92 lines
3.3 KiB
PHP
92 lines
3.3 KiB
PHP
<?php
|
|
|
|
namespace App\Provisioning\Steps\Host;
|
|
|
|
use App\Models\Host;
|
|
use App\Models\ProvisioningRun;
|
|
use App\Provisioning\StepResult;
|
|
use App\Services\Ssh\RemoteShell;
|
|
use App\Services\Wireguard\WireguardHub;
|
|
use Illuminate\Support\Facades\Cache;
|
|
|
|
/**
|
|
* Installs WireGuard on the host, allocates a management IP, registers the host
|
|
* as a peer on the CluPilot hub, and verifies the tunnel is up.
|
|
*/
|
|
class ConfigureWireguard extends HostStep
|
|
{
|
|
public function __construct(private RemoteShell $shell, private WireguardHub $hub) {}
|
|
|
|
public function key(): string
|
|
{
|
|
return 'configure_wireguard';
|
|
}
|
|
|
|
public function execute(ProvisioningRun $run): StepResult
|
|
{
|
|
$host = $this->host($run);
|
|
$alreadyProvisioned = filled($host->wg_ip) && $this->hasResource($run, 'wg_peer');
|
|
|
|
$this->keyLogin($this->shell, $host);
|
|
|
|
if (! $alreadyProvisioned) {
|
|
$this->shell->run('export DEBIAN_FRONTEND=noninteractive; apt-get install -y wireguard');
|
|
$this->shell->run('test -f /etc/wireguard/privatekey || (umask 077; wg genkey > /etc/wireguard/privatekey)');
|
|
|
|
$publicKey = trim($this->shell->run('wg pubkey < /etc/wireguard/privatekey')->stdout);
|
|
if (blank($publicKey)) {
|
|
return StepResult::retry(20, 'could not read host WireGuard public key');
|
|
}
|
|
|
|
// Allocate + reserve the management IP atomically so concurrent
|
|
// onboarding runs can never receive the same address.
|
|
$wgIp = Cache::lock('wireguard:allocate', 30)->block(10, function () use ($host) {
|
|
$ip = $host->wg_ip ?: $this->hub->allocateIp();
|
|
if (blank($host->wg_ip)) {
|
|
$host->update(['wg_ip' => $ip]);
|
|
}
|
|
|
|
return $ip;
|
|
});
|
|
|
|
$privateKey = trim($this->shell->run('cat /etc/wireguard/privatekey')->stdout);
|
|
|
|
$this->shell->putFile('/etc/wireguard/wg0.conf', $this->renderConfig($wgIp, $privateKey));
|
|
$this->shell->run('systemctl enable --now wg-quick@wg0 || wg-quick up wg0');
|
|
|
|
$this->hub->addPeer($publicKey, $wgIp);
|
|
|
|
// Persist external identity BEFORE verifying/advancing (crash-safe).
|
|
$host->update(['wg_pubkey' => $publicKey]);
|
|
$this->recordResource($run, $host, 'wg_peer', $publicKey);
|
|
}
|
|
|
|
// Always verify the tunnel is up — including the idempotent replay path,
|
|
// so we never advance onto Proxmox API calls over a dead tunnel.
|
|
$hubIp = (string) config('provisioning.wireguard.hub_ip');
|
|
if (! $this->shell->run('ping -c1 -W2 '.escapeshellarg($hubIp))->ok()) {
|
|
return StepResult::retry(15, 'WireGuard handshake not up yet');
|
|
}
|
|
|
|
return StepResult::advance();
|
|
}
|
|
|
|
private function renderConfig(string $wgIp, string $privateKey): string
|
|
{
|
|
$subnet = (string) config('provisioning.wireguard.subnet', '10.66.0.0/24');
|
|
|
|
return implode("\n", [
|
|
'[Interface]',
|
|
"Address = {$wgIp}/24",
|
|
"PrivateKey = {$privateKey}",
|
|
'',
|
|
'[Peer]',
|
|
'PublicKey = '.$this->hub->publicKey(),
|
|
'Endpoint = '.$this->hub->endpoint(),
|
|
"AllowedIPs = {$subnet}",
|
|
'PersistentKeepalive = 25',
|
|
'',
|
|
]);
|
|
}
|
|
}
|