b307a7b1f7
Initialer Schema-Set (8 Migrationen, 13 Tabellen) für EdgeGuard v1: users + audit_log + system_settings, ha_nodes, backends/domains/ routing_rules/tls_certs, forward_proxy_acls, wireguard_peers, firewall_rules, dns_zones/dns_records, licenses. Migrations liegen in internal/database/migrations/ (analog mail-gateway) und werden per //go:embed ins Binary gepackt — keine separate SQL-Dateien im .deb. ValidateMigrations + Test schützen vor Duplicate-Versionen (mail-gateway 2026-05-08-Vorfall). GORM-Models für alle Tabellen, sensible Felder (password_hash, private_key_enc) sind json:"-". Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
42 lines
1.6 KiB
SQL
42 lines
1.6 KiB
SQL
-- +goose Up
|
|
-- +goose StatementBegin
|
|
|
|
-- WireGuard peers. v1 uses Option A (shared server identity, see
|
|
-- docs/architecture.md §8.1) — the local server peer is row 1, type
|
|
-- 'server'; remote site-to-site peers and road-warrior clients are
|
|
-- separate rows.
|
|
--
|
|
-- private_key_enc holds the encrypted server private key (NULL for
|
|
-- non-server rows); decryption key lives in /var/lib/edgeguard/.wg_key
|
|
-- (mode 0600). Never logged.
|
|
CREATE TABLE IF NOT EXISTS wireguard_peers (
|
|
id BIGSERIAL PRIMARY KEY,
|
|
name TEXT NOT NULL,
|
|
peer_type TEXT NOT NULL,
|
|
public_key TEXT NOT NULL,
|
|
private_key_enc TEXT,
|
|
preshared_key_enc TEXT,
|
|
allowed_ips TEXT NOT NULL,
|
|
endpoint TEXT,
|
|
listen_port INTEGER,
|
|
persistent_keepalive INTEGER,
|
|
last_handshake_at TIMESTAMPTZ,
|
|
active BOOLEAN NOT NULL DEFAULT TRUE,
|
|
notes TEXT,
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
|
updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
|
CONSTRAINT wireguard_peers_name_unique UNIQUE (name),
|
|
CONSTRAINT wireguard_peers_pubkey_unique UNIQUE (public_key),
|
|
CONSTRAINT wireguard_peers_type_check CHECK (peer_type IN ('server', 's2s', 'roadwarrior'))
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_wireguard_peers_active ON wireguard_peers (active) WHERE active;
|
|
CREATE INDEX IF NOT EXISTS idx_wireguard_peers_type ON wireguard_peers (peer_type);
|
|
|
|
-- +goose StatementEnd
|
|
|
|
-- +goose Down
|
|
-- +goose StatementBegin
|
|
DROP TABLE IF EXISTS wireguard_peers;
|
|
-- +goose StatementEnd
|