gf4
/
wagon
2
0
Fork 0
Code Issues 3 Pull Requests Projects Releases Wiki Activity

feat: ✨ Custom AllowedIPs and PostUp/PostDown lines

master
Keith Irwin 2024-01-11 15:44:54 -07:00
parent 3edf1c0c6e
commit f0b2b92219
Signed by: ki9
GPG Key ID: DF773B3F4A88DA86
11 changed files with 38 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
INSTALL.md
View File

@ -476,8 +476,8 @@ Configure the `docker-compose.override.yml` file however you like. Here you can
The `/etc/wagon/servers` file is a list of servers on the `/16` network. For now, just set our single server with the correct variables.
```tsv
# host ipv4 ipv6 pubkey wg-endpoint admin-endpoint secret
hn 10.99.0.1 XXXX XXXXX= 1.2.3.4:51820 https://wagon-admin.hn.mynet XXXXXX
# host ipv4 ipv6 pubkey allowed-ips wg-endpoint admin-endpoint secret
hn 10.99.0.1 XXXX XXXXX= 10.99.0.1/32 1.2.3.4:51820 https://wagon-admin.hn.mynet XXXXXX
```
We're just gonna leave `XXXX` as a placeholder for ipv6 since we aren't using it. But do set the pubkey to hn's wireguard public key from above. Set admin-endpoint to whatever you want right now; this is actually used for server-to-server communication, not administration. Same thing for secret: leave it as `XXXXXX` or generate something random; in any case it isn't used unless your network has multiple servers.
@ -500,6 +500,7 @@ SSL_CA_PASS='XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
DNS_KEY='hmac-sha512:wagon:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=='
DNS_MASTER='10.99.0.1'
DNS_TTL='86400'
INTERFACE_EXTRA_LINES=""
```
This file should be mostly self-explanitory. "SSL_CA_PASS" is the CA key passphrase created in the last section. The "DNS_KEY" string should be created from the `/etc/bind/keys/wagon.keys` file, which looks like this:
@ -511,6 +512,8 @@ key "wagon" {
};
```
`INTERFACE_EXTRA_LINES` will be appeneded to new users' wireguard configurations in the `[Interface]` section. Use this to add extra `PostUp` and `PostDown` parameters, or to set a default MTU.
Wagon comes as 4 services:
1. An api users can access to add/delete hosts

12
back/lib/admin/peer/add
View File

@ -94,14 +94,14 @@ fi
# Do the wireguard and tell the user
server_blocks=''
while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey server_endpoint server_url server_secret; do
while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey server_allowedips server_endpoint server_url server_secret; do
[[ ${server_hostname:0:1} = \# ]] && continue
server_psk="$(/usr/bin/wg genpsk)"
# Local server
if [ "${server_hostname}" == "${LOCAL_SERVER}" ]; then
server_blocks="${server_blocks}\n[Peer] # ${server_hostname}.${TLD}\nPublicKey=${server_pubkey}\nPresharedKey=${server_psk}\nAllowedIPs=${server_ipv4}/${IPV4_NET#*/},${server_ipv6}/${IPV6_NET#*/}\nEndpoint=${server_endpoint}\n"
server_blocks="${server_blocks}\n[Peer] # ${server_hostname:?}.${TLD:?}\nPublicKey=${server_pubkey:?}\nPresharedKey=${server_psk:?}\nAllowedIPs=${server_allowedips:?}\nEndpoint=${server_endpoint:?}\n"
# Add new user to local wireguard
if /usr/lib/wagon/wg_peer_add "${pubkey}" "${server_psk}" "${ipv4}/32,${ipv6}/128"; then
if /usr/lib/wagon/wg_peer_add "${pubkey:?}" "${server_psk:?}" "${server_allowedips:?}"; then
printf 'Added %s to local wireguard server.\n' "${domain}" >&2
else
printf 'ERROR! Failed to add %s to local wireguard server!\n' "${domain}" >&2
@ -109,14 +109,14 @@ while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey se
fi
# Remote server
else
server_blocks="${server_blocks}\n[Peer] # ${server_hostname}.${TLD}\nPublicKey=${server_pubkey}\nPresharedKey=${server_psk}\nAllowedIPs=${server_ipv4}/32,${server_ipv6}/128\nEndpoint=${server_endpoint}\n"
server_blocks="${server_blocks}\n[Peer] # ${server_hostname:?}.${TLD:?}\nPublicKey=${server_pubkey:?}\nPresharedKey=${server_psk:?}\nAllowedIPs=${server_allowedips:?}\nEndpoint=${server_endpoint:?}\n"
# Send new user config to federated server
if /usr/lib/wagon/fed_peer_add "${server_url}" "${server_secret}" "${pubkey}" "${server_psk}" "${ipv4}/32,${ipv6}/128" "${server_secret}"; then
if /usr/lib/wagon/fed_peer_add "${server_url:?}" "${server_secret:?}" "${pubkey:?}" "${server_psk:?}" "${server_allowedips:?}" "${server_secret:?}"; then
printf 'Sent %s to remote wireguard server %s.\n' "${domain}" "${server_hostname}" >&2
else
printf 'ERROR! Failed to send %s to remote wireguard server %s!\n' "${domain}" "${server_hostname}" >&2
fi
fi
done </etc/wagon/servers
wg_config="[Interface] # ${hostname}.${username}.${TLD}\nPrivateKey=${privkey:?}\n#PublicKey=${pubkey:?}\nAddress=${address:?}\nDNS=${IPV4_HUB},${IPV6_HUB}\n${server_blocks:?}"
wg_config="[Interface] # ${hostname:?}.${username:?}.${TLD:?}\nPrivateKey=${privkey:?}\n#PublicKey=${pubkey:?}\nAddress=${address:?}\nDNS=${IPV4_HUB},${IPV6_HUB}\n${server_blocks:?}"
<<<"${wg_config}" /usr/lib/wagon/http_res 202

6
back/lib/admin/peer/del
View File

@ -62,7 +62,7 @@ username="$(<<<"${domain}" cut -d'.' -f2)"
for_server_do() {
[[ ${server_hostname:0:1} = \# ]] && return # Ignore comments
server_hostname="${1}"; server_ipv4="${2}"; server_ipv6="${3}"; server_pubkey="${4}"
server_endpoint="${5}"; server_url="${6}"; server_secret="${7}"
server_allowedips="${5}"; server_endpoint="${6}"; server_url="${7}"; server_secret="${8}"
if [ "${server_hostname}" == "${LOCAL_SERVER}" ]; then
# Local server
if /usr/lib/wagon/wg_peer_del "${pubkey}"; then
@ -81,8 +81,8 @@ for_server_do() {
/usr/lib/wagon/http_res 500; exit
fi
fi
}; while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey server_endpoint server_url server_secret
do for_server_do "${server_hostname}" "${server_ipv4}" "${server_ipv6}" "${server_pubkey}" "${server_endpoint}" "${server_url}" "${server_secret}" &
}; while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey server_allowedips server_endpoint server_url server_secret
do for_server_do "${server_hostname:?}" "${server_ipv4:?}" "${server_ipv6:?}" "${server_pubkey:?}" "${server_allowedips:?}" "${server_endpoint:?}" "${server_url:?}" "${server_secret:?}" &
done </etc/wagon/servers &
# Update nameserver

