diff --git a/INSTALL.md b/INSTALL.md index 764d947..b72a6b7 100644 --- a/INSTALL.md +++ b/INSTALL.md @@ -476,8 +476,8 @@ Configure the `docker-compose.override.yml` file however you like. Here you can The `/etc/wagon/servers` file is a list of servers on the `/16` network. For now, just set our single server with the correct variables. ```tsv -# host ipv4 ipv6 pubkey wg-endpoint admin-endpoint secret - hn 10.99.0.1 XXXX XXXXX= 1.2.3.4:51820 https://wagon-admin.hn.mynet XXXXXX +# host ipv4 ipv6 pubkey allowed-ips wg-endpoint admin-endpoint secret + hn 10.99.0.1 XXXX XXXXX= 10.99.0.1/32 1.2.3.4:51820 https://wagon-admin.hn.mynet XXXXXX ``` We're just gonna leave `XXXX` as a placeholder for ipv6 since we aren't using it. But do set the pubkey to hn's wireguard public key from above. Set admin-endpoint to whatever you want right now; this is actually used for server-to-server communication, not administration. Same thing for secret: leave it as `XXXXXX` or generate something random; in any case it isn't used unless your network has multiple servers. @@ -500,6 +500,7 @@ SSL_CA_PASS='XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' DNS_KEY='hmac-sha512:wagon:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX==' DNS_MASTER='10.99.0.1' DNS_TTL='86400' +INTERFACE_EXTRA_LINES="" ``` This file should be mostly self-explanitory. "SSL_CA_PASS" is the CA key passphrase created in the last section. The "DNS_KEY" string should be created from the `/etc/bind/keys/wagon.keys` file, which looks like this: @@ -511,6 +512,8 @@ key "wagon" { }; ``` +`INTERFACE_EXTRA_LINES` will be appeneded to new users' wireguard configurations in the `[Interface]` section. Use this to add extra `PostUp` and `PostDown` parameters, or to set a default MTU. + Wagon comes as 4 services: 1. An api users can access to add/delete hosts diff --git a/back/lib/admin/peer/add b/back/lib/admin/peer/add index f6c9bd8..0b1f548 100755 --- a/back/lib/admin/peer/add +++ b/back/lib/admin/peer/add @@ -94,14 +94,14 @@ fi # Do the wireguard and tell the user server_blocks='' -while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey server_endpoint server_url server_secret; do +while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey server_allowedips server_endpoint server_url server_secret; do [[ ${server_hostname:0:1} = \# ]] && continue server_psk="$(/usr/bin/wg genpsk)" # Local server if [ "${server_hostname}" == "${LOCAL_SERVER}" ]; then - server_blocks="${server_blocks}\n[Peer] # ${server_hostname}.${TLD}\nPublicKey=${server_pubkey}\nPresharedKey=${server_psk}\nAllowedIPs=${server_ipv4}/${IPV4_NET#*/},${server_ipv6}/${IPV6_NET#*/}\nEndpoint=${server_endpoint}\n" + server_blocks="${server_blocks}\n[Peer] # ${server_hostname:?}.${TLD:?}\nPublicKey=${server_pubkey:?}\nPresharedKey=${server_psk:?}\nAllowedIPs=${server_allowedips:?}\nEndpoint=${server_endpoint:?}\n" # Add new user to local wireguard - if /usr/lib/wagon/wg_peer_add "${pubkey}" "${server_psk}" "${ipv4}/32,${ipv6}/128"; then + if /usr/lib/wagon/wg_peer_add "${pubkey:?}" "${server_psk:?}" "${server_allowedips:?}"; then printf 'Added %s to local wireguard server.\n' "${domain}" >&2 else printf 'ERROR! Failed to add %s to local wireguard server!