founder
16214f3c66
Peer discovery is now the single owner of how wg is invoked and parsed. wg.rs: - resolve the binary through ordered amnezia.wg_binaries (default [awg, wg]); awg is the real binary in the official image and wg is a symlink to it, so awg is tried first and wg stays for plain WireGuard containers. No probe call: resolution is a property of the command being run anyway. - drop the nsenter fallback. AmneziaWG is userspace and its UAPI socket lives under RUNSTATEDIR/amneziawg/ in the container mount namespace, while host wireguard-tools looks under /var/run/wireguard/. nsenter -n enters only the network namespace, so that path could never return peers. - classify dump lines structurally instead of by column count. The AWG interface line is longer than a peer line (14 columns on AWG 2.0, 28 on AWG 3.0) and its handshake/rx/tx positions hold junk-packet sizes that parse as integers, so only the allowed-ips column discriminates. Column 1 of an interface line is the device private key, which the previous heuristic rejected only incidentally. - fix allowed-ips parsing: `show all allowed-ips` separates a peer's addresses with spaces, not commas, so peers with more than one allowed IP were shaped on their first address only and the rest ran unlimited. - collapse the three duplicated /32-in-CIDR filters into one tokenizer shared by the allowed-ips, dump and pretty-print parsers. config.rs: - add amnezia.wg_binaries with serde default, validated as bare command names (non-empty, no whitespace, no path separators) since they execute inside the container. Existing deployed configs keep parsing unchanged. - remove host wg from the required-tool preflight. It gated daemon startup on wireguard-tools for a code path that produced nothing. status.rs: - discover peers once instead of twice per status call and degrade gracefully like the neighbouring sections instead of aborting the whole output. Tests: real AWG 3.0 / AWG 2.0 / plain WireGuard interface-line fixtures, AWG 3.0 range keepalive, space-separated allowed-ips, binary resolution order, and a test that parses and validates the shipped config.example.toml.
92 lines
3.2 KiB
TOML
92 lines
3.2 KiB
TOML
[amnezia]
|
||
# Порядок важен: используется первый запущенный контейнер из списка.
|
||
# amnezia-awg3 указан на будущее: в AmneziaVPN 5.0 такого типа контейнера ещё нет.
|
||
container_names = ["amnezia-awg2", "amnezia-awg3", "amnezia-awg"]
|
||
interface_candidates = ["awg0", "wg0", "amnezia0", "tun0"]
|
||
interface_patterns = ["awg*", "wg*", "amnezia*", "tun*"]
|
||
|
||
# Утилита для чтения peer state внутри контейнера. Пробуются по порядку,
|
||
# используется первая успешная. В официальном образе AmneziaWG реальный бинарь —
|
||
# /usr/bin/awg, а /usr/bin/wg является symlink на него.
|
||
# Значения выполняются внутри контейнера: только имена команд, без путей и пробелов.
|
||
# На хосте wireguard-tools не требуется.
|
||
wg_binaries = ["awg", "wg"]
|
||
|
||
# Подсеть VPN peers.
|
||
# Проверка:
|
||
# C="$(docker ps --format '{{.Names}}' | grep -E '^(amnezia-awg2|amnezia-awg3|amnezia-awg)$' | head -n1)"
|
||
# docker exec "$C" ip -4 addr
|
||
# docker exec "$C" awg show
|
||
peer_ipv4_cidr = "10.8.1.0/24"
|
||
|
||
[traffic]
|
||
enabled = true
|
||
peer_limit = "50mbit"
|
||
root_rate = "500mbit"
|
||
reconcile_interval_secs = 15
|
||
container_ready_timeout_secs = 120
|
||
class_start_id = 10
|
||
ifb_name = "ifb0"
|
||
|
||
[sysctl_tuning]
|
||
enabled = true
|
||
apply_on_daemon_start = true
|
||
|
||
# Включает IPv4 forwarding для VPN/Docker gateway host.
|
||
ip_forward = true
|
||
|
||
# off | auto | require
|
||
# auto: использовать BBR, если доступен; иначе пропустить без ошибки.
|
||
# require: завершить с ошибкой, если BBR недоступен.
|
||
tcp_bbr = "auto"
|
||
|
||
# none | fq | fq_codel
|
||
# fq применяется только когда BBR активен.
|
||
default_qdisc = "fq"
|
||
|
||
# Лимиты socket buffers в байтах.
|
||
# Баланс для хоста порядка ~500 Mbit/s.
|
||
rmem_max = 67108864
|
||
wmem_max = 67108864
|
||
|
||
netdev_backlog_enabled = true
|
||
netdev_max_backlog = 50000
|
||
|
||
udp_rmem_min_enabled = true
|
||
udp_rmem_min = 8192
|
||
|
||
# net.ipv4.udp_wmem_min intentionally not managed:
|
||
# Linux kernel documentation states it has no effect.
|
||
|
||
[host_firewall]
|
||
enabled = true
|
||
# Должен совпадать с реально слушающим портом sshd до apply-firewall.
|
||
ssh_port = 2323
|
||
# Должен совпадать с опубликованным Docker/Amnezia UDP-портом.
|
||
# Проверка: docker port amnezia-awg2 2>/dev/null || docker port amnezia-awg3 2>/dev/null || docker port amnezia-awg
|
||
# Транспортный порт AmneziaWG/AWG, опубликованный Docker, обычно 443/udp.
|
||
# Это не AmneziaDNS. Не указывайте здесь 53.
|
||
amnezia_port = 443
|
||
amnezia_protocols = ["udp"]
|
||
allow_icmp = true
|
||
default_input_policy = "drop"
|
||
|
||
[anti_torrent]
|
||
enabled = true
|
||
max_connections_per_peer = 150
|
||
# Обычно та же подсеть, что и [amnezia].peer_ipv4_cidr.
|
||
peer_ipv4_cidr = "10.8.1.0/24"
|
||
apply_in_amnezia_netns = true
|
||
|
||
[reboot]
|
||
enabled = true
|
||
window_start_utc = "01:00"
|
||
window_end_utc = "02:00"
|
||
|
||
[swap]
|
||
enabled = true
|
||
path = "/swapfile"
|
||
size_mb = 2048
|
||
priority = 1
|
||
swappiness = 1
|