ambrose
/
wireguard-negotiator
mirror of https://github.com/serverwentdown/wireguard-negotiator.git
1
0
Fork 0
Code Releases Activity
wireguard-negotiator/README.md

75 lines
2.5 KiB
Markdown
Raw Normal View History

Initial project scaffold
2019-12-19 19:48:52 +08:00
Initial commit
2019-12-19 18:03:15 +08:00
# wireguard-negotiator
Initial project scaffold
2019-12-19 19:48:52 +08:00
Initial commit
2019-12-19 18:03:15 +08:00
A not-very-secure manual WireGuard negotiator
Initial project scaffold
2019-12-19 19:48:52 +08:00
## Purpose
`wireguard-negotiator` is built for scenarios where a simple mechanism to exchange and manually accept WireGuard keys is needed. This makes it slightly easier to provision a group of Linux WireGuard peers that peer with a "server".
In summary:
* Manage "client" keys
* Exchange keys over HTTP(S)
Initial prototype server
2019-12-20 17:41:49 +08:00
* Exchange IP addressing
Initial project scaffold
2019-12-19 19:48:52 +08:00
* Manually gate new peers
Update README and initial routes
2019-12-19 20:52:27 +08:00
* Sets up network interface on the "client"
Initial project scaffold
2019-12-19 19:48:52 +08:00
* Generate Ansible INI inventory
Update README and initial routes
2019-12-19 20:52:27 +08:00
The primary scenario this tool is going to be used for is to manage machines using Ansible within an unknown LAN behind NAT. I am planning to use it for FOSSASIA Summit 2020.
Initial project scaffold
2019-12-19 19:48:52 +08:00
## Limitations
* Linux-only
* Manages existing config files only
* Removing peers is a manual process
# Usage
Initial prototype server
2019-12-20 17:41:49 +08:00
## Server
Correct README statement about "server"
2019-12-21 00:29:54 +08:00
The "server" manages a WireGuard interface, ~~treating a WireGuard configuration file as a database~~ (TODO). It assumes this interface and configuration exists. It only adds new peers to the configuration file and interface, and does not delete existing configuration.
Initial prototype server
2019-12-20 17:41:49 +08:00
Update README with usage
2019-12-21 18:50:10 +08:00
```
wireguard-negotiator server --endpoint wireguard-endpoint:port
```
Initial prototype server
2019-12-20 17:41:49 +08:00
The "server" also exposes the HTTP server with the following endpoints:
### `POST /request`
Request for the assignment of an IP address and accepted as a peer. This blocks until the server has finished configuring the peer, therefore the client SHOULD NOT timeout.
#### Request Body
Content-Type: application/x-www-form-urlencoded
| Name | Description | Required |
|------|-------------|----------|
| PublicKey | The public key of the "client" peer | X |
#### Response Body
Content-Type: application/json
| Name | Type | Description |
|------|------|-------------|
| PublicKey | String | Base64 encoded public key of the "server" peer |
| Endpoint | String | The endpoint of the "server" peer |
| PersistentKeepaliveInterval | Number | Suggests a PersistentKeepaliveInterval |
| AllowedIPs | []String | List of allowed IP addresses in CIDR notation |
| InterfaceIPs | []String | List of IP addresses assigned to the "client" interface |
## Client
The "client" sets up a WireGuard interface, and relies on network backends to do so. *It should not be run more than once*. The following network backends are supported:
- (Not implemented) `none`: Creates an interface and WireGuard configuration file
- `networkd`: Creates a `systemd.netdev` file in `/etc/systemd/network`
It does so by performing `POST /request` to the "server".
Update README with usage
2019-12-21 18:50:10 +08:00
```
wireguard-negotiator request --server https://url-of-server
```