12
back/lib/admin/user/add
View File

@ -85,14 +85,14 @@ fi
# Do the wireguard and tell the user
server_blocks=''
while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey server_endpoint server_url server_secret; do
while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey server_allowedips server_endpoint server_url server_secret; do
[[ ${server_hostname:0:1} = \# ]] && continue
server_psk="$(/usr/bin/wg genpsk)"
# Local server
if [ "${server_hostname}" == "${LOCAL_SERVER}" ]; then
server_blocks="${server_blocks}\n[Peer] # ${server_hostname}.${TLD}\nPublicKey=${server_pubkey}\nPresharedKey=${server_psk}\nAllowedIPs=${server_ipv4}/${IPV4_NET#*/},${server_ipv6}/${IPV6_NET#*/}\nEndpoint=${server_endpoint}\n"
server_blocks="${server_blocks}\n[Peer] # ${server_hostname}.${TLD:?}\nPublicKey=${server_pubkey:?}\nPresharedKey=${server_psk:?}\nAllowedIPs=${server_allowedips:?}\nEndpoint=${server_endpoint:?}\n"
# Add new user to local wireguard
if /usr/lib/wagon/wg_peer_add "${pubkey}" "${server_psk}" "${ipv4}/32,${ipv6}/128"; then
if /usr/lib/wagon/wg_peer_add "${pubkey:?}" "${server_psk:?}" "${server_allowedips:?}"; then
printf 'Added %s to local wireguard server.\n' "${domain}" >&2
else
printf 'ERROR! Failed to add %s to local wireguard server!\n' "${domain}" >&2
@ -101,14 +101,14 @@ while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey se
fi
# Remote server
else
server_blocks="${server_blocks}\n[Peer] # ${server_hostname}.${TLD}\nPublicKey=${server_pubkey}\nPresharedKey=${server_psk}\nAllowedIPs=${server_ipv4}/32,${server_ipv6}/128\nEndpoint=${server_endpoint}\n"
server_blocks="${server_blocks}\n[Peer] # ${server_hostname:?}.${TLD:?}\nPublicKey=${server_pubkey:?}\nPresharedKey=${server_psk:?}\nAllowedIPs=${server_allowedips:?}\nEndpoint=${server_endpoint:?}\n"
# Send new user config to federated server
if /usr/lib/wagon/fed_peer_add "${server_url}" "${server_secret}" "${pubkey}" "${server_psk}" "${ipv4}/32,${ipv6}/128" "${server_secret}"; then
if /usr/lib/wagon/fed_peer_add "${server_url:?}" "${server_secret:?}" "${pubkey:?}" "${server_psk:?}" "${server_allowedips:?}" "${server_secret:?}"; then
printf 'Sent %s to remote wireguard server %s.\n' "${domain}" "${server_hostname}" >&2
else
printf 'ERROR! Failed to send %s to remote wireguard server %s!\n' "${domain}" "${server_hostname}" >&2
fi
fi
done </etc/wagon/servers
wg_config="[Interface] # ${hostname}.${username}.${TLD}\nPrivateKey=${privkey:?}\n#PublicKey=${pubkey:?}\nAddress=${address:?}\nDNS=${IPV4_HUB},${IPV6_HUB}\n${server_blocks:?}"
wg_config="[Interface] # ${hostname:?}.${username:?}.${TLD:?}\nPrivateKey=${privkey:?}\n#PublicKey=${pubkey:?}\nAddress=${address:?}\nDNS=${IPV4_HUB},${IPV6_HUB}\n${server_blocks:?}"
<<<"${wg_config}" /usr/lib/wagon/http_res 202

4
back/lib/admin/user/del
View File

@ -80,8 +80,8 @@ delete_peer() {
printf 'Deleting peer %s\n' "${domain}" >&2
# Remove peer from wireguard
while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey server_endpoint server_url server_secret
do for_server_do "${server_hostname}" "${server_ipv4}" "${server_ipv6}" "${server_pubkey}" "${server_endpoint}" "${server_url}" "${server_secret}" &
while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey server_allowedips server_endpoint server_url server_secret
do for_server_do "${server_hostname:?}" "${server_ipv4:?}" "${server_ipv6:?}" "${server_pubkey:?}" "${server_allowedips:?}" "${server_endpoint:?}" "${server_url:?}" "${server_secret:?}" &
done </etc/wagon/servers &
# Remove peer from nameserver

