 15 Imported by: 0

Documentation

Index

Constants

View Source
const DefaultInterfaceName = "plexd0"

DefaultInterfaceName is the default WireGuard interface name.

View Source
const DefaultListenPort = 51820

DefaultListenPort is the default WireGuard UDP listen port.

Variables

This section is empty.

Functions

func ReconcileHandler

func ReconcileHandler(mgr *Manager) reconcile.ReconcileHandler

ReconcileHandler returns a reconcile.ReconcileHandler that applies peer changes from the StateDiff to the WireGuard interface via the Manager. PeersToRemove are node IDs resolved through the peer index; adds and updates are converted from the snapshot shape via peerFromSnapshot. Order: removes first, then updates, then adds. Individual failures are logged and collected; an aggregated error is returned.

Types

type Config

type Config struct {
	// InterfaceName is the WireGuard network interface name.
	// Default: "plexd0"
	InterfaceName string `yaml:"interface_name"`

	// ListenPort is the UDP port WireGuard listens on.
	// Default: 51820
	ListenPort int `yaml:"listen_port"`

	// MTU is the interface MTU. 0 means system default.
	MTU int `yaml:"mtu"`
}

Config holds the configuration for WireGuard tunnel management. Config is passed as a constructor argument — no file I/O in this package.

func (*Config) ApplyDefaults

func (c *Config) ApplyDefaults()

ApplyDefaults sets default values for zero-valued fields.

func (*Config) Validate

func (c *Config) Validate() error

Validate checks that configuration values are within acceptable ranges.

type Manager

type Manager struct {
	// contains filtered or unexported fields
}

Manager manages the WireGuard interface and peer configuration.

func NewManager

func NewManager(ctrl WGController, cfg Config, logger *slog.Logger) *Manager

NewManager creates a new Manager. Config defaults are applied automatically.

func (*Manager) AddPeer

func (m *Manager) AddPeer(peer api.Peer) error

AddPeer adds a peer to the WireGuard interface and updates the peer index.

func (*Manager) ConfigurePeers

func (m *Manager) ConfigurePeers(ctx context.Context, peers []api.Peer) error

ConfigurePeers bulk-configures all peers. Individual errors are logged but not returned.

func (*Manager) PeerIndex

func (m *Manager) PeerIndex() *PeerIndex

PeerIndex returns the peer index.

func (*Manager) RemovePeer

func (m *Manager) RemovePeer(publicKey []byte) error

RemovePeer removes a peer from the WireGuard interface by public key.

func (*Manager) RemovePeerByID

func (m *Manager) RemovePeerByID(peerID string) error

RemovePeerByID removes a peer by its peer ID, looking up the public key in the index.

func (*Manager) Setup

func (m *Manager) Setup(ctx context.Context, identity *registration.NodeIdentity) error

Setup creates and configures the WireGuard interface using the node identity.

func (*Manager) Teardown

func (m *Manager) Teardown() error

Teardown deletes the WireGuard interface.

func (*Manager) UpdatePeer

func (m *Manager) UpdatePeer(peer api.Peer) error

UpdatePeer updates a peer configuration. WireGuard AddPeer is idempotent (upsert).

func (*Manager) UpdatePrivateKey added in v0.2.0

func (m *Manager) UpdatePrivateKey(privateKey []byte) error

UpdatePrivateKey installs a rotated private key on the managed interface.

type NetlinkController

type NetlinkController struct {
	// contains filtered or unexported fields
}

NetlinkController implements WGController using Linux netlink and wgctrl.

func NewNetlinkController

func NewNetlinkController(logger *slog.Logger) *NetlinkController

NewNetlinkController returns a new NetlinkController.

func (*NetlinkController) AddPeer

func (c *NetlinkController) AddPeer(iface string, cfg PeerConfig) error

AddPeer adds or updates a peer on the named WireGuard interface. A new wgctrl client is created per call to avoid stale netlink socket issues across long-lived controller instances. The creation cost is negligible.

