founder
c6fa1a0af9
wireguard-tools was still declared in Depends and in the runtime package list installed by tools/build.sh --prepare-runtime-env. Since peer discovery moved to docker exec, no code path invokes a host-side wg, and check_host_tools stopped requiring it. The declaration was therefore installing a package the harness never calls and misrepresenting the actual architecture to anyone reading the control file. Removed from both places. Three items were carrying #[allow(dead_code)], which is a way of silencing the compiler about a real question rather than answering it: - SysctlTuningStatus.desired duplicated data that is already in .current - every SysctlValue holds both the desired and the current value, so the second Vec was the same information cloned on every inspect call and read by nobody; - SysctlValue.managed was always set to true and never read. Ownership is decided per file by the marker, not per key, so the field encoded nothing; - unix_now() in the reboot scheduler, along with the SystemTime and UNIX_EPOCH imports it needed. The module works in chrono NaiveDateTime throughout. All three are removed rather than annotated. The workspace now builds clean under -D warnings with no dead_code exceptions anywhere. cargo test --workspace: 158 + 4 passed. clippy -D warnings clean.
AWG2 Harness builder
tools/build.sh — единый build/package helper для AWG2 Harness. Он предназначен в первую очередь для build-machine. Production-хост обычно получает только готовый .deb и /etc/awg2-harness/config.toml.
Скрипт собирает workspace из двух бинарей:
traffic_core -> awg2-harness
reboot_module -> awg2-reboot-scheduler
И при --package создаёт Debian-пакет dist/awg2-harness_<version>_amd64.deb с checksum-файлом dist/SHA256SUMS.
Поддерживаемая build-среда
- Debian 13 с
apt. - Debian package architecture: amd64.
- Rust toolchain из
rust-toolchain.toml(1.95.0в текущем дереве). Cargo.lockобязателен: build gate работает в--lockedрежиме.
Быстрый production build
cd awg2_harness
chmod +x tools/build.sh
./tools/build.sh --prepare-build-env --bootstrap-rust --yes
./tools/build.sh --package --version 0.1.6
(cd dist && sha256sum -c SHA256SUMS)
dpkg-deb -I dist/awg2-harness_0.1.6_amd64.deb
dpkg-deb -c dist/awg2-harness_0.1.6_amd64.deb | sort
Что делает default запуск
./tools/build.sh
Если не указан ни один action flag, включается --build.
Проверка пакета перед переносом
(cd dist && sha256sum -c SHA256SUMS)
dpkg-deb -I dist/awg2-harness_<version>_amd64.deb
dpkg-deb -c dist/awg2-harness_<version>_amd64.deb | sort
Production transfer
scp -P 2323 dist/awg2-harness_<version>_amd64.deb root@<server-ip>:/root/
scp -P 2323 dist/SHA256SUMS root@<server-ip>:/root/
Runtime config bootstrap на production
--package кладёт config.example.toml только в:
/usr/share/doc/awg2-harness/repo/config.example.toml
Боевой /etc/awg2-harness/config.toml создаётся вручную после установки пакета:
apt install ./awg2-harness_<version>_amd64.deb
install -d -m 0755 /etc/awg2-harness
cp /usr/share/doc/awg2-harness/repo/config.example.toml /etc/awg2-harness/config.toml
nano /etc/awg2-harness/config.toml
Перед первым apply-firewall обязательно сверяйте ssh_port, amnezia_port и peer_ipv4_cidr с реальным состоянием хоста и Amnezia.
Что скрипт намеренно не делает
- не устанавливает AmneziaVPN;
- не генерирует client keys/configs;
- не копирует
config.example.tomlв/etc/awg2-harness/config.toml; - не включает services без
--enable; - не управляет SSH hardening.