diff --git a/VERSION b/VERSION index cf6931b..36a0393 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.1.52 +1.1.53 diff --git a/internal/database/migrations/0026_wg_client_routes.sql b/internal/database/migrations/0026_wg_client_routes.sql new file mode 100644 index 0000000..c7f0fab --- /dev/null +++ b/internal/database/migrations/0026_wg_client_routes.sql @@ -0,0 +1,6 @@ +-- +goose Up +ALTER TABLE wireguard_interfaces + ADD COLUMN IF NOT EXISTS client_routes TEXT; + +-- +goose Down +ALTER TABLE wireguard_interfaces DROP COLUMN IF EXISTS client_routes; diff --git a/internal/handlers/wireguard.go b/internal/handlers/wireguard.go index fd8f697..7c7a2ee 100644 --- a/internal/handlers/wireguard.go +++ b/internal/handlers/wireguard.go @@ -173,6 +173,7 @@ type ifaceCreateReq struct { AllowedIPs *string `json:"allowed_ips,omitempty"` PersistentKeepalive *int `json:"persistent_keepalive,omitempty"` MTU *int `json:"mtu,omitempty"` + ClientRoutes *string `json:"client_routes,omitempty"` Role string `json:"role"` Active bool `json:"active"` Description *string `json:"description,omitempty"` @@ -222,6 +223,7 @@ func (h *WireguardHandler) CreateIface(c *gin.Context) { PeerEndpoint: req.PeerEndpoint, PeerPublicKey: req.PeerPublicKey, PeerPSKEnc: encPSK, AllowedIPs: req.AllowedIPs, PersistentKeepalive: req.PersistentKeepalive, MTU: req.MTU, + ClientRoutes: req.ClientRoutes, Role: req.Role, Active: req.Active, Description: req.Description, } if ifc.Role == "" { @@ -311,6 +313,7 @@ func (h *WireguardHandler) UpdateIface(c *gin.Context) { PeerEndpoint: req.PeerEndpoint, PeerPublicKey: req.PeerPublicKey, PeerPSKEnc: encPSK, AllowedIPs: req.AllowedIPs, PersistentKeepalive: req.PersistentKeepalive, MTU: req.MTU, + ClientRoutes: req.ClientRoutes, Role: req.Role, Active: req.Active, Description: req.Description, } if ifc.Role == "" { @@ -645,12 +648,15 @@ func (h *WireguardHandler) peerConfigText(ctx context.Context, peerID int64) (st } fmt.Fprintf(&b, "PresharedKey = %s\n", string(psk)) } - // AllowedIPs on the client side is "everything that should go - // through the tunnel". For a server hosting an internal LAN - // this is typically 10.x/8 or the server's address range. We - // default to the iface address (so the client can at least - // reach the gateway) — operator can edit downloaded conf. - fmt.Fprintf(&b, "AllowedIPs = %s\n", ifc.AddressCIDR) + // AllowedIPs on the client side: the server's tunnel subnet + // (so peers can reach each other + the gateway) plus any + // additional "push routes" the operator configured on the + // server interface (e.g. 10.0.10.0/24 for a LAN behind the box). + clientAllowedIPs := ifc.AddressCIDR + if ifc.ClientRoutes != nil && strings.TrimSpace(*ifc.ClientRoutes) != "" { + clientAllowedIPs += ", " + strings.TrimSpace(*ifc.ClientRoutes) + } + fmt.Fprintf(&b, "AllowedIPs = %s\n", clientAllowedIPs) // Endpoint — the operator's public host:port that peers dial. // We don't know this here (could be a CNAME or behind a load // balancer); leave a placeholder the operator must fill in. diff --git a/internal/models/wireguard.go b/internal/models/wireguard.go index e391559..0c5a9f7 100644 --- a/internal/models/wireguard.go +++ b/internal/models/wireguard.go @@ -18,6 +18,7 @@ type WireguardInterface struct { AllowedIPs *string `gorm:"column:allowed_ips" json:"allowed_ips,omitempty"` PersistentKeepalive *int `gorm:"column:persistent_keepalive" json:"persistent_keepalive,omitempty"` MTU *int `gorm:"column:mtu" json:"mtu,omitempty"` + ClientRoutes *string `gorm:"column:client_routes" json:"client_routes,omitempty"` Role string `gorm:"column:role" json:"role"` Active bool `gorm:"column:active" json:"active"` Description *string `gorm:"column:description" json:"description,omitempty"` diff --git a/internal/services/wireguard/interfaces.go b/internal/services/wireguard/interfaces.go index e24f7cd..6193ef9 100644 --- a/internal/services/wireguard/interfaces.go +++ b/internal/services/wireguard/interfaces.go @@ -21,7 +21,7 @@ func NewInterfacesRepo(pool *pgxpool.Pool) *InterfacesRepo { return &InterfacesR const ifaceBaseSelect = ` SELECT id, name, mode, address_cidr, listen_port, public_key, private_key_enc, peer_endpoint, peer_public_key, peer_psk_enc, allowed_ips, persistent_keepalive, - mtu, role, active, description, created_at, updated_at + mtu, client_routes, role, active, description, created_at, updated_at FROM wireguard_interfaces ` @@ -59,14 +59,14 @@ func (r *InterfacesRepo) Create(ctx context.Context, i models.WireguardInterface INSERT INTO wireguard_interfaces ( name, mode, address_cidr, listen_port, public_key, private_key_enc, peer_endpoint, peer_public_key, peer_psk_enc, allowed_ips, persistent_keepalive, - mtu, role, active, description -) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15) + mtu, client_routes, role, active, description +) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16) RETURNING id, name, mode, address_cidr, listen_port, public_key, private_key_enc, peer_endpoint, peer_public_key, peer_psk_enc, allowed_ips, persistent_keepalive, - mtu, role, active, description, created_at, updated_at`, + mtu, client_routes, role, active, description, created_at, updated_at`, i.Name, i.Mode, i.AddressCIDR, i.ListenPort, i.PublicKey, i.PrivateKeyEnc, i.PeerEndpoint, i.PeerPublicKey, i.PeerPSKEnc, i.AllowedIPs, i.PersistentKeepalive, - i.MTU, i.Role, i.Active, i.Description) + i.MTU, i.ClientRoutes, i.Role, i.Active, i.Description) return scanIface(row) } @@ -75,15 +75,15 @@ func (r *InterfacesRepo) Update(ctx context.Context, id int64, i models.Wireguar UPDATE wireguard_interfaces SET name = $1, mode = $2, address_cidr = $3, listen_port = $4, public_key = $5, private_key_enc = $6, peer_endpoint = $7, peer_public_key = $8, peer_psk_enc = $9, - allowed_ips = $10, persistent_keepalive = $11, mtu = $12, role = $13, - active = $14, description = $15, updated_at = NOW() -WHERE id = $16 + allowed_ips = $10, persistent_keepalive = $11, mtu = $12, client_routes = $13, + role = $14, active = $15, description = $16, updated_at = NOW() +WHERE id = $17 RETURNING id, name, mode, address_cidr, listen_port, public_key, private_key_enc, peer_endpoint, peer_public_key, peer_psk_enc, allowed_ips, persistent_keepalive, - mtu, role, active, description, created_at, updated_at`, + mtu, client_routes, role, active, description, created_at, updated_at`, i.Name, i.Mode, i.AddressCIDR, i.ListenPort, i.PublicKey, i.PrivateKeyEnc, i.PeerEndpoint, i.PeerPublicKey, i.PeerPSKEnc, i.AllowedIPs, i.PersistentKeepalive, - i.MTU, i.Role, i.Active, i.Description, id) + i.MTU, i.ClientRoutes, i.Role, i.Active, i.Description, id) out, err := scanIface(row) if err != nil { if errors.Is(err, pgx.ErrNoRows) { @@ -110,7 +110,7 @@ func scanIface(row interface{ Scan(...any) error }) (*models.WireguardInterface, if err := row.Scan( &i.ID, &i.Name, &i.Mode, &i.AddressCIDR, &i.ListenPort, &i.PublicKey, &i.PrivateKeyEnc, &i.PeerEndpoint, &i.PeerPublicKey, &i.PeerPSKEnc, &i.AllowedIPs, &i.PersistentKeepalive, - &i.MTU, &i.Role, &i.Active, &i.Description, &i.CreatedAt, &i.UpdatedAt, + &i.MTU, &i.ClientRoutes, &i.Role, &i.Active, &i.Description, &i.CreatedAt, &i.UpdatedAt, ); err != nil { return nil, err } diff --git a/management-ui/src/i18n/locales/de/common.json b/management-ui/src/i18n/locales/de/common.json index 02284b7..3a72c2c 100644 --- a/management-ui/src/i18n/locales/de/common.json +++ b/management-ui/src/i18n/locales/de/common.json @@ -625,7 +625,9 @@ "generateExtra": "Wenn an: Server erzeugt ein neues Curve25519-Keypair beim Speichern.", "generateOn": "Server generiert", "generateOff": "Manuell paste", - "editKeyWarning": "Achtung: neue Schlüssel = bestehende Peer-Configs ungültig. Nur ändern wenn explizit gewollt." + "editKeyWarning": "Achtung: neue Schlüssel = bestehende Peer-Configs ungültig. Nur ändern wenn explizit gewollt.", + "clientRoutes": "Push-Routes (Client)", + "clientRoutesExtra": "Zusätzliche Netzwerke die der Peer über den Tunnel erreichen soll, z. B. 10.0.10.0/24 für ein LAN hinter der Box. Kommagetrennt. Wird automatisch in den Peer-Config-Download eingetragen." }, "peers": { "button": "Peers", diff --git a/management-ui/src/i18n/locales/en/common.json b/management-ui/src/i18n/locales/en/common.json index 4ad1baf..028734e 100644 --- a/management-ui/src/i18n/locales/en/common.json +++ b/management-ui/src/i18n/locales/en/common.json @@ -625,7 +625,9 @@ "generateExtra": "If on: server generates a fresh Curve25519 keypair on save.", "generateOn": "Server-generated", "generateOff": "Manual paste", - "editKeyWarning": "Warning: new keys invalidate all existing peer configs. Only change if intentional." + "editKeyWarning": "Warning: new keys invalidate all existing peer configs. Only change if intentional.", + "clientRoutes": "Push routes (client)", + "clientRoutesExtra": "Extra networks the peer should reach through the tunnel, e.g. 10.0.10.0/24 for a LAN behind the box. Comma-separated. Automatically included in the peer config download." }, "peers": { "button": "Peers", diff --git a/management-ui/src/pages/Wireguard/Servers.tsx b/management-ui/src/pages/Wireguard/Servers.tsx index c559017..772b203 100644 --- a/management-ui/src/pages/Wireguard/Servers.tsx +++ b/management-ui/src/pages/Wireguard/Servers.tsx @@ -25,6 +25,7 @@ interface ServerForm { address_cidr: string listen_port: number mtu?: number + client_routes?: string role: string active: boolean description?: string @@ -153,6 +154,7 @@ export default function ServersTab() { address_cidr: row.address_cidr, listen_port: row.listen_port ?? 51820, mtu: row.mtu ?? undefined, + client_routes: row.client_routes ?? undefined, role: row.role, active: row.active, description: row.description ?? undefined, @@ -263,6 +265,12 @@ export default function ServersTab() { + + + diff --git a/management-ui/src/pages/Wireguard/types.ts b/management-ui/src/pages/Wireguard/types.ts index 7ba53ea..566abd3 100644 --- a/management-ui/src/pages/Wireguard/types.ts +++ b/management-ui/src/pages/Wireguard/types.ts @@ -12,6 +12,7 @@ export interface WGInterface { allowed_ips?: string | null persistent_keepalive?: number | null mtu?: number | null + client_routes?: string | null role: string active: boolean description?: string | null