admin/felhom-agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(felhomsshd): operator_peer_configured from belt @operator_ips (agent-readable)

Browse Source 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
This commit is contained in:
authentik Default Admin
2026-07-05 22:58:58 +02:00
parent 72d6132907
commit 223c235f01
1 changed files with 9 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/felhomsshd/health.go
+9 -14
View File
@@ -75,10 +75,10 @@ func (m *Manager) Status(ctx context.Context, block *hub.WireWireguard) *hub.OOB
st.WGHandshakeAgeS = &age st.WGHandshakeAgeS = &age
} }
// Operator-peer configured: from the in-memory block when fetched, OR (robust across an agent // Operator-peer configured: from the in-memory block when fetched, OR (robust across an agent
// restart, before the next desired-state fetch) from the PERSISTENT rendered wg-felhom.conf — a // restart, before the next desired-state fetch) from the PERSISTENT belt @operator_ips set — the
// second /32 in AllowedIPs is the operator peer. This keeps the report (and the oob_degraded alert // agent can read it via the sudo nft-list grant (unlike the 0600 root-owned wg-felhom.conf). This
// gate) accurate immediately after a restart, not only after the next 900s heartbeat fetch. // keeps the report + the oob_degraded alert gate accurate immediately after a restart.
st.OperatorPeerConfigured = wgConfHasOperatorPeer() st.OperatorPeerConfigured = m.beltOperatorConfigured(ctx)
if block != nil { if block != nil {
if block.OOBPeerIP != "" { if block.OOBPeerIP != "" {
st.OperatorPeerConfigured = true st.OperatorPeerConfigured = true
@@ -146,17 +146,12 @@ func listenerPresent(port int) bool {
return err == nil && strings.TrimSpace(string(out)) != "" return err == nil && strings.TrimSpace(string(out)) != ""
} }
// wgConfHasOperatorPeer reports whether the rendered wg-felhom.conf carries a SECOND AllowedIPs /32 // beltOperatorConfigured reports whether the belt's @operator_ips set is non-empty (an operator /32
// (the operator OOB peer, alongside the PBS /32). A pure file read — always current, survives restart. // is allowed to reach felhom-sshd). Read via the sudo nft-list grant — persistent + agent-readable.
func wgConfHasOperatorPeer() bool { func (m *Manager) beltOperatorConfigured(ctx context.Context) bool {
raw, err := os.ReadFile("/etc/wireguard/wg-felhom.conf") out, _, err := m.runner.Run(ctx, "nft", "list", "set", "inet", "felhom_oob", "operator_ips")
if err != nil { if err != nil {
return false return false
} }
for _, line := range strings.Split(string(raw), "\n") { return strings.Contains(string(out), "elements")
if strings.HasPrefix(strings.TrimSpace(line), "AllowedIPs") && strings.Contains(line, ",") {
return true // two or more /32s = PBS + operator
}
}
return false
} }