\n' "${domain}" >&2 @@ -109,14 +109,14 @@ while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey se fi # Remote server else - server_blocks="${server_blocks}\n[Peer] # ${server_hostname}.${TLD}\nPublicKey=${server_pubkey}\nPresharedKey=${server_psk}\nAllowedIPs=${server_ipv4}/32,${server_ipv6}/128\nEndpoint=${server_endpoint}\n" + server_blocks="${server_blocks}\n[Peer] # ${server_hostname:?}.${TLD:?}\nPublicKey=${server_pubkey:?}\nPresharedKey=${server_psk:?}\nAllowedIPs=${server_allowedips:?}\nEndpoint=${server_endpoint:?}\n" # Send new user config to federated server - if /usr/lib/wagon/fed_peer_add "${server_url}" "${server_secret}" "${pubkey}" "${server_psk}" "${ipv4}/32,${ipv6}/128" "${server_secret}"; then + if /usr/lib/wagon/fed_peer_add "${server_url:?}" "${server_secret:?}" "${pubkey:?}" "${server_psk:?}" "${server_allowedips:?}" "${server_secret:?}"; then printf 'Sent %s to remote wireguard server %s.\n' "${domain}" "${server_hostname}" >&2 else printf 'ERROR! Failed to send %s to remote wireguard server %s!\n' "${domain}" "${server_hostname}" >&2 fi fi done &2 else printf 'ERROR! Failed to add %s to local wireguard server!\n' "${domain}" >&2 @@ -101,14 +101,14 @@ while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey se fi # Remote server else - server_blocks="${server_blocks}\n[Peer] # ${server_hostname}.${TLD}\nPublicKey=${server_pubkey}\nPresharedKey=${server_psk}\nAllowedIPs=${server_ipv4}/32,${server_ipv6}/128\nEndpoint=${server_endpoint}\n" + server_blocks="${server_blocks}\n[Peer] # ${server_hostname:?}.${TLD:?}\nPublicKey=${server_pubkey:?}\nPresharedKey=${server_psk:?}\nAllowedIPs=${server_allowedips:?}\nEndpoint=${server_endpoint:?}\n" # Send new user config to federated server - if /usr/lib/wagon/fed_peer_add "${server_url}" "${server_secret}" "${pubkey}" "${server_psk}" "${ipv4}/32,${ipv6}/128" "${server_secret}"; then + if /usr/lib/wagon/fed_peer_add "${server_url:?}" "${server_secret:?}" "${pubkey:?}" "${server_psk:?}" "${server_allowedips:?}" "${server_secret:?}"; then printf 'Sent %s to remote wireguard server %s.\n' "${domain}" "${server_hostname}" >&2 else printf 'ERROR! Failed to send %s to remote wireguard server %s!\n' "${domain}" "${server_hostname}" >&2 fi fi done &2 # Remove peer from wireguard - while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey server_endpoint server_url server_secret - do for_server_do "${server_hostname}" "${server_ipv4}" "${server_ipv6}" "${server_pubkey}" "${server_endpoint}" "${server_url}" "${server_secret}" & + while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey server_allowedips server_endpoint server_url server_secret + do for_server_do "${server_hostname:?}" "${server_ipv4:?}" "${server_ipv6:?}" "${server_pubkey:?}" "${server_allowedips:?}" "${server_endpoint:?}" "${server_url:?}" "${server_secret:?}" & done &2 else printf 'ERROR! Failed to add %s to local wireguard server!\n' "${domain}" >&2 @@ -119,14 +119,14 @@ while IFS=$'\t' read -r server_hostname server_ipv4 server_ipv6 server_pubkey se fi # Remote server else - server_blocks="${server_blocks}\n[Peer] # ${server_hostname}.${TLD}\nPublicKey=${server_pubkey}\nPresharedKey=${server_psk}\nAllowedIPs=${server_ipv4}/32,${server_ipv6}/128\nEndpoint=${server_endpoint}\n" + server_blocks="${server_blocks}\n[Peer] # ${server_hostname:?