Add wgpeer: WireGuard peer management for wgnet01 #1

Open

hclaude wants to merge 5 commits from hclaude/wgpeer into main AGit

hclaude commented

2026-11-03 18:18:59 +00:00

First-time contributor

wgnet01/wgpeer + README. add/rm/list/show/qr/plik, hot-apply via wg syncconf, all wg0.conf backups kept.

hclaude added 2 commits

2026-11-03 18:18:59 +00:00

Add wgpeer: WireGuard peer management script for wgnet01 7c143157b4

Adds wgnet01/wgpeer, a single-file bash tool for the production WireGuard
IPv6 exit node, plus a README describing the design.

Subcommands: add (multi-name, keys + preshared key, lowest free ::N/128,
client conf written to /etc/wireguard/clients/), rm, list (live handshake
and transfer via wg show dump), show, qr (qrencode, for phones), plik
(one-shot, 1d TTL, random password).

wg0.conf stays the single source of truth; peer name is the first comment
line after [Peer]. Changes are hot-applied with wg syncconf so existing
sessions are not disturbed, and wg0.conf is backed up before every write.
Client AllowedIPs default to ::/0 per the PoC decision; --split limits to
DC prefixes + Quad9.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X6bYXvY6rShboFKXg8Sgdy

wgpeer: keep all wg0.conf backups by default 294dad946f

Backup pruning is now opt-in (KEEP_BACKUPS=N); the default of 0 never
removes a backup. Nothing the tool writes gets deleted unless asked.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X6bYXvY6rShboFKXg8Sgdy

hclaude added 1 commit

2026-11-03 18:22:36 +00:00

wgpeer: fix plik password flag (-p is a bare prompt flag) 30d140bd7e

The plik client's -p takes no argument and prompts interactively; the
option that accepts a value is --password LOGIN:PASSWORD. With -p the
generated password was parsed as a filename and the upload failed with
"File <password> not found". Also print the login and a curl fetch line,
and fix the same mistake in the PLAN.md example.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X6bYXvY6rShboFKXg8Sgdy

hclaude added 1 commit

2026-11-03 18:33:56 +00:00

wgpeer: delegate routed /56 blocks to peers 19eb0aa776

New `wgpeer block <name>` and `wgpeer add --block`: take the next free
/56 out of BLOCK_POOL (set in /etc/wireguard/wgpeer.conf, with an
optional BLOCK_SKIP list), append it to the peer's server-side
AllowedIPs, hot-apply with wg syncconf, and add the kernel route to wg0.
On first use an `ip -6 route replace unreachable <pool>` PostUp/PostDown
pair is inserted into [Interface] so unallocated pool space cannot loop
between wgnet01 and the upstream. `wgpeer rm` frees the block and its
route; `wgpeer list` gains a BLOCK column; `wgpeer pool` shows usage.

The client conf is unchanged apart from a comment: AllowedIPs ::/0
already covers the block. README documents the upstream summary route,
Nautobot recording, and a Linux/Docker client example. Adds
wgpeer.conf.example with the candidate pools found in Nautobot.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X6bYXvY6rShboFKXg8Sgdy

hclaude added 1 commit

2026-11-03 18:38:20 +00:00

wgpeer: block pool 2c0f:fc78:fee0:d000::/52 via /etc/wireguard/wgpeer.conf 0d0b127551

Pool decided 2026-11-03. The script no longer carries a pool default;
BLOCK_POOL must come from /etc/wireguard/wgpeer.conf, and the repo now
ships that file (renamed from wgpeer.conf.example) with the chosen /52.
README install step copies it alongside the script.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X6bYXvY6rShboFKXg8Sgdy

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin +refs/pull/1/head:hclaude/wgpeer

git switch hclaude/wgpeer

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff hclaude/wgpeer

git switch hclaude/wgpeer

git rebase main

git switch main

git merge --ff-only hclaude/wgpeer

git switch hclaude/wgpeer

git rebase main

git switch main

git merge --no-ff hclaude/wgpeer

git switch main

git merge --squash hclaude/wgpeer