From 51c9702dcfa0abb6459ab8d35fea820134e6789b Mon Sep 17 00:00:00 2001
From: boban <boban@git.bave.dev>
Date: Sat, 20 Jun 2026 22:38:00 +0200
Subject: [PATCH] feat(wg): install wireguard-tools/qrencode + enable the gate
 unit (inert by default)

---
 install.sh | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/install.sh b/install.sh
index 50c8f3a..ef1125a 100755
--- a/install.sh
+++ b/install.sh
@@ -103,6 +103,15 @@ else
 fi
 info "openssl vorhanden"
 
+# WireGuard gate (clusev wg ...) — present but inert until the operator runs `clusev wg setup`.
+if [ "$IS_APT" = 1 ]; then
+  if DEBIAN_FRONTEND=noninteractive apt-get install -y wireguard-tools qrencode >/dev/null 2>&1; then
+    info "wireguard-tools + qrencode vorhanden"
+  else
+    warn "wireguard-tools/qrencode nicht installiert — 'clusev wg' erst nach 'apt-get install wireguard-tools qrencode' nutzbar."
+  fi
+fi
+
 # ── [2/9] dedicated clusev user ──────────────────────────────────────
 phase 2/9 "Benutzer clusev"
 USER_CREATED=0
@@ -278,24 +287,29 @@ install_host_watchers() {
   # Render the units with THIS project's path (the repo units default to /home/nexxo/clusev).
   local tmp_path tmp_svc tmp_upath tmp_usvc
   tmp_path="$(mktemp)"; tmp_svc="$(mktemp)"; tmp_upath="$(mktemp)"; tmp_usvc="$(mktemp)"
+  local tmp_gate; tmp_gate="$(mktemp)"
   # Restart units run as the clusev user.
   sed "s#/home/nexxo/clusev#${proj}#g" "${src}/clusev-restart.path" > "$tmp_path"
   sed -e "s#/home/nexxo/clusev#${proj}#g" -e "s/^User=.*/User=clusev/" "${src}/clusev-restart.service" > "$tmp_svc"
   # Update units keep User=root (only the path is rewritten).
   sed "s#/home/nexxo/clusev#${proj}#g" "${src}/clusev-update.path" > "$tmp_upath"
   sed "s#/home/nexxo/clusev#${proj}#g" "${src}/clusev-update.service" > "$tmp_usvc"
+  # Gate unit keeps User=root; only the path is rewritten.
+  sed "s#/home/nexxo/clusev#${proj}#g" "docker/wg/clusev-wg-gate.service" > "$tmp_gate"
   if install -m 0644 "$tmp_path" "${dst}/clusev-restart.path" \
      && install -m 0644 "$tmp_svc" "${dst}/clusev-restart.service" \
      && install -m 0644 "$tmp_upath" "${dst}/clusev-update.path" \
      && install -m 0644 "$tmp_usvc" "${dst}/clusev-update.service" \
+     && install -m 0644 "$tmp_gate" "${dst}/clusev-wg-gate.service" \
      && systemctl daemon-reload \
      && systemctl enable --now clusev-restart.path \
-     && systemctl enable --now clusev-update.path; then
+     && systemctl enable --now clusev-update.path \
+     && systemctl enable clusev-wg-gate.service; then
     info "Host-Watcher aktiv (clusev-restart.path User=clusev, clusev-update.path User=root)"
   else
     warn "Host-Watcher konnten nicht installiert werden — siehe ${src}/README.md."
   fi
-  rm -f "$tmp_path" "$tmp_svc" "$tmp_upath" "$tmp_usvc"
+  rm -f "$tmp_path" "$tmp_svc" "$tmp_upath" "$tmp_usvc" "$tmp_gate"
 }
 install_host_watchers