boban
/
CluPilotCloud
1
0
Fork 0
Code Issues Pull Requests Actions 45 Packages Projects Releases Wiki Activity

fix(engine): store wg_pubkey right after addPeer so failed peers are cleanable 

Keeps the wg_peer resource gated on a verified handshake (idempotency) while
ensuring PurgeHost can always remove the hub peer, even on terminal failure.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
feat/portal-design
nexxo 2026-07-25 11:07:41 +02:00
parent 9e664654a2
commit 294c9aef2f
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
app/Provisioning/Steps/Host/ConfigureWireguard.php
View File

@ -63,14 +63,15 @@ class ConfigureWireguard extends HostStep
$this->hub->addPeer($publicKey, $wgIp); $this->hub->addPeer($publicKey, $wgIp);
// Verify the tunnel BEFORE recording the peer as provisioned. If the // Store the pubkey now (so removal can always clean up the hub peer), but
// handshake isn't up we retry and re-run the full setup next time (no // record the wg_peer resource only AFTER the handshake verifies — the
// wg_peer resource yet), instead of skipping a broken configuration. // idempotent short-circuit must not skip an un-verified configuration.
$host->update(['wg_pubkey' => $publicKey]);
if ($this->verifyHandshake()->type !== StepResult::ADVANCE) { if ($this->verifyHandshake()->type !== StepResult::ADVANCE) {
return StepResult::retry(15, 'WireGuard handshake not up yet'); return StepResult::retry(15, 'WireGuard handshake not up yet');
} }
$host->update(['wg_pubkey' => $publicKey]);
$this->recordResource($run, $host, 'wg_peer', $publicKey); $this->recordResource($run, $host, 'wg_peer', $publicKey);
return StepResult::advance(); return StepResult::advance();