feat(network): VLAN/bridge/bond interface provisioner + IP-address apply

Fügt zwei neue systemd-oneshot-Services hinzu:
- edgeguard-interfaces.service: erstellt VLAN/bridge/bond-Interfaces
  (ip link add/del) wenn der Operator sie über die GUI anlegt/entfernt.
  Ethernet + WireGuard bleiben OS-managed.
- edgeguard-ipaddresses.service: bindet/entfernt IP-Adressen (ip addr
  add/del) nach jeder GUI-Mutation; läuft jetzt After=edgeguard-interfaces
  damit Interfaces immer vor den Adressen existieren.

Beide Services triggern per applyAsync() in den zugehörigen Handlern
(networks.go → Interfaces, ipaddresses.go → Adressen). Diff-Ansatz
über *-applied.conf verhindert dass manuell gebundene Adressen/
Interfaces angefasst werden.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/handlers/ipaddresses.go

@@ -1,7 +1,9 @@
 package handlers
 
 import (
+	"context"
 	"errors"
+	"log/slog"
 	"strconv"
 
 	"github.com/gin-gonic/gin"
@@ -13,13 +15,27 @@ import (
 )
 
 type IPAddressesHandler struct {
-	Repo   *ipaddresses.Repo
-	Audit  *audit.Repo
-	NodeID string
+	Repo      *ipaddresses.Repo
+	Generator *ipaddresses.Generator
+	Audit     *audit.Repo
+	NodeID    string
 }
 
 func NewIPAddressesHandler(repo *ipaddresses.Repo, a *audit.Repo, nodeID string) *IPAddressesHandler {
-	return &IPAddressesHandler{Repo: repo, Audit: a, NodeID: nodeID}
+	return &IPAddressesHandler{
+		Repo:      repo,
+		Generator: ipaddresses.NewGenerator(repo),
+		Audit:     a,
+		NodeID:    nodeID,
+	}
+}
+
+func (h *IPAddressesHandler) applyAsync(ctx context.Context) {
+	go func() {
+		if err := h.Generator.Render(ctx); err != nil {
+			slog.Warn("ip-addresses: apply failed", "error", err)
+		}
+	}()
 }
 
 func (h *IPAddressesHandler) Register(rg *gin.RouterGroup) {
@@ -70,6 +86,7 @@ func (h *IPAddressesHandler) Create(c *gin.Context) {
 	}
 	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "ip_address.create",
 		req.Address, out, h.NodeID)
+	h.applyAsync(c.Request.Context())
 	response.Created(c, out)
 }
 
@@ -94,6 +111,7 @@ func (h *IPAddressesHandler) Update(c *gin.Context) {
 	}
 	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "ip_address.update",
 		out.Address, out, h.NodeID)
+	h.applyAsync(c.Request.Context())
 	response.OK(c, out)
 }
 
@@ -112,5 +130,6 @@ func (h *IPAddressesHandler) Delete(c *gin.Context) {
 	}
 	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "ip_address.delete",
 		strconv.FormatInt(id, 10), gin.H{"id": id}, h.NodeID)
+	h.applyAsync(c.Request.Context())
 	response.NoContent(c)
 }

internal/handlers/networks.go

@@ -1,7 +1,9 @@
 package handlers
 
 import (
+	"context"
 	"errors"
+	"log/slog"
 	"strconv"
 
 	"github.com/gin-gonic/gin"
@@ -15,18 +17,34 @@ import (
 )
 
 type NetworksHandler struct {
-	Repo   *networkifs.Repo
-	IPs    *ipaddresses.Repo
-	Zones  *firewall.ZonesRepo
-	Audit  *audit.Repo
-	NodeID string
+	Repo      *networkifs.Repo
+	Generator *networkifs.Generator
+	IPs       *ipaddresses.Repo
+	Zones     *firewall.ZonesRepo
+	Audit     *audit.Repo
+	NodeID    string
 }
 
