From 294c9aef2f90e85edb3840c5215facad5dfdf57d Mon Sep 17 00:00:00 2001 From: nexxo Date: Sat, 25 Jul 2026 11:07:41 +0200 Subject: [PATCH] fix(engine): store wg_pubkey right after addPeer so failed peers are cleanable Keeps the wg_peer resource gated on a verified handshake (idempotency) while ensuring PurgeHost can always remove the hub peer, even on terminal failure. Co-Authored-By: Claude Opus 4.8 --- app/Provisioning/Steps/Host/ConfigureWireguard.php | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/app/Provisioning/Steps/Host/ConfigureWireguard.php b/app/Provisioning/Steps/Host/ConfigureWireguard.php index 959aa83..304bdb9 100644 --- a/app/Provisioning/Steps/Host/ConfigureWireguard.php +++ b/app/Provisioning/Steps/Host/ConfigureWireguard.php @@ -63,14 +63,15 @@ class ConfigureWireguard extends HostStep $this->hub->addPeer($publicKey, $wgIp); - // Verify the tunnel BEFORE recording the peer as provisioned. If the - // handshake isn't up we retry and re-run the full setup next time (no - // wg_peer resource yet), instead of skipping a broken configuration. + // Store the pubkey now (so removal can always clean up the hub peer), but + // record the wg_peer resource only AFTER the handshake verifies — the + // idempotent short-circuit must not skip an un-verified configuration. + $host->update(['wg_pubkey' => $publicKey]); + if ($this->verifyHandshake()->type !== StepResult::ADVANCE) { return StepResult::retry(15, 'WireGuard handshake not up yet'); } - $host->update(['wg_pubkey' => $publicKey]); $this->recordResource($run, $host, 'wg_peer', $publicKey); return StepResult::advance();