61 lines
2.1 KiB
PHP
61 lines
2.1 KiB
PHP
<?php
|
|
|
|
namespace App\Services\Wireguard;
|
|
|
|
use App\Models\Host;
|
|
use Illuminate\Support\Facades\Process;
|
|
use RuntimeException;
|
|
|
|
/**
|
|
* Real hub on the CluPilot VM. Allocates the next free address in the configured
|
|
* subnet and manages peers with `wg`. Watch-item: the app runs in a container, so
|
|
* the wg interface must be reachable from here (host network / mounted config);
|
|
* verified on the real VM, not in the mocked test-suite.
|
|
*/
|
|
class LocalWireguardHub implements WireguardHub
|
|
{
|
|
public function allocateIp(): string
|
|
{
|
|
$used = array_flip(Host::query()->whereNotNull('wg_ip')->pluck('wg_ip')->all());
|
|
$hubIp = (string) config('provisioning.wireguard.hub_ip');
|
|
|
|
[$network, $bits] = explode('/', config('provisioning.wireguard.subnet', '10.66.0.0/24'));
|
|
$bits = (int) $bits;
|
|
$hostBits = 32 - $bits;
|
|
$size = 2 ** $hostBits;
|
|
$base = ip2long($network) & (0xFFFFFFFF << $hostBits) & 0xFFFFFFFF;
|
|
|
|
// Skip the network address (offset 0) and broadcast (offset size-1).
|
|
for ($offset = 1; $offset < $size - 1; $offset++) {
|
|
$ip = long2ip($base + $offset);
|
|
if ($ip !== $hubIp && ! isset($used[$ip])) {
|
|
return $ip;
|
|
}
|
|
}
|
|
|
|
throw new RuntimeException('WireGuard management subnet exhausted.');
|
|
}
|
|
|
|
public function addPeer(string $publicKey, string $ip): void
|
|
{
|
|
Process::run(['wg', 'set', 'wg0', 'peer', $publicKey, 'allowed-ips', $ip.'/32'])->throw();
|
|
Process::run('wg-quick save wg0')->throw(); // persist, else the peer is lost on restart
|
|
}
|
|
|
|
public function removePeer(string $publicKey): void
|
|
{
|
|
Process::run(['wg', 'set', 'wg0', 'peer', $publicKey, 'remove'])->throw();
|
|
Process::run('wg-quick save wg0')->throw(); // persist, else the peer is lost on restart
|
|
}
|
|
|
|
public function endpoint(): string
|
|
{
|
|
return (string) config('provisioning.wireguard.endpoint');
|
|
}
|
|
|
|
public function publicKey(): string
|
|
{
|
|
return (string) config('provisioning.wireguard.hub_public_key');
|
|
}
|
|
}
|