 func NewNetworksHandler(
 	repo *networkifs.Repo, ips *ipaddresses.Repo,
 	zones *firewall.ZonesRepo, a *audit.Repo, nodeID string,
 ) *NetworksHandler {
-	return &NetworksHandler{Repo: repo, IPs: ips, Zones: zones, Audit: a, NodeID: nodeID}
+	return &NetworksHandler{
+		Repo:      repo,
+		Generator: networkifs.NewGenerator(repo),
+		IPs:       ips,
+		Zones:     zones,
+		Audit:     a,
+		NodeID:    nodeID,
+	}
+}
+
+func (h *NetworksHandler) applyAsync(ctx context.Context) {
+	go func() {
+		if err := h.Generator.Render(ctx); err != nil {
+			slog.Warn("network-interfaces: apply failed", "error", err)
+		}
+	}()
 }
 
 func (h *NetworksHandler) Register(rg *gin.RouterGroup) {
@@ -88,6 +106,7 @@ func (h *NetworksHandler) Create(c *gin.Context) {
 		return
 	}
 	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "network_interface.create", req.Name, out, h.NodeID)
+	h.applyAsync(c.Request.Context())
 	response.Created(c, out)
 }
 
@@ -122,6 +141,7 @@ func (h *NetworksHandler) Update(c *gin.Context) {
 		return
 	}
 	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "network_interface.update", out.Name, out, h.NodeID)
+	h.applyAsync(c.Request.Context())
 	response.OK(c, out)
 }
 
@@ -140,6 +160,7 @@ func (h *NetworksHandler) Delete(c *gin.Context) {
 	}
 	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "network_interface.delete",
 		strconv.FormatInt(id, 10), gin.H{"id": id}, h.NodeID)
+	h.applyAsync(c.Request.Context())
 	response.NoContent(c)
 }
 

internal/services/ipaddresses/apply.go

@@ -0,0 +1,87 @@
+package ipaddresses
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"os/exec"
+	"strings"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/configgen"
+)
+
+// ConfPath wird von edgeguard-apply-ipaddresses gelesen.
+const ConfPath = "/etc/edgeguard/ip-addresses.conf"
+
+type Generator struct {
+	Repo *Repo
+}
+
+func NewGenerator(repo *Repo) *Generator { return &Generator{Repo: repo} }
+
+// Render schreibt /etc/edgeguard/ip-addresses.conf (Format: dev|addr/prefix)
+// und triggert das apply-Skript via sudo.
+func (g *Generator) Render(ctx context.Context) error {
+	type addrRow struct {
+		dev    string
+		addr   string
+		prefix int
+	}
+
+	rows, err := g.Repo.Pool.Query(ctx, `
+		SELECT ni.name, ia.address, ia.prefix
+		FROM ip_addresses ia
+		JOIN network_interfaces ni ON ni.id = ia.interface_id
+		WHERE ia.active = true
+		ORDER BY ni.name, ia.address`,
+	)
+	if err != nil {
+		return fmt.Errorf("query: %w", err)
+	}
+	defer rows.Close()
+
+	var entries []addrRow
+	for rows.Next() {
+		var r addrRow
+		if err := rows.Scan(&r.dev, &r.addr, &r.prefix); err != nil {
+			return fmt.Errorf("scan: %w", err)
+		}
+		entries = append(entries, r)
+	}
+	if err := rows.Err(); err != nil {
+		return err
+	}
+
+	var buf bytes.Buffer
+	buf.WriteString("# Generated by edgeguard-api — DO NOT EDIT.\n")
+	buf.WriteString("# Read by edgeguard-apply-ipaddresses. Format: dev|address/prefix\n")
+	for _, e := range entries {
+		fmt.Fprintf(&buf, "%s|%s/%d\n",
+			sanitize(e.dev), sanitize(e.addr), e.prefix)
+	}
+
+	if err := configgen.AtomicWrite(ConfPath, buf.Bytes(), 0o644); err != nil {
+		return fmt.Errorf("write %s: %w", ConfPath, err)
+	}
+	if err := applyIPAddresses(); err != nil {
+		return fmt.Errorf("apply: %w", err)
+	}
+	return nil
+}
+
+func applyIPAddresses() error {
+	cmd := exec.Command("sudo", "-n", "/usr/bin/systemctl",
+		"restart", "edgeguard-ipaddresses.service")
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("systemctl restart edgeguard-ipaddresses.service: %s: %w",
+			strings.TrimSpace(string(out)), err)
+	}
+	return nil
+}
+
+func sanitize(s string) string {
+	s = strings.ReplaceAll(s, "|", "")
+	s = strings.ReplaceAll(s, "\n", "")
+	return strings.TrimSpace(s)
+}

