projekte/edgeguard-native
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(wg): Push-Routes (Client-Routes) für WireGuard-Server-Interfaces

Browse Source 
Neues Feld 'client_routes' auf wireguard_interfaces: der Operator
trägt dort kommagetrennte Netzwerke ein (z. B. 10.0.10.0/24 für ein
LAN hinter der Box). Der Peer-Config-Download fügt diese automatisch
als zusätzliche AllowedIPs in den [Peer]-Block der Client-Config ein.

Bisher wurde nur das Server-Tunnel-Subnetz (ifc.address_cidr) als
AllowedIPs exportiert — Peers konnten so keine anderen Netze über
den Tunnel erreichen ohne die Config manuell anzupassen.

Migration: 0026_wg_client_routes.sql

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Debian
2026-05-21 13:09:51 +02:00
parent 1f0d05019e
commit bc5d81d966
9 changed files with 46 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
internal/services/wireguard/interfaces.go
View File

@@ -21,7 +21,7 @@ func NewInterfacesRepo(pool *pgxpool.Pool) *InterfacesRepo { return &InterfacesR
const ifaceBaseSelect = `
SELECT id, name, mode, address_cidr, listen_port, public_key, private_key_enc,
peer_endpoint, peer_public_key, peer_psk_enc, allowed_ips, persistent_keepalive,
mtu, role, active, description, created_at, updated_at
mtu, client_routes, role, active, description, created_at, updated_at
FROM wireguard_interfaces
`
@@ -59,14 +59,14 @@ func (r *InterfacesRepo) Create(ctx context.Context, i models.WireguardInterface
INSERT INTO wireguard_interfaces (
name, mode, address_cidr, listen_port, public_key, private_key_enc,
peer_endpoint, peer_public_key, peer_psk_enc, allowed_ips, persistent_keepalive,
mtu, role, active, description
) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)
mtu, client_routes, role, active, description
) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16)
RETURNING id, name, mode, address_cidr, listen_port, public_key, private_key_enc,
peer_endpoint, peer_public_key, peer_psk_enc, allowed_ips, persistent_keepalive,
mtu, role, active, description, created_at, updated_at`,
mtu, client_routes, role, active, description, created_at, updated_at`,
i.Name, i.Mode, i.AddressCIDR, i.ListenPort, i.PublicKey, i.PrivateKeyEnc,
i.PeerEndpoint, i.PeerPublicKey, i.PeerPSKEnc, i.AllowedIPs, i.PersistentKeepalive,
i.MTU, i.Role, i.Active, i.Description)
i.MTU, i.ClientRoutes, i.Role, i.Active, i.Description)
return scanIface(row)
}
@@ -75,15 +75,15 @@ func (r *InterfacesRepo) Update(ctx context.Context, id int64, i models.Wireguar
UPDATE wireguard_interfaces SET
name = $1, mode = $2, address_cidr = $3, listen_port = $4, public_key = $5,
private_key_enc = $6, peer_endpoint = $7, peer_public_key = $8, peer_psk_enc = $9,
allowed_ips = $10, persistent_keepalive = $11, mtu = $12, role = $13,
active = $14, description = $15, updated_at = NOW()
WHERE id = $16
allowed_ips = $10, persistent_keepalive = $11, mtu = $12, client_routes = $13,
role = $14, active = $15, description = $16, updated_at = NOW()
WHERE id = $17
RETURNING id, name, mode, address_cidr, listen_port, public_key, private_key_enc,
peer_endpoint, peer_public_key, peer_psk_enc, allowed_ips, persistent_keepalive,
mtu, role, active, description, created_at, updated_at`,
mtu, client_routes, role, active, description, created_at, updated_at`,
i.Name, i.Mode, i.AddressCIDR, i.ListenPort, i.PublicKey, i.PrivateKeyEnc,
i.PeerEndpoint, i.PeerPublicKey, i.PeerPSKEnc, i.AllowedIPs, i.PersistentKeepalive,
i.MTU, i.Role, i.Active, i.Description, id)
i.MTU, i.ClientRoutes, i.Role, i.Active, i.Description, id)
out, err := scanIface(row)
if err != nil {
if errors.Is(err, pgx.ErrNoRows) {
@@ -110,7 +110,7 @@ func scanIface(row interface{ Scan(...any) error }) (*models.WireguardInterface,
if err := row.Scan(
&i.ID, &i.Name, &i.Mode, &i.AddressCIDR, &i.ListenPort, &i.PublicKey, &i.PrivateKeyEnc,
&i.PeerEndpoint, &i.PeerPublicKey, &i.PeerPSKEnc, &i.AllowedIPs, &i.PersistentKeepalive,
&i.MTU, &i.Role, &i.Active, &i.Description, &i.CreatedAt, &i.UpdatedAt,
&i.MTU, &i.ClientRoutes, &i.Role, &i.Active, &i.Description, &i.CreatedAt, &i.UpdatedAt,
); err != nil {
return nil, err
}