12
back/lib/dashboard/peer/add
View File

@ -104,14 +104,14 @@ fi
# Do the wireguard and tell the user
server_blocks=''
while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey server_endpoint server_url server_secret; do
while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey server_allowedips server_endpoint server_url server_secret; do
[[ ${server_hostname:0:1} = \# ]] && continue
server_psk="$(/usr/bin/wg genpsk)"
# Local server
if [ "${server_hostname}" == "${LOCAL_SERVER}" ]; then
server_blocks="${server_blocks}\n[Peer] # ${server_hostname}.${TLD}\nPublicKey=${server_pubkey}\nPresharedKey=${server_psk}\nAllowedIPs=${server_ipv4}/${IPV4_NET#*/},${server_ipv6}/${IPV6_NET#*/}\nEndpoint=${server_endpoint}\n"
server_blocks="${server_blocks}\n[Peer] # ${server_hostname:?}.${TLD:?}\nPublicKey=${server_pubkey:?}\nPresharedKey=${server_psk:?}\nAllowedIPs=${server_allowedips:?}\nEndpoint=${server_endpoint:?}\n"
# Add new user to local wireguard
if /usr/lib/wagon/wg_peer_add "${pubkey}" "${server_psk}" "${ipv4}/32,${ipv6}/128"; then
if /usr/lib/wagon/wg_peer_add "${pubkey:?}" "${server_psk:?}" "${server_allowedips:?}"; then
printf 'Added %s to local wireguard server.\n' "${domain}" >&2
else
printf 'ERROR! Failed to add %s to local wireguard server!\n' "${domain}" >&2
@ -119,14 +119,14 @@ while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey se
fi
# Remote server
else
server_blocks="${server_blocks}\n[Peer] # ${server_hostname}.${TLD}\nPublicKey=${server_pubkey}\nPresharedKey=${server_psk}\nAllowedIPs=${server_ipv4}/32,${server_ipv6}/128\nEndpoint=${server_endpoint}\n"
server_blocks="${server_blocks}\n[Peer] # ${server_hostname:?}.${TLD:?}\nPublicKey=${server_pubkey:?}\nPresharedKey=${server_psk:?}\nAllowedIPs=${server_allowedips:?}\nEndpoint=${server_endpoint:?}\n"
# Send new user config to federated server
if /usr/lib/wagon/fed_peer_add "${server_url}" "${server_secret}" "${pubkey}" "${server_psk}" "${ipv4}/32,${ipv6}/128" "${server_secret}"; then
if /usr/lib/wagon/fed_peer_add "${server_url:?}" "${server_secret:?}" "${pubkey:?}" "${server_psk:?}" "${server_allowedips:?}" "${server_secret:?}"; then
printf 'Sent %s to remote wireguard server %s.\n' "${domain}" "${server_hostname}" >&2
else
printf 'ERROR! Failed to send %s to remote wireguard server %s!\n' "${domain}" "${server_hostname}" >&2
fi
fi
done </etc/wagon/servers
wg_config="[Interface] # ${hostname}.${username}.${TLD}\nPrivateKey=${privkey:?}\n#PublicKey=${pubkey:?}\nAddress=${address:?}\nDNS=${IPV4_HUB},${IPV6_HUB}\nPostUp = ip route delete ${IPV4_NET} dev %i; ip route delete ${IPV6_NET} dev %i\nPostUp = ip route add ${IPV4_HUB}/32 dev %i; ip route add ${IPV6_HUB}/128 dev %i\nPostUp = ip route add ${IPV4_NET} via ${IPV4_HUB} dev %i; ip route add ${IPV6_NET} via ${IPV6_HUB} dev %i\nPostUp = resolvectl dns %i ${IPV4_HUB} ${IPV6_HUB}\nPostUp = resolvectl domain %i '~${TLD}' '${IPV4_NET}~4.10.in-addr.arpa' '${IPV6_NET}~4.f.0.0.4.f.0.0.0.2.4.0.0.0.0.0.7.3.3.1.9.6.d.f.ip6.arpa'${server_blocks:?}"
wg_config="[Interface] # ${hostname:?}.${username:?}.${TLD:?}\nPrivateKey=${privkey:?}\n#PublicKey=${pubkey:?}\nAddress=${address:?}\nDNS=${IPV4_HUB},${IPV6_HUB}\nPostUp = resolvectl dns %i ${IPV4_HUB} ${IPV6_HUB}\nPostUp = resolvectl domain %i '~${TLD}' '${IPV4_NET}~4.10.in-addr.arpa' '${IPV6_NET}~4.f.0.0.4.f.0.0.0.2.4.0.0.0.0.0.7.3.3.1.9.6.d.f.ip6.arpa'${INTERFACE_EXTRA_LINES}${server_blocks:?}"
<<<"${wg_config}" /usr/lib/wagon/http_res 202

