85904d0c36
WireGuard --------- * Migration 0013: wireguard_interfaces (server|client mode, key envelope- encrypted) + wireguard_peers (per-server roster). Drop old empty 0005-Schema (Option-A peer_type, kein Iface-FK), neuer Aufbau mit zwei Tabellen + FK. * internal/services/secrets: Box mit AES-256-GCM, Master-Key in /var/lib/edgeguard/.master_key (lazy-create, 0600). Sealed/Open für PrivateKey + PSK. * internal/services/wireguard: KeyGen (Curve25519 mit clamping), PublicFromPrivate (für Import), InterfacesRepo, PeersRepo, Importer (parst /etc/wireguard/*.conf, server vs. client heuristisch nach ListenPort + Peer-Anzahl). * internal/wireguard: Renderer schreibt /etc/edgeguard/wireguard/<iface>.conf (0600), restartet wg-quick@<iface> via sudo (sudoers im postinst erweitert). Idempotent — re-render nur wenn content geändert. * internal/handlers/wireguard.go: REST CRUD für interfaces+peers, /generate-keypair, /peers/:id/config (text/plain wg-quick conf), /peers/:id/qr (PNG via go-qrcode). Auto-reload nach Mutation. * edgeguard-ctl wg-import [--path /etc/wireguard]: liest existierende conf-Files in die DB. Idempotent (überspringt vorhandene Iface-Namen). Shared UI components (proxy-lb-waf design pattern) -------------------------------------------------- * PageHeader: icon + title + subtitle + extras row, einheitlich oben auf jeder Page. * ActionButtons: Edit + Delete combo mit Popconfirm + Tooltip. * StatusDot: AntD Badge pattern statt "Yes/No" — schneller scanbar in dichten Tabellen. * DataTable: pageSizeOptions [20,50,100,200] + extraActions-Alias + optional renderMobileCard für Card-Liste auf < md Breakpoint. * enterprise.css: .page-header* + .datatable-toolbar Klassen. Frontend WireGuard ------------------ * /vpn/wireguard mit zwei Tabs (Server / Client) im neuen Pattern. * Server-Tab: Modal mit Generate-Keypair-Toggle, Peer-Roster im Drawer per Server. Pro Peer: QR-Code-Modal + .conf-Download. * Client-Tab: Upstream-Card im Modal, full-tunnel-Default (0.0.0.0/0,::/0), Keepalive 25. * i18n DE/EN für wg.* Block + common.* Erweiterung. Misc ---- * Sidebar: WireGuard unter Security-Sektion. * Nav-i18n: "Firewall (v2)" → "Firewall". * Version 1.0.8 → 1.0.11. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
75 lines
2.1 KiB
Go
75 lines
2.1 KiB
Go
package main
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"os"
|
|
"strings"
|
|
"time"
|
|
|
|
"git.netcell-it.de/projekte/edgeguard-native/internal/configgen"
|
|
"git.netcell-it.de/projekte/edgeguard-native/internal/database"
|
|
"git.netcell-it.de/projekte/edgeguard-native/internal/firewall"
|
|
"git.netcell-it.de/projekte/edgeguard-native/internal/haproxy"
|
|
"git.netcell-it.de/projekte/edgeguard-native/internal/services/configorch"
|
|
"git.netcell-it.de/projekte/edgeguard-native/internal/services/secrets"
|
|
"git.netcell-it.de/projekte/edgeguard-native/internal/squid"
|
|
"git.netcell-it.de/projekte/edgeguard-native/internal/unbound"
|
|
"git.netcell-it.de/projekte/edgeguard-native/internal/wireguard"
|
|
)
|
|
|
|
// cmdRenderConfig regenerates every per-service config file from PG
|
|
// state. Used after package install (postinst), after admin
|
|
// mutations (UI button), or as a manual recovery action.
|
|
//
|
|
// Flags:
|
|
//
|
|
// --no-reload Write configs but skip systemctl reload.
|
|
// --only=svc1,svc2 Run only the named generators.
|
|
func cmdRenderConfig(args []string) int {
|
|
skipReload := false
|
|
var only []string
|
|
for i := 0; i < len(args); i++ {
|
|
switch {
|
|
case args[i] == "--no-reload":
|
|
skipReload = true
|
|
case strings.HasPrefix(args[i], "--only="):
|
|
val := strings.TrimPrefix(args[i], "--only=")
|
|
only = strings.Split(val, ",")
|
|
case args[i] == "-h" || args[i] == "--help":
|
|
fmt.Println("Usage: edgeguard-ctl render-config [--no-reload] [--only=svc1,svc2]")
|
|
return 0
|
|
}
|
|
}
|
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
|
|
defer cancel()
|
|
|
|
pool, err := database.Open(ctx, database.ConnStringFromEnv())
|
|
if err != nil {
|
|
fmt.Fprintln(os.Stderr, "render-config: open db:", err)
|
|
return 1
|
|
}
|
|
defer pool.Close()
|
|
|
|
hap := haproxy.New(pool)
|
|
fw := firewall.New(pool)
|
|
sq := squid.New()
|
|
wg := wireguard.New(pool, secrets.New(""))
|
|
ub := unbound.New()
|
|
if skipReload {
|
|
hap.SkipReload = true
|
|
fw.SkipReload = true
|
|
}
|
|
|
|
gens := []configgen.Generator{hap, fw, sq, wg, ub}
|
|
|
|
results, runErr := configorch.Run(ctx, gens, only)
|
|
fmt.Print(configorch.Summarise(results))
|
|
if runErr != nil {
|
|
fmt.Fprintln(os.Stderr, "render-config aborted:", runErr)
|
|
return 1
|
|
}
|
|
return 0
|
|
}
|