feat(wg): WgStatus reader + auth-gated /wg-status.json route

app/Services/WgStatus.php

@@ -0,0 +1,78 @@
+<?php
+
+namespace App\Services;
+
+/**
+ * Reads + validates the host-written status file run/wg-status.json (bind-mounted to
+ * storage/app/restart-signal). Single source for the WireGuard page + the /wg-status.json route.
+ * Contains NO secrets — the collector never writes a private key.
+ */
+class WgStatus
+{
+    /** Status older than this (seconds) means the host collector is offline. */
+    private const STALE_AFTER = 20;
+
+    /** A peer with a handshake within this many seconds is considered online. */
+    private const ONLINE_WITHIN = 180;
+
+    private function path(): string
+    {
+        return storage_path('app/restart-signal/wg-status.json');
+    }
+
+    /**
+     * @return array{configured:bool, at:int, stale:bool, gate?:array, wg_quick?:string, server?:array, peers?:array}
+     */
+    public function read(): array
+    {
+        $path = $this->path();
+        $data = is_file($path) ? json_decode((string) @file_get_contents($path), true) : null;
+
+        if (! is_array($data)) {
+            return ['configured' => false, 'at' => 0, 'stale' => true];
+        }
+
+        $at = (int) ($data['at'] ?? 0);
+        $stale = $at < (time() - self::STALE_AFTER);
+
+        if (empty($data['configured'])) {
+            return ['configured' => false, 'at' => $at, 'stale' => $stale];
+        }
+
+        $peers = [];
+        foreach ((array) ($data['peers'] ?? []) as $p) {
+            if (! is_array($p)) {
+                continue;
+            }
+            $hs = (int) ($p['latest_handshake'] ?? 0);
+            $peers[] = [
+                'name' => (string) ($p['name'] ?? ''),
+                'pubkey' => (string) ($p['pubkey'] ?? ''),
+                'endpoint' => (string) ($p['endpoint'] ?? ''),
+                'latest_handshake' => $hs,
+                'rx' => (int) ($p['rx'] ?? 0),
+                'tx' => (int) ($p['tx'] ?? 0),
+                'online' => $hs > (time() - self::ONLINE_WITHIN),
+            ];
+        }
+
+        return [
+            'configured' => true,
+            'at' => $at,
+            'stale' => $stale,
+            'gate' => [
+                'marker' => (bool) ($data['gate']['marker'] ?? false),
+                'chain' => (bool) ($data['gate']['chain'] ?? false),
+            ],
+            'wg_quick' => (string) ($data['wg_quick'] ?? 'inactive'),
+            'server' => [
+                'subnet' => (string) ($data['server']['subnet'] ?? ''),
+                'server_ip' => (string) ($data['server']['server_ip'] ?? ''),
+                'port' => (int) ($data['server']['port'] ?? 0),
+                'endpoint' => (string) ($data['server']['endpoint'] ?? ''),
+                'pubkey' => (string) ($data['server']['pubkey'] ?? ''),
+            ],
+            'peers' => $peers,
+        ];
+    }
+}

routes/web.php

@@ -132,6 +132,8 @@ Route::middleware('auth')->group(function () {
         Route::get('/system', System\Index::class)->name('system');
         Route::get('/help', Help\Index::class)->name('help');
 
+        Route::get('/wg-status.json', fn (\App\Services\WgStatus $wg) => response()->json($wg->read()))->name('wg.status');
+
         // Plain Blade view — deliberately NOT a Livewire component so it survives the
         // container teardown that follows an update request (R1/R2 exception, by design).
         Route::get('/update-progress', function (Request $request) {

tests/Feature/WgStatusTest.php

@@ -0,0 +1,76 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use App\Services\WgStatus;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class WgStatusTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private string $file;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $dir = storage_path('app/restart-signal');
+        @mkdir($dir, 0775, true);
+        $this->file = $dir.'/wg-status.json';
+        @unlink($this->file);
+    }
+
+    protected function tearDown(): void
+    {
+        @unlink($this->file);
+        parent::tearDown();
+    }
+
+    public function test_absent_file_reads_as_unconfigured(): void
+    {
+        $s = app(WgStatus::class)->read();
+        $this->assertFalse($s['configured']);
+        $this->assertTrue($s['stale']);
+    }
+
+    public function test_parses_a_configured_status_with_peers(): void
+    {
+        file_put_contents($this->file, json_encode([
+            'at' => time(),
+            'configured' => true,
+            'gate' => ['marker' => true, 'chain' => true],
+            'wg_quick' => 'active',
+            'server' => ['subnet' => '10.99.0.0/24', 'server_ip' => '10.99.0.1', 'port' => 51820, 'endpoint' => '1.2.3.4:51820', 'pubkey' => 'srvpub'],
+            'peers' => [
+                ['name' => 'laptop', 'pubkey' => 'p1', 'endpoint' => '5.6.7.8:41820', 'latest_handshake' => time(), 'rx' => 100, 'tx' => 200],
+                ['name' => 'phone', 'pubkey' => 'p2', 'endpoint' => '', 'latest_handshake' => 0, 'rx' => 0, 'tx' => 0],
+            ],
+        ]));
+
+        $s = app(WgStatus::class)->read();
+        $this->assertTrue($s['configured']);
+        $this->assertFalse($s['stale']);
+        $this->assertTrue($s['gate']['marker']);
+        $this->assertSame(51820, $s['server']['port']);
+        $this->assertCount(2, $s['peers']);
+        $this->assertTrue($s['peers'][0]['online']);
+        $this->assertFalse($s['peers'][1]['online']);
+    }
+
+    public function test_stale_when_at_is_old(): void
+    {
+        file_put_contents($this->file, json_encode(['at' => time() - 999, 'configured' => true, 'peers' => []]));
+        $this->assertTrue(app(WgStatus::class)->read()['stale']);
+    }
+
+    public function test_route_requires_auth_and_returns_status(): void
+    {
+        $this->get('/wg-status.json')->assertRedirect('/login');
+
+        file_put_contents($this->file, json_encode(['at' => time(), 'configured' => false]));
+        $this->actingAs(User::factory()->create(['must_change_password' => false]))
+            ->getJson('/wg-status.json')->assertOk()->assertJson(['configured' => false]);
+    }
+}