6
back/lib/dashboard/peer/del
View File

@ -62,7 +62,7 @@ username="$(<<<"${domain}" cut -d'.' -f2)"
for_server_do() {
[[ ${server_hostname:0:1} = \# ]] && return # Ignore comments
server_hostname="${1}"; server_ipv4="${2}"; server_ipv6="${3}"; server_pubkey="${4}"
server_endpoint="${5}"; server_url="${6}"; server_secret="${7}"
server_allowedips="${5}"; server_endpoint="${6}"; server_url="${7}"; server_secret="${8}"
if [ "${server_hostname}" == "${LOCAL_SERVER}" ]; then
# Local server
if /usr/lib/wagon/wg_peer_del "${pubkey}"; then
@ -81,8 +81,8 @@ for_server_do() {
/usr/lib/wagon/http_res 500; exit
fi
fi
}; while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey server_endpoint server_url server_secret
do for_server_do "${server_hostname}" "${server_ipv4}" "${server_ipv6}" "${server_pubkey}" "${server_endpoint}" "${server_url}" "${server_secret}" &
}; while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey server_alloweips server_endpoint server_url server_secret
do for_server_do "${server_hostname:?}" "${server_ipv4:?}" "${server_ipv6:?}" "${server_pubkey:?}" "${server_allowedips:?}" "${server_endpoint:?}" "${server_url:?}" "${server_secret:?}" &
done </etc/wagon/servers &
# Update nameserver

2
back/lib/fed/peer/add
View File

@ -18,7 +18,7 @@ if ! sed '/^#/d' /etc/wagon/servers | cut -f2,3 | grep -qw "${ip}"; then
fi
# Check server secret
local_secret="$(grep -w "^${LOCAL_SERVER}" /etc/wagon/servers | cut -f7)"
local_secret="$(grep -w "^${LOCAL_SERVER}" /etc/wagon/servers | cut -f8)"
if ! [ "${local_secret}" == "${secret}" ]; then
printf "ERROR! Federated server %s provided a secret, %s, that doesn't match the one in our servers file, %s\n" "${ip}" "${secret}" "${local_secret}" >&2
/usr/lib/wagon/http_res 403; exit

2
back/lib/fed/peer/del
View File

@ -16,7 +16,7 @@ if ! sed '/^#/d' /etc/wagon/servers | cut -f2,3 | grep -qw "${ip}"; then
fi
# Check server secret
local_secret="$(grep -w "^${LOCAL_SERVER}" /etc/wagon/servers | cut -f7)"
local_secret="$(grep -w "^${LOCAL_SERVER}" /etc/wagon/servers | cut -f8)"
if ! [ "${local_secret}" == "${secret}" ]; then
printf "ERROR! Federated server %s provided a secret, %s, that doesn't match the one in our servers file, %s\n" "${ip}" "${secret}" "${local_secret}" >&2
/usr/lib/wagon/http_res 403; exit

3
etc.sample/config
View File

@ -8,8 +8,9 @@ SSL_CONFIG_DIR="/etc/ssl/private/${TLD}"
SSL_CA_CERT="${SSL_CONFIG_DIR}/_ca/cert.pem"
SSL_CA_KEY="${SSL_CONFIG_DIR}/_ca/key.pem"
SSL_ORG='My Org'
SSL_DAYS='3650'
SSL_DAYS='365'
SSL_CA_PASS='XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
DNS_KEY='hmac-sha512:wagon:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXxw=='
DNS_MASTER='10.3.0.1'
DNS_TTL='86400'
INTERFACE_EXTRA_LINES=""

6
etc.sample/servers
View File

@ -1,3 +1,3 @@
# host ipv4 ipv6 pubkey wg-endpoint admin-endpoint secret
myhost1 10.3.0.1 fd69:1337:0:420:f4:f3:0:1 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX= 123.123.123.123:51820 https://wagon-admin.myhost2.tld XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
myhost2 10.3.0.2 fd69:1337:0:420:f4:f3:0:2 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX= 234.234.234.234:51820 https://wagon-admin.myhost2.tld XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
# host ipv4 ipv6 pubkey allowed-ips wg-endpoint admin-endpoint secret
myhost1 10.3.0.1 fd69:1337:0:420:f4:f3:0:1 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX= 10.3.0.1/32,fd69:1337:0:420:f4:f3:0:1/128,10.3.0.0/16,fd69:1337:0:420:f4:f3::/96 123.123.123.123:51820 https://wagon-admin.myhost2.tld XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
myhost2 10.3.0.2 fd69:1337:0:420:f4:f3:0:2 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX= 10.3.0.2/32,fd69:1337:0:420:f4:f3:0:2/128 234.234.234.234:51820 https://wagon-admin.myhost2.tld XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX