Merge main (wgpeer) into headscale #2

Open

hclaude wants to merge 9 commits from hclaude/wgpeer into headscale AGit

hclaude commented

2026-11-03 18:18:59 +00:00

First-time contributor

Keeps headscale a superset of main. Brings in wgnet01/wgpeer.

hclaude added 3 commits

2026-11-03 18:18:59 +00:00

Add wgpeer: WireGuard peer management script for wgnet01 7c143157b4

Adds wgnet01/wgpeer, a single-file bash tool for the production WireGuard
IPv6 exit node, plus a README describing the design.

Subcommands: add (multi-name, keys + preshared key, lowest free ::N/128,
client conf written to /etc/wireguard/clients/), rm, list (live handshake
and transfer via wg show dump), show, qr (qrencode, for phones), plik
(one-shot, 1d TTL, random password).

wg0.conf stays the single source of truth; peer name is the first comment
line after [Peer]. Changes are hot-applied with wg syncconf so existing
sessions are not disturbed, and wg0.conf is backed up before every write.
Client AllowedIPs default to ::/0 per the PoC decision; --split limits to
DC prefixes + Quad9.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X6bYXvY6rShboFKXg8Sgdy

wgpeer: keep all wg0.conf backups by default 294dad946f

Backup pruning is now opt-in (KEEP_BACKUPS=N); the default of 0 never
removes a backup. Nothing the tool writes gets deleted unless asked.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X6bYXvY6rShboFKXg8Sgdy

Merge branch 'main' into headscale e14f21333a

hclaude added 2 commits

2026-11-03 18:22:36 +00:00

wgpeer: fix plik password flag (-p is a bare prompt flag) 30d140bd7e

The plik client's -p takes no argument and prompts interactively; the
option that accepts a value is --password LOGIN:PASSWORD. With -p the
generated password was parsed as a filename and the upload failed with
"File <password> not found". Also print the login and a curl fetch line,
and fix the same mistake in the PLAN.md example.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X6bYXvY6rShboFKXg8Sgdy

Merge branch 'main' into headscale b1305164f8

hclaude added 2 commits

2026-11-03 18:33:56 +00:00

wgpeer: delegate routed /56 blocks to peers 19eb0aa776

New `wgpeer block <name>` and `wgpeer add --block`: take the next free
/56 out of BLOCK_POOL (set in /etc/wireguard/wgpeer.conf, with an
optional BLOCK_SKIP list), append it to the peer's server-side
AllowedIPs, hot-apply with wg syncconf, and add the kernel route to wg0.
On first use an `ip -6 route replace unreachable <pool>` PostUp/PostDown
pair is inserted into [Interface] so unallocated pool space cannot loop
between wgnet01 and the upstream. `wgpeer rm` frees the block and its
route; `wgpeer list` gains a BLOCK column; `wgpeer pool` shows usage.

The client conf is unchanged apart from a comment: AllowedIPs ::/0
already covers the block. README documents the upstream summary route,
Nautobot recording, and a Linux/Docker client example. Adds
wgpeer.conf.example with the candidate pools found in Nautobot.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X6bYXvY6rShboFKXg8Sgdy

Merge branch 'main' into headscale d36d3313ee

hclaude added 2 commits

2026-11-03 18:38:20 +00:00

wgpeer: block pool 2c0f:fc78:fee0:d000::/52 via /etc/wireguard/wgpeer.conf 0d0b127551

Pool decided 2026-11-03. The script no longer carries a pool default;
BLOCK_POOL must come from /etc/wireguard/wgpeer.conf, and the repo now
ships that file (renamed from wgpeer.conf.example) with the chosen /52.
README install step copies it alongside the script.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X6bYXvY6rShboFKXg8Sgdy

Merge branch 'main' into headscale ccc0ad9ae6

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin +refs/pull/2/head:hclaude/wgpeer

git switch hclaude/wgpeer

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch headscale

git merge --no-ff hclaude/wgpeer

git switch hclaude/wgpeer

git rebase headscale

git switch headscale

git merge --ff-only hclaude/wgpeer

git switch hclaude/wgpeer

git rebase headscale

git switch headscale

git merge --no-ff hclaude/wgpeer

git switch headscale

git merge --squash hclaude/wgpeer