Preview — /opt/splicevpn/agent/wgconfig.go

/opt/splicevpn/agent/wgconfig.go

package main

import (
	"fmt"
	"strings"

	"splicevpn/proto"
)

// renderWireGuard turns a mesh snapshot into a wg-quick config: this node's
// interface, one [Peer] per other node (full mesh), and the relay hub as a
// catch-all peer when the operator has configured one.
func renderWireGuard(cfg config, reg proto.RegisterResponse, snap proto.MeshSnapshot) string {
	keepalive := 25
	if cfg.Profile == "resilience" { // hold NAT mappings open more aggressively
		keepalive = 15
	}

	var b strings.Builder
	fmt.Fprintf(&b, "# SpliceVPN — generated, do not edit by hand\n")
	fmt.Fprintf(&b, "[Interface]\n")
	fmt.Fprintf(&b, "PrivateKey = %s\n", cfg.PrivKey)
	fmt.Fprintf(&b, "Address = %s\n", reg.OverlayIP)
	fmt.Fprintf(&b, "ListenPort = %d\n", cfg.ListenPort)

	for _, p := range snap.Peers {
		fmt.Fprintf(&b, "\n[Peer] # %s\n", p.Name)
		fmt.Fprintf(&b, "PublicKey = %s\n", p.PublicKey)
		fmt.Fprintf(&b, "AllowedIPs = %s\n", strings.Join(p.AllowedIPs, ", "))
		if ep := bestEndpoint(p.Endpoints); ep != "" {
			fmt.Fprintf(&b, "Endpoint = %s\n", ep)
		}
		fmt.Fprintf(&b, "PersistentKeepalive = %d\n", keepalive)
	}

	// Relay hub: catch-all peer for anything not owned by a specific node yet,
	// and the hook point for Phase-2 relay-on-failure. Only if configured.
	if reg.HubPublicKey != "" && reg.HubEndpoint != "" {
		fmt.Fprintf(&b, "\n[Peer] # relay-hub (fallback)\n")
		fmt.Fprintf(&b, "PublicKey = %s\n", reg.HubPublicKey)
		fmt.Fprintf(&b, "AllowedIPs = %s\n", strings.Join(snap.HubAllowedIPs, ", "))
		fmt.Fprintf(&b, "Endpoint = %s\n", reg.HubEndpoint)
		fmt.Fprintf(&b, "PersistentKeepalive = %d\n", keepalive)
	}
	return b.String()
}

// bestEndpoint picks the most-likely-reachable candidate. The coordinator puts the
// observed public mapping first, so that wins; Phase-2 hole-punching will replace
// this with a real reachability probe.
func bestEndpoint(eps []string) string {
	if len(eps) == 0 {
		return ""
	}
	return eps[0]
}