func (*NetlinkController) ConfigureAddress

func (c *NetlinkController) ConfigureAddress(name string, address string) error

ConfigureAddress adds a CIDR address to the named interface.

func (*NetlinkController) CreateInterface

func (c *NetlinkController) CreateInterface(name string, privateKey []byte, listenPort int) error

CreateInterface creates a WireGuard interface with the given name, configures it with the provided private key and listen port.

func (*NetlinkController) DeleteInterface

func (c *NetlinkController) DeleteInterface(name string) error

DeleteInterface deletes the named WireGuard interface. It is idempotent: deleting a non-existent interface returns nil.

func (*NetlinkController) RemovePeer

func (c *NetlinkController) RemovePeer(iface string, publicKey []byte) error

RemovePeer removes a peer from the named WireGuard interface by public key.

func (*NetlinkController) SetInterfaceUp

func (c *NetlinkController) SetInterfaceUp(name string) error

SetInterfaceUp brings the named interface up.

func (*NetlinkController) SetMTU

func (c *NetlinkController) SetMTU(name string, mtu int) error

SetMTU sets the MTU on the named interface.

func (*NetlinkController) SetPrivateKey added in v0.2.0

func (c *NetlinkController) SetPrivateKey(name string, privateKey []byte) error

SetPrivateKey replaces the named device's private key without touching its listen port or peers.

type PeerConfig

type PeerConfig struct {
	PublicKey           []byte
	Endpoint            string
	AllowedIPs          []string
	PSK                 []byte // nil if no PSK
	PersistentKeepalive int
}

PeerConfig holds the WireGuard-native configuration for a single peer.

func PeerConfigFromAPI

func PeerConfigFromAPI(peer api.Peer) (PeerConfig, error)

PeerConfigFromAPI translates an api.Peer to a WireGuard PeerConfig. PublicKey and PSK are decoded from base64; an empty PSK is allowed.

type PeerIndex

type PeerIndex struct {
	// contains filtered or unexported fields
}

PeerIndex maintains a thread-safe mapping from peer IDs to base64-encoded public keys. This bridges the gap between the control plane (which uses peer IDs) and WireGuard (which uses public keys).

func NewPeerIndex

func NewPeerIndex() *PeerIndex

NewPeerIndex creates an empty PeerIndex.

func (*PeerIndex) Add

func (p *PeerIndex) Add(peerID, publicKey string)

Add adds or overwrites the mapping from peerID to publicKey.

func (*PeerIndex) Count

func (p *PeerIndex) Count() int

Count returns the number of peers in the index.

func (*PeerIndex) LoadFromPeers

func (p *PeerIndex) LoadFromPeers(peers []api.Peer)

LoadFromPeers bulk-populates the index from a slice of api.Peer. It clears all existing entries before adding the new ones.

func (*PeerIndex) Lookup

func (p *PeerIndex) Lookup(peerID string) (publicKey string, ok bool)

Lookup returns the public key for the given peerID and whether it was found.

func (*PeerIndex) Remove

func (p *PeerIndex) Remove(peerID string)

Remove removes the mapping for peerID. It is a no-op if peerID is not present.

func (*PeerIndex) Update

func (p *PeerIndex) Update(peerID, newPublicKey string)

Update updates the mapping from peerID to newPublicKey. It is equivalent to Add but semantically distinct for clarity.

type WGController

type WGController interface {
	CreateInterface(name string, privateKey []byte, listenPort int) error
	// DeleteInterface deletes the named WireGuard interface.
	// Implementations must be idempotent: deleting a non-existent interface must return nil.
	DeleteInterface(name string) error
	ConfigureAddress(name string, address string) error
	SetInterfaceUp(name string) error
	SetMTU(name string, mtu int) error
	AddPeer(iface string, cfg PeerConfig) error
	RemovePeer(iface string, publicKey []byte) error
	// SetPrivateKey replaces the named device's private key without touching
	// its listen port or peers.
	SetPrivateKey(name string, privateKey []byte) error
}

WGController abstracts OS-level WireGuard operations for testability.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL