wmantly
99276f4ee5
The existing WireGuard code (models/wg_site.js, routes/wireguard.js) is the roaming-client/exit-node feature -- individual peer configs an admin hands out, not gateway-to-gateway mesh peering. This adds the latter, per MULTI_SITE_SPEC.md §4: two theta-gateway instances mesh by one calling the other's POST /api/mesh/register with a join token (minted via POST /api/mesh/join-tokens, admin-gated); both sides end up with a live wg0 peer for the other, mesh-indexed per Appendix A's addressing (172.24.<idx>.0/16 + 10.<idx>.0.0/16, idx 1-254). - utils/wg_iface.js: brings up the local interface, preferring in-kernel WireGuard (ip link add type wireguard) and falling back to userspace wireguard-go when the kernel module isn't available. Both packages added to the Dockerfile. - utils/mesh_addressing.js: pure addressing math, unit tested (test/unit/mesh_addressing.test.js). - models/mesh_gateway.js: Redis-backed registry of known peer gateways (same pattern as wg_site.js), assigns + persists mesh indexes. - utils/mesh_join_token.js: single-use bootstrap credential, same GETDEL-on-Redis pattern already used on the theta-directory side. - routes/mesh.js: /join-tokens (admin), /register (bearer token, no session -- called by a remote gateway), /join (admin, initiates from this side), /gateways (admin, list). Verified with a REAL two-container test (not mocked): two independent containers, each running this actual code, meshed via a live join-token handshake, brought up real kernel WireGuard interfaces, and passed ICMP traffic across the resulting encrypted tunnel end to end (0% packet loss). That test caught a real bug worth calling out: `wg set ... peer ... allowed-ips` only configures WireGuard's own crypto-routing table -- it does NOT add a kernel route for that destination (wg-quick normally does this as a separate step; we don't use wg-quick). A real encrypted handshake completed between the two containers with the route missing, and ping still showed 100% loss until setPeer() was fixed to add the corresponding `ip route add <allowed-ip> dev <iface>` itself.
28 lines
1.2 KiB
JavaScript
28 lines
1.2 KiB
JavaScript
'use strict';
|
|
|
|
const router = require('express').Router();
|
|
const middleware = require('../middleware/auth');
|
|
|
|
// Authentication (local login + OIDC handshake). Unauthenticated by design.
|
|
router.use('/auth', require('../models').authRouter);
|
|
|
|
// Who am I — needs a valid session but no admin gate (drives the login state).
|
|
router.use('/user', middleware.auth, require('./user'));
|
|
|
|
// Self-service API token (PAT) management — any authenticated user, no
|
|
// admin gate (see routes/api_token.js for why a token can't reach admin routes).
|
|
router.use('/api-token', middleware.auth, require('./api_token'));
|
|
|
|
// Jump-host data — jump admin only (audit log, active sessions, metrics).
|
|
router.use('/', middleware.auth, middleware.requireJumpAdmin, require('./jump'));
|
|
|
|
// WireGuard peer + site management — admin only.
|
|
router.use('/wireguard', middleware.auth, middleware.requireJumpAdmin, require('./wireguard'));
|
|
|
|
// Gateway-to-gateway mesh — mixed auth (register/register-* are called by a
|
|
// remote gateway with a bearer join token, not an admin session; join-tokens
|
|
// mint + join are admin-gated). See routes/mesh.js for the per-route gates.
|
|
router.use('/mesh', require('./mesh'));
|
|
|
|
module.exports = router;
|