admin
6f5fb19a64
Peersync script: validate-first (jq contract check before ANY state change), head-file + generated-peers conf model, syncconf-from-tmp then atomic mv (live conf never diverges in the failure direction), zero-peer payload valid (wipe). hub.yaml: 0.32.0 image + WG_ENDPOINT_SSH_* env + optional Secret mount so the pod starts before the runbook's step-6 Secret exists. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
71 lines
3.1 KiB
Bash
71 lines
3.1 KiB
Bash
#!/usr/bin/env bash
|
|
# felhom-peersync v1.0.0 — the offsite endpoint's WG peer-list reconcile script (S1, doc 06 §5).
|
|
#
|
|
# Runs as the SSH forced command for the hub's `felhom-peersync` user (via sudo — see
|
|
# documentation/runbooks/offsite-endpoint.md step 5). Reads the hub's declarative payload on
|
|
# stdin, VALIDATES FIRST (any failure exits 1 before touching anything), then applies the FULL
|
|
# peer list with `wg syncconf` (exact-match: adds missing peers, removes absent ones, never
|
|
# bounces the interface) and only after a successful apply persists the conf atomically.
|
|
#
|
|
# Payload contract (version 1):
|
|
# {"version":1,"interface":"wg0","peers":[{"pubkey":"<44b64>","allowed_ip":"10.77.0.x/32"}]}
|
|
# Response on stdout: {"status":"ok","applied":<N>}
|
|
#
|
|
# One script, one job: there is NO second mode. It never reads or prints the WG private key —
|
|
# /etc/wireguard/wg0.conf.head (the [Interface] section, including PrivateKey) is only ever
|
|
# concatenated. Do NOT replace the head-file model with `wg-quick save` (nondeterministic; would
|
|
# rewrite the whole conf from runtime state).
|
|
set -euo pipefail
|
|
|
|
CONF_DIR=/etc/wireguard
|
|
HEAD_FILE="$CONF_DIR/wg0.conf.head"
|
|
LIVE_CONF="$CONF_DIR/wg0.conf"
|
|
IFACE=wg0
|
|
|
|
err() {
|
|
echo "felhom-peersync: ERROR: $*" >&2
|
|
exit 1
|
|
}
|
|
|
|
command -v jq >/dev/null || err "jq is required"
|
|
command -v wg >/dev/null || err "wireguard-tools is required"
|
|
[ -r "$HEAD_FILE" ] || err "missing $HEAD_FILE"
|
|
|
|
# 1. Read stdin capped at 1 MiB. A truncated (oversized) payload fails JSON validation below.
|
|
payload=$(head -c 1048576)
|
|
[ -n "$payload" ] || err "empty payload"
|
|
|
|
# 2. Validate EVERYTHING before touching any state. `all` is true on an empty peers array, so a
|
|
# zero-peer payload (wipe the list) is valid by design. The endpoint's own 10.77.0.1 must
|
|
# never appear as a peer allowed_ip.
|
|
jq -e '
|
|
(.version == 1)
|
|
and (.interface == "wg0")
|
|
and ((.peers | type) == "array")
|
|
and ([.peers[] | (.pubkey | type) == "string" and (.pubkey | test("^[A-Za-z0-9+/]{43}=$"))] | all)
|
|
and ([.peers[] | (.allowed_ip | type) == "string"
|
|
and (.allowed_ip | test("^10\\.77\\.0\\.[0-9]{1,3}/32$"))
|
|
and (.allowed_ip != "10.77.0.1/32")] | all)
|
|
' >/dev/null <<<"$payload" || err "payload failed validation (version/interface/pubkey/allowed_ip)"
|
|
|
|
# 3. Generate the candidate conf in a tmp dir ON THE SAME FILESYSTEM (atomic mv later). Values
|
|
# are written into the file by jq/cat only — never interpolated into a command line.
|
|
tmpdir=$(mktemp -d "$CONF_DIR/.peersync.XXXXXX")
|
|
trap 'rm -rf "$tmpdir"' EXIT
|
|
tmp="$tmpdir/wg0.conf"
|
|
(umask 077; cat "$HEAD_FILE" > "$tmp")
|
|
jq -r '.peers[] | "\n[Peer]\nPublicKey = \(.pubkey)\nAllowedIPs = \(.allowed_ip)"' \
|
|
<<<"$payload" >> "$tmp"
|
|
chmod 600 "$tmp"
|
|
|
|
# 4. Apply from the TMP file first. On failure we exit here (set -e): the previous good
|
|
# LIVE_CONF is still in place — runtime and boot config never diverge in the bad direction.
|
|
wg syncconf "$IFACE" <(wg-quick strip "$tmp") || err "wg syncconf failed; live conf untouched"
|
|
|
|
# 5. Persist only after a successful apply (same-fs mv = atomic).
|
|
mv "$tmp" "$LIVE_CONF"
|
|
|
|
# 6. Report.
|
|
applied=$(jq '.peers | length' <<<"$payload")
|
|
printf '{"status":"ok","applied":%d}\n' "$applied"
|