}.${TLD:?}\nPublicKey=${server_pubkey:?}\nPresharedKey=${server_psk:?}\nAllowedIPs=${server_allowedips:?}\nEndpoint=${server_endpoint:?}\n" # Send new user config to federated server - if /usr/lib/wagon/fed_peer_add "${server_url}" "${server_secret}" "${pubkey}" "${server_psk}" "${ipv4}/32,${ipv6}/128" "${server_secret}"; then + if /usr/lib/wagon/fed_peer_add "${server_url:?}" "${server_secret:?}" "${pubkey:?}" "${server_psk:?}" "${server_allowedips:?}" "${server_secret:?}"; then printf 'Sent %s to remote wireguard server %s.\n' "${domain}" "${server_hostname}" >&2 else printf 'ERROR! Failed to send %s to remote wireguard server %s!\n' "${domain}" "${server_hostname}" >&2 fi fi done &2 /usr/lib/wagon/http_res 403; exit diff --git a/back/lib/fed/peer/del b/back/lib/fed/peer/del index f2e40c2..e11f3b1 100755 --- a/back/lib/fed/peer/del +++ b/back/lib/fed/peer/del @@ -16,7 +16,7 @@ if ! sed '/^#/d' /etc/wagon/servers | cut -f2,3 | grep -qw "${ip}"; then fi # Check server secret -local_secret="$(grep -w "^${LOCAL_SERVER}" /etc/wagon/servers | cut -f7)" +local_secret="$(grep -w "^${LOCAL_SERVER}" /etc/wagon/servers | cut -f8)" if ! [ "${local_secret}" == "${secret}" ]; then printf "ERROR! Federated server %s provided a secret, %s, that doesn't match the one in our servers file, %s\n" "${ip}" "${secret}" "${local_secret}" >&2 /usr/lib/wagon/http_res 403; exit diff --git a/etc.sample/config b/etc.sample/config index d9ac981..ba552ed 100644 --- a/etc.sample/config +++ b/etc.sample/config @@ -8,8 +8,9 @@ SSL_CONFIG_DIR="/etc/ssl/private/${TLD}" SSL_CA_CERT="${SSL_CONFIG_DIR}/_ca/cert.pem" SSL_CA_KEY="${SSL_CONFIG_DIR}/_ca/key.pem" SSL_ORG='My Org' -SSL_DAYS='3650' +SSL_DAYS='365' SSL_CA_PASS='XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' DNS_KEY='hmac-sha512:wagon:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXxw==' DNS_MASTER='10.3.0.1' DNS_TTL='86400' +INTERFACE_EXTRA_LINES="" diff --git a/etc.sample/servers b/etc.sample/servers index 7b55126..32afc28 100644 --- a/etc.sample/servers +++ b/etc.sample/servers @@ -1,3 +1,3 @@ -# host ipv4 ipv6 pubkey wg-endpoint admin-endpoint secret -myhost1 10.3.0.1 fd69:1337:0:420:f4:f3:0:1 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX= 123.123.123.123:51820 https://wagon-admin.myhost2.tld XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX -myhost2 10.3.0.2 fd69:1337:0:420:f4:f3:0:2 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX= 234.234.234.234:51820 https://wagon-admin.myhost2.tld XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX +# host ipv4 ipv6 pubkey allowed-ips wg-endpoint admin-endpoint secret +myhost1 10.3.0.1 fd69:1337:0:420:f4:f3:0:1 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX= 10.3.0.1/32,fd69:1337:0:420:f4:f3:0:1/128,10.3.0.0/16,fd69:1337:0:420:f4:f3::/96 123.123.123.123:51820 https://wagon-admin.myhost2.tld XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX +myhost2 10.3.0.2 fd69:1337:0:420:f4:f3:0:2 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX= 10.3.0.2/32,fd69:1337:0:420:f4:f3:0:2/128 234.234.234.234:51820 https://wagon-admin.myhost2.tld XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX