From 223c235f015cef31fdf0ee9239d1591590f12257 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sun, 5 Jul 2026 22:58:58 +0200 Subject: [PATCH] fix(felhomsshd): operator_peer_configured from belt @operator_ips (agent-readable) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6 --- internal/felhomsshd/health.go | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-) diff --git a/internal/felhomsshd/health.go b/internal/felhomsshd/health.go index d4d24c0..8333fe0 100644 --- a/internal/felhomsshd/health.go +++ b/internal/felhomsshd/health.go @@ -75,10 +75,10 @@ func (m *Manager) Status(ctx context.Context, block *hub.WireWireguard) *hub.OOB st.WGHandshakeAgeS = &age } // Operator-peer configured: from the in-memory block when fetched, OR (robust across an agent - // restart, before the next desired-state fetch) from the PERSISTENT rendered wg-felhom.conf — a - // second /32 in AllowedIPs is the operator peer. This keeps the report (and the oob_degraded alert - // gate) accurate immediately after a restart, not only after the next 900s heartbeat fetch. - st.OperatorPeerConfigured = wgConfHasOperatorPeer() + // restart, before the next desired-state fetch) from the PERSISTENT belt @operator_ips set — the + // agent can read it via the sudo nft-list grant (unlike the 0600 root-owned wg-felhom.conf). This + // keeps the report + the oob_degraded alert gate accurate immediately after a restart. + st.OperatorPeerConfigured = m.beltOperatorConfigured(ctx) if block != nil { if block.OOBPeerIP != "" { st.OperatorPeerConfigured = true @@ -146,17 +146,12 @@ func listenerPresent(port int) bool { return err == nil && strings.TrimSpace(string(out)) != "" } -// wgConfHasOperatorPeer reports whether the rendered wg-felhom.conf carries a SECOND AllowedIPs /32 -// (the operator OOB peer, alongside the PBS /32). A pure file read — always current, survives restart. -func wgConfHasOperatorPeer() bool { - raw, err := os.ReadFile("/etc/wireguard/wg-felhom.conf") +// beltOperatorConfigured reports whether the belt's @operator_ips set is non-empty (an operator /32 +// is allowed to reach felhom-sshd). Read via the sudo nft-list grant — persistent + agent-readable. +func (m *Manager) beltOperatorConfigured(ctx context.Context) bool { + out, _, err := m.runner.Run(ctx, "nft", "list", "set", "inet", "felhom_oob", "operator_ips") if err != nil { return false } - for _, line := range strings.Split(string(raw), "\n") { - if strings.HasPrefix(strings.TrimSpace(line), "AllowedIPs") && strings.Contains(line, ",") { - return true // two or more /32s = PBS + operator - } - } - return false + return strings.Contains(string(out), "elements") }