founder
16214f3c66
Peer discovery is now the single owner of how wg is invoked and parsed. wg.rs: - resolve the binary through ordered amnezia.wg_binaries (default [awg, wg]); awg is the real binary in the official image and wg is a symlink to it, so awg is tried first and wg stays for plain WireGuard containers. No probe call: resolution is a property of the command being run anyway. - drop the nsenter fallback. AmneziaWG is userspace and its UAPI socket lives under RUNSTATEDIR/amneziawg/ in the container mount namespace, while host wireguard-tools looks under /var/run/wireguard/. nsenter -n enters only the network namespace, so that path could never return peers. - classify dump lines structurally instead of by column count. The AWG interface line is longer than a peer line (14 columns on AWG 2.0, 28 on AWG 3.0) and its handshake/rx/tx positions hold junk-packet sizes that parse as integers, so only the allowed-ips column discriminates. Column 1 of an interface line is the device private key, which the previous heuristic rejected only incidentally. - fix allowed-ips parsing: `show all allowed-ips` separates a peer's addresses with spaces, not commas, so peers with more than one allowed IP were shaped on their first address only and the rest ran unlimited. - collapse the three duplicated /32-in-CIDR filters into one tokenizer shared by the allowed-ips, dump and pretty-print parsers. config.rs: - add amnezia.wg_binaries with serde default, validated as bare command names (non-empty, no whitespace, no path separators) since they execute inside the container. Existing deployed configs keep parsing unchanged. - remove host wg from the required-tool preflight. It gated daemon startup on wireguard-tools for a code path that produced nothing. status.rs: - discover peers once instead of twice per status call and degrade gracefully like the neighbouring sections instead of aborting the whole output. Tests: real AWG 3.0 / AWG 2.0 / plain WireGuard interface-line fixtures, AWG 3.0 range keepalive, space-separated allowed-ips, binary resolution order, and a test that parses and validates the shipped config.example.toml.
71 lines
2.5 KiB
Markdown
71 lines
2.5 KiB
Markdown
# Production example (reference)
|
|
|
|
Этот пример фиксирует эталонный production-state после успешной установки и preflight. Значения обезличены и предназначены как reference для smoke-проверки.
|
|
|
|
```text
|
|
SSH:
|
|
host: <server-ip>
|
|
port: 2323
|
|
user: root
|
|
|
|
Amnezia:
|
|
container: amnezia-awg2
|
|
interface: awg0
|
|
published UDP: 443
|
|
peer CIDR: 10.8.1.0/24
|
|
|
|
AmneziaDNS:
|
|
container: amnezia-dns
|
|
status: healthy
|
|
internal_ip: 172.29.172.254 # example value; verify with docker inspect
|
|
exposed_ports: 53/tcp, 53/udp inside Docker only
|
|
published_ports: none
|
|
public_53: closed
|
|
|
|
Expected status:
|
|
service: active
|
|
network tuning drift: no
|
|
traffic drift: no
|
|
host firewall drift: no
|
|
anti-torrent drift: no
|
|
swap drift: no
|
|
```
|
|
|
|
Проверка ключевых сигналов:
|
|
|
|
```bash
|
|
systemctl status awg2-harness.service --no-pager -l
|
|
systemctl status awg2-reboot-scheduler.service --no-pager -l
|
|
awg2-harness --config /etc/awg2-harness/config.toml status
|
|
```
|
|
|
|
Проверка Docker/Amnezia runtime:
|
|
|
|
```bash
|
|
docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'
|
|
C="$(docker ps --format '{{.Names}}' | grep -E '^(amnezia-awg2|amnezia-awg3|amnezia-awg)$' | head -n1)"
|
|
docker port "$C"
|
|
docker exec "$C" awg show
|
|
docker inspect -f 'ports={{json .NetworkSettings.Ports}}' amnezia-dns
|
|
```
|
|
|
|
Проверка AWG-контракта внутри контейнера (без раскрытия секретов):
|
|
|
|
```bash
|
|
docker exec "$C" readlink -f /usr/bin/wg # ожидается /usr/bin/awg
|
|
docker exec "$C" awg --version
|
|
docker exec "$C" ip -o link show awg0
|
|
docker exec "$C" awg show all allowed-ips
|
|
docker exec "$C" awg show all dump | awk -F '\t' '{ print "row=" NR, "fields=" NF, "interface=" $1 }'
|
|
```
|
|
|
|
Interface-строка `awg show all dump` даёт 14 полей на AWG 2.0 и 28 на AWG 3.0, peer-строки — 9. Полный вывод `awg show all dump` передавать нельзя: во второй колонке interface-строки находится приватный ключ устройства.
|
|
|
|
Проверка, что runtime config создан вручную (ожидаемое поведение):
|
|
|
|
```bash
|
|
test -f /etc/awg2-harness/config.toml && echo "runtime config present"
|
|
```
|
|
|
|
Если файл отсутствует после `apt install`, это корректно: создайте его вручную из `/usr/share/doc/awg2-harness/repo/config.example.toml`.
|