115 lines
4.1 KiB
PHP
115 lines
4.1 KiB
PHP
<?php
|
|
|
|
namespace App\Provisioning\Jobs;
|
|
|
|
use App\Models\VpnPeer;
|
|
use App\Services\Wireguard\WireguardHub;
|
|
use Illuminate\Support\Facades\Cache;
|
|
use Illuminate\Support\Facades\Log;
|
|
use Illuminate\Bus\Queueable;
|
|
use Illuminate\Contracts\Queue\ShouldQueue;
|
|
use Illuminate\Foundation\Bus\Dispatchable;
|
|
use Illuminate\Queue\InteractsWithQueue;
|
|
use Illuminate\Queue\SerializesModels;
|
|
|
|
/**
|
|
* Push one peer's desired state onto the hub. Runs on the provisioning queue
|
|
* because that is the only worker whose container owns wg0.
|
|
*
|
|
* Takes the public key rather than the model for the removal case: the row is
|
|
* already gone by then, and the hub still has to be told.
|
|
*/
|
|
class ApplyVpnPeer implements ShouldQueue
|
|
{
|
|
use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
|
|
|
|
public int $tries = 3;
|
|
|
|
public function __construct(
|
|
public string $publicKey,
|
|
public ?string $allowedIp,
|
|
public bool $enabled,
|
|
/**
|
|
* Revoke this key no matter what the database says.
|
|
*
|
|
* Needed when a key is replaced: for a moment the old key is live on the
|
|
* hub with no row behind it, and a sync running in that window adopts it
|
|
* as an unknown peer — enabled. Without this flag the removal would then
|
|
* read that row, decide the key should stay, and leave two peers
|
|
* claiming the same tunnel address. Forcing can only ever remove, so it
|
|
* cannot resurrect anything.
|
|
*/
|
|
public bool $force = false,
|
|
) {
|
|
$this->onQueue('provisioning');
|
|
}
|
|
|
|
public static function for(VpnPeer $peer): self
|
|
{
|
|
return new self($peer->public_key, $peer->allowed_ip, $peer->enabled);
|
|
}
|
|
|
|
public function handle(WireguardHub $hub): void
|
|
{
|
|
// Shared with SyncVpnPeers so a reconciliation cannot read the hub
|
|
// around this mutation and then act on what it saw.
|
|
Cache::lock('wireguard:hub', 30)->block(10, fn () => $this->apply($hub));
|
|
}
|
|
|
|
private function apply(WireguardHub $hub): void
|
|
{
|
|
// Read the CURRENT desired state rather than the one captured at
|
|
// dispatch time. A retried block job would otherwise undo an unblock
|
|
// that happened in the meantime, and nothing would ever put it back:
|
|
// SyncVpnPeers only observes, it never re-applies intent.
|
|
$peer = VpnPeer::withTrashed()->where('public_key', $this->publicKey)->first();
|
|
|
|
// A missing row can only mean the access is gone — deleted, tombstone
|
|
// already purged. A stale enable payload must never be able to re-add a
|
|
// key that no longer has a row to revoke it with, so the captured state
|
|
// can only ever remove, never enable.
|
|
$enabled = ! $this->force && $peer !== null && ! $peer->trashed() && $peer->enabled;
|
|
$ip = $peer?->allowed_ip ?? $this->allowedIp;
|
|
|
|
// Checked before touching the hub: a forced revocation whose key has
|
|
// since been re-issued to someone else must not disconnect them.
|
|
if ($this->force && $peer !== null
|
|
&& ! ($peer->kind === VpnPeer::KIND_SYSTEM && $peer->created_by === null && $peer->user_id === null)) {
|
|
Log::info('forced revocation skipped: the key belongs to a live access again', [
|
|
'peer' => $peer->uuid,
|
|
]);
|
|
|
|
return;
|
|
}
|
|
|
|
if ($enabled && $ip !== null) {
|
|
$hub->addPeer($this->publicKey, $ip);
|
|
} else {
|
|
$hub->removePeer($this->publicKey);
|
|
}
|
|
|
|
// Adoption artifact cleaned up; the guard above already sent anything
|
|
// else home.
|
|
if ($this->force && $peer !== null) {
|
|
$peer->forceDelete();
|
|
|
|
return;
|
|
}
|
|
|
|
if ($peer === null) {
|
|
return;
|
|
}
|
|
|
|
// The tombstone has served its purpose once the hub has dropped the peer.
|
|
if ($peer->trashed()) {
|
|
$peer->forceDelete();
|
|
|
|
return;
|
|
}
|
|
|
|
// Reflect the change immediately instead of waiting for the next sync,
|
|
// so the console does not sit on "wird angewendet" for a whole minute.
|
|
$peer->update(['present' => $enabled, 'observed_at' => now()]);
|
|
}
|
|
}
|