net-tools

applications/net-tools

Fork 0

Commit graph

Author	SHA1	Message	Date
Natalie	53a79d3494	net-tools: fix wg-render apply (set -e abort + dash syncconf), nyc3 endpoint Two bugs found bringing the nyc3 segment live (citron hub + lime spoke): - Hub render ended in `[ -n "$miss" ] && echo`, which returns 1 when no spokes are unkeyed; under `set -e` that silently aborted `render_conf > tmp` on the apply path (spokes were fine — they end in printf). Use an if-block. - `wg syncconf <(wg-quick strip)` used bash process substitution but the script runs under /bin/sh (dash) — replaced with a POSIX temp file. Also: nyc3 endpoint -> citron's bound public IP (104.248.9.88), not the reserved IP (143.244.223.5) — DO routes the reserved IP in but WG replies from the primary, so the reserved IP can't be a WG endpoint without anchor source-routing. Verified live: lime<->citron handshake, ping 10.9.0.7 0% loss, citron dnsmasq resolving *.wg on 10.9.0.7. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-29 21:50:52 -04:00
Natalie	de1f7f2dec	net-tools: multi-segment WireGuard hub model + bin/wg-render Adds the missing reconciler piece: render each host's /etc/wireguard/wg1.conf from data/mesh-hosts.json (WG config was previously hand-built). - mesh.segments maps <segment> -> {hub, endpoint, dns_host, dns_listen}; hosts carry `segment` + `wg_pubkey` (public key only). iceland(yuzu) and nyc3(citron) are independent stars. Legacy single-hub (mesh.hub) still works as fallback. - bin/wg-render: --keygen/--pubkey bootstrap, --dry-run/--whoami inspect, --apply installs + `wg syncconf` (idempotent, rollback). Hub gets a [Peer] per spoke + ip_forward/MASQUERADE; spoke gets one [Peer] = its hub. WG_RENDER_SELF override for tests/ops. - bin/wg-dns-sync: segment-aware listen — a segment's dns_host binds its own dns_listen (citron serves nyc3 on 10.9.0.7; apricot unchanged on 10.9.0.2). - Registers citron (com.uvlava.quinn.infra, nyc3 hub) + nyc3 keys for lime; carries the com.uvlava.ct.* DO-name aliases. Tests cover hub/spoke/dns. (data/mesh-hosts.json also carries pre-existing working-tree normalization: literal em-dash -> — escapes and expanded alias arrays.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-29 21:38:25 -04:00

Author

SHA1

Message

Date

Natalie

53a79d3494

net-tools: fix wg-render apply (set -e abort + dash syncconf), nyc3 endpoint

Two bugs found bringing the nyc3 segment live (citron hub + lime spoke):
- Hub render ended in `[ -n "$miss" ] && echo`, which returns 1 when no spokes
  are unkeyed; under `set -e` that silently aborted `render_conf > tmp` on the
  apply path (spokes were fine — they end in printf). Use an if-block.
- `wg syncconf <(wg-quick strip)` used bash process substitution but the script
  runs under /bin/sh (dash) — replaced with a POSIX temp file.

Also: nyc3 endpoint -> citron's bound public IP (104.248.9.88), not the reserved
IP (143.244.223.5) — DO routes the reserved IP in but WG replies from the
primary, so the reserved IP can't be a WG endpoint without anchor source-routing.

Verified live: lime<->citron handshake, ping 10.9.0.7 0% loss, citron dnsmasq
resolving *.wg on 10.9.0.7.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-29 21:50:52 -04:00

Natalie

de1f7f2dec

net-tools: multi-segment WireGuard hub model + bin/wg-render

Adds the missing reconciler piece: render each host's /etc/wireguard/wg1.conf
from data/mesh-hosts.json (WG config was previously hand-built).

- mesh.segments maps <segment> -> {hub, endpoint, dns_host, dns_listen}; hosts
  carry `segment` + `wg_pubkey` (public key only). iceland(yuzu) and nyc3(citron)
  are independent stars. Legacy single-hub (mesh.hub) still works as fallback.
- bin/wg-render: --keygen/--pubkey bootstrap, --dry-run/--whoami inspect,
  --apply installs + `wg syncconf` (idempotent, rollback). Hub gets a [Peer] per
  spoke + ip_forward/MASQUERADE; spoke gets one [Peer] = its hub. WG_RENDER_SELF
  override for tests/ops.
- bin/wg-dns-sync: segment-aware listen — a segment's dns_host binds its own
  dns_listen (citron serves nyc3 on 10.9.0.7; apricot unchanged on 10.9.0.2).
- Registers citron (com.uvlava.quinn.infra, nyc3 hub) + nyc3 keys for lime;
  carries the com.uvlava.ct.* DO-name aliases. Tests cover hub/spoke/dns.

(data/mesh-hosts.json also carries pre-existing working-tree normalization:
 literal em-dash -> — escapes and expanded alias arrays.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-29 21:38:25 -04:00

2 commits