v1.0 hackathon

2021-10-14 16:53:42 -06:00 · 2021-10-14 16:53:42 -06:00 · 4c77914453
parent a04c9a2ee8
commit 4c77914453
11 changed files with 834 additions and 3 deletions
--- a/.dockerignore
+++ b/.dockerignore
@ -0,0 +1,2 @@
+node_modules
+npm-debug.log
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1 @@
+node_modules/
--- a/8
+++ b/8
@ -0,0 +1,8 @@
+FROM node:bullseye
+WORKDIR /app
+COPY package*.json ./
+RUN npm install
+RUN npm ci --only=production
+COPY . .
+EXPOSE 80
+CMD [ "npm", "run", "start" ]
--- a/README.md
+++ b/README.md
@ -4,11 +4,51 @@

 ## Installation

-TODO: Write installation instructions
+### Docker
+
+Install docker and docker-compose.  Then create a project directory and pull the `docker-compose.yml` file
+
+```
+$ sudo mkdir /srv/wgapi
+$ cd /srv/wgapi
+$ sudo wget https://gitea.gf4.pw/gf4/wgapi/raw/master/docker-compose.yml
+```
+
+TODO: Fix that URL
+
+Edit the compose file according to its comments.  Then you can start the service.  
+
+```
+docker-compose up -d
+```
+
+The API will modify your wireguard configuration file.  Changes will not take effect unless the interface is restarted periodically.  One way of doing this is with a systemd timer.  
+
+TODO: Add systemd timer and instructions
+
+**NOTE:** The API is not protected by any authentication.  As it stands, anyone can connect to your API and access your wireguard network!  Be sure to protect it with authentication in a web proxy or by blocking access with a firewall.  

 ## Usage

-TODO: Write usage instructions
+Once the server is listening, there are two endpoints that clients can direct requests to.  
+
+### Add
+
+This endpoint adds a peer to the wireguard server.  
+
+TODO: Write how to use it. 
+
+### Delete
+
+This endpoint deletes a peer from the server.  
+
+TODO: Write how to use it. 
+
+## Notes
+
+After a config has been downloaded by a client, the user is free to modify it to peer with friends' hosts.  
+
+TODO: Add instructions on how to do this.  

 ## License (MIT)

--- a/docker-compose.yml
+++ b/docker-compose.yml
@ -0,0 +1,12 @@
+version: '3'
+services:
+  wgapi:
+    image: keith24/wgapi:latest
+    restart: unless-stopped
+    container_name: wgapi
+    volumes:
+      # Set this (mywg.conf) to the wireguard config you want to manage
+      - "/etc/wireguard/mywg.conf:/etc/wireguard/wg.conf"
+    ports:
+      # Change 8080 to the port you want to listen on
+      - "10.4.1.1:8080:80/tcp"
--- a/index.js
+++ b/index.js
@ -0,0 +1,167 @@
+'use strict'
+const fs = require('fs').promises
+const app = require('express')()
+const wg = require('./wireguard')
+
+// Variables
+const PORT = 80
+const IPV4_CIDR = 16
+const IPV4_NET = '10.4'
+const IPV6_CIDR = 80
+const IPV6_NET = 'fd69:1337:0:420:f4:f4'
+const WG_CONFIG_FILE = '/etc/wireguard/wg.conf'
+const TLD = 'gf4'
+const SERVERS = [
+	{
+		host: 'ksn',
+		ipv4: '10.4.0.1',
+		ipv6: 'fd69:1337:0:420:f4:f4::1',
+		pubkey: '/LrbvvmXLk2ZmU94JZua+eliqySuJ4QMHApthjvhO3s=',
+		endpoint: '172.93.54.60:52348',
+		dns: true,
+		local: true,
+	}, {
+		host: 'krow',
+		ipv4: '10.4.0.3',
+		ipv6: 'fd69:1337:0:420:f4:f4::3',
+		pubkey: '6VA79LOmlUaJSD1AiLEMCtnjMRZ7rwRrdbtNSCDtO2k=',
+		endpoint: '85.17.214.157:56333',
+		dns: true,
+	}
+]
+
+//TODO: Extract this from SERVERS with dns=true
+const DNS_SERVERS = '10.4.0.1, fd69:1337:0:420:f4:f4::1, 10.4.0.3, fd69:1337:0:420:f4:f4::3'
+
+// API
+app.get('/', async (req,res) => {
+	const privkey = req.query['del']
+	const hostname = req.query['add']
+	const requester = req.ip.replace('::ffff:','')
+	
+	// Delete a peer
+	if (privkey) {
+		console.log(`Deleting ${privkey} from ${req.ip}`)
+		res.setHeader('content-type', 'text/plain')
+		res.send(`Delete ${privkey}`)
+	}
+
+	// Add a peer
+	else if (hostname) {
+		console.log(`New peer request from ${requester}`)
+		
+		// Determine user subnet
+		let subnet
+		if (requester.includes(IPV4_NET)) subnet = requester.split('.').slice(-2,-1)[0]
+		else if (requester.includes(IPV6_NET)) subnet = requester.split(':').slice(-2,-1)[0]
+		else console.log(`Received add request from ${requester}, which does not appear to be from the network.`)
+
+		// Read wg.conf file for this user's other devices
+		const userpeers = (await fs.readFile(WG_CONFIG_FILE)).toString()
+		.split('\n\n').filter( (paragraph) => {
+			return paragraph.includes('[Peer]')
+		}).filter( (peer) => {
+			return peer.includes(`${IPV4_NET}.${subnet}`) || peer.includes(`${IPV6_NET}:${subnet}`)
+		})
+		let found_usernames = []
+		let found_ipv6s = []
+		let found_ipv4s = []
+		for (const userpeer of userpeers) {
+			for (const line of userpeer.split('\n')) {
+				if (line.includes('[Peer]')) {
+					// Check if host exists
+					if (line.includes(`# ${hostname}.`)) {
+						console.log(`Host already exists for ${hostname}`)
+						res.sendStatus(500)
+					}
+					found_usernames.push(line.split('.').slice(-2,-1)[0])
+				}
+				else if (line.includes('AllowedIPs')) {
+					const ips = line.split('=')[1].split(',')
+					found_ipv4s.push(ips.filter( (ip) => ip.includes(IPV4_NET) ))
+					found_ipv6s.push(ips.filter( (ip) => ip.includes(IPV6_NET) ))
+				}
+			}
+		}
+		// Check that all IP addresses are in correct subnet or error out
+		if (!found_ipv4s.every((found_ipv4) => 
+		found_ipv4.toString().includes(`${IPV4_NET}.${subnet}.`))) {
+                        console.log(`Found unmatching IPv4 address subnets for ${requester}: ${found_ipv4s}`)
+			res.sendStatus(500)
+		} else if (!found_ipv6s.every((found_ipv6) =>
+                found_ipv6.toString().includes(`${IPV6_NET}:${subnet}:`))) {
+                        console.log(`Found unmatching IPv6 address subnets for ${requester}: ${found_ipv6s}`)
+                        res.sendStatus(500)
+		// Check that all usernames are correct or error out
+		// https://stackoverflow.com/a/35568895
+		} else if (!found_usernames.every( (v,i,r) => v === r[0] )) {
+			console.log(`Found unmatching usernames for ${requester}: ${found_usernames.toString()}`)
+			res.sendStatus(500)
+
+		// Everything looks good!  Proceed
+		} else {
+			const username = found_usernames[0]
+			console.log(`${requester} must be ${username}`)
+
+			// Find next available host part in config
+			const used_ipv4_hosts = found_ipv4s.map((found_ipv4) => 
+				found_ipv4.toString().split('.')[3].split('/')[0])
+			const used_ipv6_hosts = found_ipv6s.map((found_ipv6) => 
+				found_ipv6.toString().split(':')[3].split('/')[0])
+			let host = 1
+			while ([...used_ipv4_hosts,...used_ipv6_hosts].includes(host.toString())) host++
+			
+			// Create IP Addresses and keys
+			const ipv4_addr = `${IPV4_NET}.${subnet}.${host}`
+			const ipv6_addr = `${IPV6_NET}:${subnet}:${host}`
+			const keypair = await wg.generateKeypair()
+			const pubkey = keypair[0]
+			const privkey = keypair[1]
+			
+			// Create [Peer] sections for each SERVERS
+			let client_peers = []
+			let server_peers = {}
+			for (const server of SERVERS) {
+				const psk = await wg.generatePSK()
+				client_peers.push(`
+[Peer] # ${server.host}.${TLD}
+PublicKey = ${server.pubkey}
+PresharedKey = ${psk}
+AllowedIPs = ${server.ipv4}/32, ${server.ipv6}/128
+Endpoint = ${server.endpoint}
+PersistentKeepAlive = 25`)
+				const server_config = `\n
+[Peer] # ${hostname}.${username}.${TLD}
+PublicKey = ${pubkey}
+PresharedKey = ${psk}
+AllowedIPs = ${ipv4_addr}/32, ${ipv6_addr}/128`
+				if (server.local) {
+					// Add server_config to wg0.conf
+					fs.appendFile(WG_CONFIG_FILE,server_config)
+				} else {
+					//TODO: Send server_config to `${server.host}.gf4`
+					console.log(`Sending config to ${server.host}.gf4`)
+				}
+			}
+	
+			//TODO: Nameserver config
+	
+			// Generate config
+			const listen_port = Math.floor(50000 + Math.random() * 10000)
+			const config = `[Interface]
+PrivateKey = ${privkey}
+Address = ${ipv4_addr}/${IPV4_CIDR}, ${ipv6_addr}/${IPV6_CIDR}
+DNS = ${DNS_SERVERS}
+ListenPort = ${listen_port}
+PostUp = resolvectl domain ${TLD} ${TLD}
+${client_peers.join('\n')}`
+	
+			// Send config to user
+			res.setHeader('content-type', 'text/plain')
+			res.send(config)
+		}
+	}
+
+	// Invalid querystring
+	else { console.log(`Invalid querystring: ${req.query}`) }
+}).listen(PORT)
--- a/package-lock.json
+++ b/package-lock.json
@ -0,0 +1,387 @@
+{
+  "name": "wgapi",
+  "version": "1.0.0",
+  "lockfileVersion": 1,
+  "requires": true,
+  "dependencies": {
+    "accepts": {
+      "version": "1.3.7",
+      "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.7.tgz",
+      "integrity": "sha512-Il80Qs2WjYlJIBNzNkK6KYqlVMTbZLXgHx2oT0pU/fjRHyEp+PEfEPY0R3WCwAGVOtauxh1hOxNgIf5bv7dQpA==",
+      "requires": {
+        "mime-types": "~2.1.24",
+        "negotiator": "0.6.2"
+      }
+    },
+    "array-flatten": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
+      "integrity": "sha1-ml9pkFGx5wczKPKgCJaLZOopVdI="
+    },
+    "body-parser": {
+      "version": "1.19.0",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.19.0.tgz",
+      "integrity": "sha512-dhEPs72UPbDnAQJ9ZKMNTP6ptJaionhP5cBb541nXPlW60Jepo9RV/a4fX4XWW9CuFNK22krhrj1+rgzifNCsw==",
+      "requires": {
+        "bytes": "3.1.0",
+        "content-type": "~1.0.4",
+        "debug": "2.6.9",
+        "depd": "~1.1.2",
+        "http-errors": "1.7.2",
+        "iconv-lite": "0.4.24",
+        "on-finished": "~2.3.0",
+        "qs": "6.7.0",
+        "raw-body": "2.4.0",
+        "type-is": "~1.6.17"
+      }
+    },
+    "bytes": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.0.tgz",
+      "integrity": "sha512-zauLjrfCG+xvoyaqLoV8bLVXXNGC4JqlxFCutSDWA6fJrTo2ZuvLYTqZ7aHBLZSMOopbzwv8f+wZcVzfVTI2Dg=="
+    },
+    "content-disposition": {
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.3.tgz",
+      "integrity": "sha512-ExO0774ikEObIAEV9kDo50o+79VCUdEB6n6lzKgGwupcVeRlhrj3qGAfwq8G6uBJjkqLrhT0qEYFcWng8z1z0g==",
+      "requires": {
+        "safe-buffer": "5.1.2"
+      }
+    },
+    "content-type": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.4.tgz",
+      "integrity": "sha512-hIP3EEPs8tB9AT1L+NUqtwOAps4mk2Zob89MWXMHjHWg9milF/j4osnnQLXBCBFBk/tvIG/tUc9mOUJiPBhPXA=="
+    },
+    "cookie": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.4.0.tgz",
+      "integrity": "sha512-+Hp8fLp57wnUSt0tY0tHEXh4voZRDnoIrZPqlo3DPiI4y9lwg/jqx+1Om94/W6ZaPDOUbnjOt/99w66zk+l1Xg=="
+    },
+    "cookie-signature": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
+      "integrity": "sha1-4wOogrNCzD7oylE6eZmXNNqzriw="
+    },
+    "debug": {
+      "version": "2.6.9",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "requires": {
+        "ms": "2.0.0"
+      }
+    },
+    "depd": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/depd/-/depd-1.1.2.tgz",
+      "integrity": "sha1-m81S4UwJd2PnSbJ0xDRu0uVgtak="
+    },
+    "destroy": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.0.4.tgz",
+      "integrity": "sha1-l4hXRCxEdJ5CBmE+N5RiBYJqvYA="
+    },
+    "ee-first": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
+      "integrity": "sha1-WQxhFWsK4vTwJVcyoViyZrxWsh0="
+    },
+    "encodeurl": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-1.0.2.tgz",
+      "integrity": "sha1-rT/0yG7C0CkyL1oCw6mmBslbP1k="
+    },
+    "escape-html": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
+      "integrity": "sha1-Aljq5NPQwJdN4cFpGI7wBR0dGYg="
+    },
+    "etag": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
+      "integrity": "sha1-Qa4u62XvpiJorr/qg6x9eSmbCIc="
+    },
+    "express": {
+      "version": "4.17.1",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.17.1.tgz",
+      "integrity": "sha512-mHJ9O79RqluphRrcw2X/GTh3k9tVv8YcoyY4Kkh4WDMUYKRZUq0h1o0w2rrrxBqM7VoeUVqgb27xlEMXTnYt4g==",
+      "requires": {
+        "accepts": "~1.3.7",
+        "array-flatten": "1.1.1",
+        "body-parser": "1.19.0",
+        "content-disposition": "0.5.3",
+        "content-type": "~1.0.4",
+        "cookie": "0.4.0",
+        "cookie-signature": "1.0.6",
+        "debug": "2.6.9",
+        "depd": "~1.1.2",
+        "encodeurl": "~1.0.2",
+        "escape-html": "~1.0.3",
+        "etag": "~1.8.1",
+        "finalhandler": "~1.1.2",
+        "fresh": "0.5.2",
+        "merge-descriptors": "1.0.1",
+        "methods": "~1.1.2",
+        "on-finished": "~2.3.0",
+        "parseurl": "~1.3.3",
+        "path-to-regexp": "0.1.7",
+        "proxy-addr": "~2.0.5",
+        "qs": "6.7.0",
+        "range-parser": "~1.2.1",
+        "safe-buffer": "5.1.2",
+        "send": "0.17.1",
+        "serve-static": "1.14.1",
+        "setprototypeof": "1.1.1",
+        "statuses": "~1.5.0",
+        "type-is": "~1.6.18",
+        "utils-merge": "1.0.1",
+        "vary": "~1.1.2"
+      }
+    },
+    "finalhandler": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.1.2.tgz",
+      "integrity": "sha512-aAWcW57uxVNrQZqFXjITpW3sIUQmHGG3qSb9mUah9MgMC4NeWhNOlNjXEYq3HjRAvL6arUviZGGJsBg6z0zsWA==",
+      "requires": {
+        "debug": "2.6.9",
+        "encodeurl": "~1.0.2",
+        "escape-html": "~1.0.3",
+        "on-finished": "~2.3.0",
+        "parseurl": "~1.3.3",
+        "statuses": "~1.5.0",
+        "unpipe": "~1.0.0"
+      }
+    },
+    "forwarded": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
+      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow=="
+    },
+    "fresh": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
+      "integrity": "sha1-PYyt2Q2XZWn6g1qx+OSyOhBWBac="
+    },
+    "http-errors": {
+      "version": "1.7.2",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.7.2.tgz",
+      "integrity": "sha512-uUQBt3H/cSIVfch6i1EuPNy/YsRSOUBXTVfZ+yR7Zjez3qjBz6i9+i4zjNaoqcoFVI4lQJ5plg63TvGfRSDCRg==",
+      "requires": {
+        "depd": "~1.1.2",
+        "inherits": "2.0.3",
+        "setprototypeof": "1.1.1",
+        "statuses": ">= 1.5.0 < 2",
+        "toidentifier": "1.0.0"
+      }
+    },
+    "iconv-lite": {
+      "version": "0.4.24",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
+      "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
+      "requires": {
+        "safer-buffer": ">= 2.1.2 < 3"
+      }
+    },
+    "inherits": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.3.tgz",
+      "integrity": "sha1-Yzwsg+PaQqUC9SRmAiSA9CCCYd4="
+    },
+    "ipaddr.js": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
+      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g=="
+    },
+    "lodash.mergewith": {
+      "version": "4.6.2",
+      "resolved": "https://registry.npmjs.org/lodash.mergewith/-/lodash.mergewith-4.6.2.tgz",
+      "integrity": "sha512-GK3g5RPZWTRSeLSpgP8Xhra+pnjBC56q9FZYe1d5RN3TJ35dbkGy3YqBSMbyCrlbi+CM9Z3Jk5yTL7RCsqboyQ=="
+    },
+    "media-typer": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
+      "integrity": "sha1-hxDXrwqmJvj/+hzgAWhUUmMlV0g="
+    },
+    "merge-descriptors": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.1.tgz",
+      "integrity": "sha1-sAqqVW3YtEVoFQ7J0blT8/kMu2E="
+    },
+    "methods": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
+      "integrity": "sha1-VSmk1nZUE07cxSZmVoNbD4Ua/O4="
+    },
+    "mime": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz",
+      "integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg=="
+    },
+    "mime-db": {
+      "version": "1.50.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.50.0.tgz",
+      "integrity": "sha512-9tMZCDlYHqeERXEHO9f/hKfNXhre5dK2eE/krIvUjZbS2KPcqGDfNShIWS1uW9XOTKQKqK6qbeOci18rbfW77A=="
+    },
+    "mime-types": {
+      "version": "2.1.33",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.33.tgz",
+      "integrity": "sha512-plLElXp7pRDd0bNZHw+nMd52vRYjLwQjygaNg7ddJ2uJtTlmnTCjWuPKxVu6//AdaRuME84SvLW91sIkBqGT0g==",
+      "requires": {
+        "mime-db": "1.50.0"
+      }
+    },
+    "ms": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g="
+    },
+    "negotiator": {
+      "version": "0.6.2",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.2.tgz",
+      "integrity": "sha512-hZXc7K2e+PgeI1eDBe/10Ard4ekbfrrqG8Ep+8Jmf4JID2bNg7NvCPOZN+kfF574pFQI7mum2AUqDidoKqcTOw=="
+    },
+    "on-finished": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.3.0.tgz",
+      "integrity": "sha1-IPEzZIGwg811M3mSoWlxqi2QaUc=",
+      "requires": {
+        "ee-first": "1.1.1"
+      }
+    },
+    "parseurl": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
+      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ=="
+    },
+    "path-to-regexp": {
+      "version": "0.1.7",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.7.tgz",
+      "integrity": "sha1-32BBeABfUi8V60SQ5yR6G/qmf4w="
+    },
+    "proxy-addr": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
+      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "requires": {
+        "forwarded": "0.2.0",
+        "ipaddr.js": "1.9.1"
+      }
+    },
+    "qs": {
+      "version": "6.7.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.7.0.tgz",
+      "integrity": "sha512-VCdBRNFTX1fyE7Nb6FYoURo/SPe62QCaAyzJvUjwRaIsc+NePBEniHlvxFmmX56+HZphIGtV0XeCirBtpDrTyQ=="
+    },
+    "range-parser": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
+      "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg=="
+    },
+    "raw-body": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.4.0.tgz",
+      "integrity": "sha512-4Oz8DUIwdvoa5qMJelxipzi/iJIi40O5cGV1wNYp5hvZP8ZN0T+jiNkL0QepXs+EsQ9XJ8ipEDoiH70ySUJP3Q==",
+      "requires": {
+        "bytes": "3.1.0",
+        "http-errors": "1.7.2",
+        "iconv-lite": "0.4.24",
+        "unpipe": "1.0.0"
+      }
+    },
+    "safe-buffer": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
+    },
+    "safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="
+    },
+    "send": {
+      "version": "0.17.1",
+      "resolved": "https://registry.npmjs.org/send/-/send-0.17.1.tgz",
+      "integrity": "sha512-BsVKsiGcQMFwT8UxypobUKyv7irCNRHk1T0G680vk88yf6LBByGcZJOTJCrTP2xVN6yI+XjPJcNuE3V4fT9sAg==",
+      "requires": {
+        "debug": "2.6.9",
+        "depd": "~1.1.2",
+        "destroy": "~1.0.4",
+        "encodeurl": "~1.0.2",
+        "escape-html": "~1.0.3",
+        "etag": "~1.8.1",
+        "fresh": "0.5.2",
+        "http-errors": "~1.7.2",
+        "mime": "1.6.0",
+        "ms": "2.1.1",
+        "on-finished": "~2.3.0",
+        "range-parser": "~1.2.1",
+        "statuses": "~1.5.0"
+      },
+      "dependencies": {
+        "ms": {
+          "version": "2.1.1",
+          "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.1.tgz",
+          "integrity": "sha512-tgp+dl5cGk28utYktBsrFqA7HKgrhgPsg6Z/EfhWI4gl1Hwq8B/GmY/0oXZ6nF8hDVesS/FpnYaD/kOWhYQvyg=="
+        }
+      }
+    },
+    "serve-static": {
+      "version": "1.14.1",
+      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.14.1.tgz",
+      "integrity": "sha512-JMrvUwE54emCYWlTI+hGrGv5I8dEwmco/00EvkzIIsR7MqrHonbD9pO2MOfFnpFntl7ecpZs+3mW+XbQZu9QCg==",
+      "requires": {
+        "encodeurl": "~1.0.2",
+        "escape-html": "~1.0.3",
+        "parseurl": "~1.3.3",
+        "send": "0.17.1"
+      }
+    },
+    "setprototypeof": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.1.1.tgz",
+      "integrity": "sha512-JvdAWfbXeIGaZ9cILp38HntZSFSo3mWg6xGcJJsd+d4aRMOqauag1C63dJfDw7OaMYwEbHMOxEZ1lqVRYP2OAw=="
+    },
+    "statuses": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-1.5.0.tgz",
+      "integrity": "sha1-Fhx9rBd2Wf2YEfQ3cfqZOBR4Yow="
+    },
+    "toidentifier": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.0.tgz",
+      "integrity": "sha512-yaOH/Pk/VEhBWWTlhI+qXxDFXlejDGcQipMlyxda9nthulaxLZUNcUqFxokp0vcYnvteJln5FNQDRrxj3YcbVw=="
+    },
+    "type-is": {
+      "version": "1.6.18",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
+      "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==",
+      "requires": {
+        "media-typer": "0.3.0",
+        "mime-types": "~2.1.24"
+      }
+    },
+    "unpipe": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
+      "integrity": "sha1-sr9O6FFKrmFltIF4KdIbLvSZBOw="
+    },
+    "utils-merge": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
+      "integrity": "sha1-n5VxD1CiZ5R7LMwSR0HBAoQn5xM="
+    },
+    "vary": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
+      "integrity": "sha1-IpnwLG3tMNSllhsLn3RSShj2NPw="
+    },
+    "wireguard-tools": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/wireguard-tools/-/wireguard-tools-0.1.0.tgz",
+      "integrity": "sha512-oBnnSB6wXGEAB1ZVPfbfpX8WlHNw7wv45r13ILX73felVnrGpMxMjFcKGAsMeRfBOGzXcW0LgAWe+T53dRcI+g==",
+      "requires": {
+        "lodash.mergewith": "^4.6.2"
+      }
+    }
+  }
+}
--- a/package.json
+++ b/package.json
@ -4,8 +4,13 @@
  "description": "HTTP API to add and remove wireguard configs",
  "main": "index.js",
  "scripts": {
+    "start": "node index.js",
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "author": "Keith Irwin <ki9@gf4.pw> (ki9.gf4.pw)",
-  "license": "MIT"
+  "license": "MIT",
+  "dependencies": {
+    "express": "^4.17.1",
+    "wireguard-tools": "^0.1.0"
+  }
 }
--- a/systemd/restart-wg-quick@.service
+++ b/systemd/restart-wg-quick@.service
@ -0,0 +1,10 @@
+[Unit]
+Description=Restart a wireguard service
+Requires=wg-quick@%i
+
+[Service]
+Type=oneshot
+ExecStart=systemctl restart wg-quick@%i
+
+[Install]
+WantedBy=multi-user.target
--- a/systemd/restart-wg-quick@.timer
+++ b/systemd/restart-wg-quick@.timer
@ -0,0 +1,10 @@
+[Unit]
+Description=Restart wg-quick@%i every 10 minutes
+Requires=wg-quick@%i.service
+
+[Timer]
+OnCalendar=OnCalendar=*:0/10
+Unit=restart-wg-quick@%i.service
+
+[Install]
+WantedBy=timers.target
--- a/wireguard.js
+++ b/wireguard.js
@ -0,0 +1,189 @@
+/*! SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
+ */
+'use strict'
+
+const crypto = require('crypto')
+
+function gf(init) {
+	var r = new Float64Array(16);
+	if (init) {
+		for (var i = 0; i < init.length; ++i)
+			r[i] = init[i];
+	}
+	return r;
+}
+
+function pack(o, n) {
+	var b, m = gf(), t = gf();
+	for (var i = 0; i < 16; ++i)
+		t[i] = n[i];
+	carry(t);
+	carry(t);
+	carry(t);
+	for (var j = 0; j < 2; ++j) {
+		m[0] = t[0] - 0xffed;
+		for (var i = 1; i < 15; ++i) {
+			m[i] = t[i] - 0xffff - ((m[i - 1] >> 16) & 1);
+			m[i - 1] &= 0xffff;
+		}
+		m[15] = t[15] - 0x7fff - ((m[14] >> 16) & 1);
+		b = (m[15] >> 16) & 1;
+		m[14] &= 0xffff;
+		cswap(t, m, 1 - b);
+	}
+	for (var i = 0; i < 16; ++i) {
+		o[2 * i] = t[i] & 0xff;
+		o[2 * i + 1] = t[i] >> 8;
+	}
+}
+
+function carry(o) {
+	var c;
+	for (var i = 0; i < 16; ++i) {
+		o[(i + 1) % 16] += (i < 15 ? 1 : 38) * Math.floor(o[i] / 65536);
+		o[i] &= 0xffff;
+	}
+}
+
+function cswap(p, q, b) {
+	var t, c = ~(b - 1);
+	for (var i = 0; i < 16; ++i) {
+		t = c & (p[i] ^ q[i]);
+		p[i] ^= t;
+		q[i] ^= t;
+	}
+}
+
+function add(o, a, b) {
+	for (var i = 0; i < 16; ++i)
+		o[i] = (a[i] + b[i]) | 0;
+}
+
+function subtract(o, a, b) {
+	for (var i = 0; i < 16; ++i)
+		o[i] = (a[i] - b[i]) | 0;
+}
+
+function multmod(o, a, b) {
+	var t = new Float64Array(31);
+	for (var i = 0; i < 16; ++i) {
+		for (var j = 0; j < 16; ++j)
+			t[i + j] += a[i] * b[j];
+	}
+	for (var i = 0; i < 15; ++i)
+		t[i] += 38 * t[i + 16];
+	for (var i = 0; i < 16; ++i)
+		o[i] = t[i];
+	carry(o);
+	carry(o);
+}
+
+function invert(o, i) {
+	var c = gf();
+	for (var a = 0; a < 16; ++a)
+		c[a] = i[a];
+	for (var a = 253; a >= 0; --a) {
+		multmod(c, c, c);
+		if (a !== 2 && a !== 4)
+			multmod(c, c, i);
+	}
+	for (var a = 0; a < 16; ++a)
+		o[a] = c[a];
+}
+
+function clamp(z) {
+	z[31] = (z[31] & 127) | 64;
+	z[0] &= 248;
+}
+
+function generatePublicKey(privateKey) {
+	var r, z = new Uint8Array(32);
+	var a = gf([1]),
+		b = gf([9]),
+		c = gf(),
+		d = gf([1]),
+		e = gf(),
+		f = gf(),
+		_121665 = gf([0xdb41, 1]),
+		_9 = gf([9]);
+	for (var i = 0; i < 32; ++i)
+		z[i] = privateKey[i];
+	clamp(z);
+	for (var i = 254; i >= 0; --i) {
+		r = (z[i >>> 3] >>> (i & 7)) & 1;
+		cswap(a, b, r);
+		cswap(c, d, r);
+		add(e, a, c);
+		subtract(a, a, c);
+		add(c, b, d);
+		subtract(b, b, d);
+		multmod(d, e, e);
+		multmod(f, a, a);
+		multmod(a, c, a);
+		multmod(c, b, e);
+		add(e, a, c);
+		subtract(a, a, c);
+		multmod(b, a, a);
+		subtract(c, d, f);
+		multmod(a, c, _121665);
+		add(a, a, d);
+		multmod(c, c, a);
+		multmod(a, d, f);
+		multmod(d, b, _9);
+		multmod(b, e, e);
+		cswap(a, b, r);
+		cswap(c, d, r);
+	}
+	invert(c, c);
+	multmod(a, a, c);
+	pack(z, a);
+	return z;
+}
+
+function generatePresharedKey() {
+	var privateKey = new Uint8Array(32);
+	crypto.webcrypto.getRandomValues(privateKey);
+	return privateKey;
+}
+
+function generatePrivateKey() {
+	var privateKey = generatePresharedKey();
+	clamp(privateKey);
+	return privateKey;
+}
+
+function encodeBase64(dest, src) {
+	var input = Uint8Array.from([(src[0] >> 2) & 63, ((src[0] << 4) | (src[1] >> 4)) & 63, ((src[1] << 2) | (src[2] >> 6)) & 63, src[2] & 63]);
+	for (var i = 0; i < 4; ++i)
+		dest[i] = input[i] + 65 +
+		(((25 - input[i]) >> 8) & 6) -
+		(((51 - input[i]) >> 8) & 75) -
+		(((61 - input[i]) >> 8) & 15) +
+		(((62 - input[i]) >> 8) & 3);
+}
+
+function keyToBase64(key) {
+	var i, base64 = new Uint8Array(44);
+	for (i = 0; i < 32 / 3; ++i)
+		encodeBase64(base64.subarray(i * 4), key.subarray(i * 3));
+	encodeBase64(base64.subarray(i * 4), Uint8Array.from([key[i * 3 + 0], key[i * 3 + 1], 0]));
+	base64[43] = 61;
+	return String.fromCharCode.apply(null, base64);
+}
+
+module.exports = {
+	generateKeypair: function() {
+		var privateKey = generatePrivateKey();
+		var publicKey = generatePublicKey(privateKey);
+		return [
+			keyToBase64(publicKey),
+			keyToBase64(privateKey),
+		];
+	},
+	generatePSK: async () => {
+		return keyToBase64(await generatePresharedKey())
+	},
+};
+