internal/services/networkifs/apply.go

@@ -0,0 +1,103 @@
+package networkifs
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"os/exec"
+	"strings"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/configgen"
+)
+
+// ConfPath is read by edgeguard-apply-interfaces.
+const ConfPath = "/etc/edgeguard/interfaces.conf"
+
+type Generator struct {
+	Repo *Repo
+}
+
+func NewGenerator(repo *Repo) *Generator { return &Generator{Repo: repo} }
+
+// Render writes /etc/edgeguard/interfaces.conf (format: type|name|parent|vlan_id|mtu|members)
+// for VLAN/bridge/bond interfaces and triggers edgeguard-interfaces.service.
+// Ethernet and WireGuard interfaces are managed by the OS / wg-quick and are excluded.
+func (g *Generator) Render(ctx context.Context) error {
+	rows, err := g.Repo.Pool.Query(ctx, `
+		SELECT type, name,
+		       COALESCE(parent, ''),
+		       COALESCE(vlan_id::text, ''),
+		       COALESCE(mtu::text, ''),
+		       members
+		FROM network_interfaces
+		WHERE active = true
+		  AND type IN ('vlan', 'bridge', 'bond')
+		  AND (type = 'vlan' OR jsonb_array_length(members) > 0)
+		ORDER BY type, name`,
+	)
+	if err != nil {
+		return fmt.Errorf("query: %w", err)
+	}
+	defer rows.Close()
+
+	type ifRow struct {
+		typ     string
+		name    string
+		parent  string
+		vlanID  string
+		mtu     string
+		members []string
+	}
+
+	var entries []ifRow
+	for rows.Next() {
+		var r ifRow
+		var membersRaw []byte
+		if err := rows.Scan(&r.typ, &r.name, &r.parent, &r.vlanID, &r.mtu, &membersRaw); err != nil {
+			return fmt.Errorf("scan: %w", err)
+		}
+		if len(membersRaw) > 0 {
+			_ = json.Unmarshal(membersRaw, &r.members)
+		}
+		entries = append(entries, r)
+	}
+	if err := rows.Err(); err != nil {
+		return err
+	}
+
+	var buf bytes.Buffer
+	buf.WriteString("# Generated by edgeguard-api — DO NOT EDIT.\n")
+	buf.WriteString("# Read by edgeguard-apply-interfaces. Format: type|name|parent|vlan_id|mtu|members\n")
+	for _, e := range entries {
+		fmt.Fprintf(&buf, "%s|%s|%s|%s|%s|%s\n",
+			sanitizeIf(e.typ), sanitizeIf(e.name), sanitizeIf(e.parent),
+			sanitizeIf(e.vlanID), sanitizeIf(e.mtu),
+			sanitizeIf(strings.Join(e.members, ",")))
+	}
+
+	if err := configgen.AtomicWrite(ConfPath, buf.Bytes(), 0o644); err != nil {
+		return fmt.Errorf("write %s: %w", ConfPath, err)
+	}
+	if err := applyInterfaces(); err != nil {
+		return fmt.Errorf("apply: %w", err)
+	}
+	return nil
+}
+
+func applyInterfaces() error {
+	cmd := exec.Command("sudo", "-n", "/usr/bin/systemctl",
+		"restart", "edgeguard-interfaces.service")
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("systemctl restart edgeguard-interfaces.service: %s: %w",
+			strings.TrimSpace(string(out)), err)
+	}
+	return nil
+}
+
+func sanitizeIf(s string) string {
+	s = strings.ReplaceAll(s, "|", "")
+	s = strings.ReplaceAll(s, "\n", "")
+	return strings.TrimSpace(s)
+}