From dc6d2fae598e053a6637a3d19908370ba98e9400 Mon Sep 17 00:00:00 2001 From: boban Date: Sun, 21 Jun 2026 22:11:25 +0200 Subject: [PATCH] fix(wg): endpoint auto-gets the listen port when given as a bare host (v0.9.43) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If the operator entered an endpoint without a port (e.g. "10.10.90.165" instead of "10.10.90.165:51820"), that value was written verbatim into every peer config. WireGuard requires the endpoint as host:port, so the WireGuard app rejected the QR/file import as "keine gültige WireGuard-Konfiguration" — the real cause of the invalid-config errors (the QR-size fix in 0.9.42 was secondary). Normalise host-side: append the listen port when the endpoint has no colon, in both _write_server_conf (setup — covers the dashboard and interactive paths) and _set_endpoint (later changes). Verified: bare host -> host:port, host:port left as-is, DNS host -> host:port; write-bridge smoke test still passes; shellcheck clean. setup_endpoint_hint (de/en) now documents the host:port format. Co-Authored-By: Claude Opus 4.8 --- CHANGELOG.md | 11 ++++++++++- config/clusev.php | 2 +- docker/wg/clusev-wg.sh | 10 ++++++++++ lang/de/wireguard.php | 2 +- lang/en/wireguard.php | 2 +- 5 files changed, 23 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a12a008..37cc8d5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,7 +13,16 @@ getaggte Releases (Kanal `stable`, optional `beta`) — niemals Entwicklungs-Bui _Keine offenen Änderungen — der nächste Stand wird hier gesammelt und als `vX.Y.Z` getaggt._ -## [0.9.42] - 2026-06-21 +## [0.9.43] - 2026-06-21 + +### Behoben +- **Endpoint ohne Port machte jede Client-Config ungültig.** Wurde beim Einrichten/Ändern nur ein + Host ohne Port eingegeben (z. B. `10.10.90.165` statt `10.10.90.165:51820`), landete dieser + Wert unverändert in den Peer-Configs — WireGuard verlangt aber zwingend `host:port`, sodass die + WireGuard-App den (QR- oder Datei-)Import als „keine gültige WireGuard-Konfiguration" ablehnte. + Der Listen-Port wird jetzt automatisch ergänzt, wenn der Endpoint keinen Port enthält (sowohl bei + der Einrichtung als auch beim späteren Ändern). Bestehende Konfigurationen: einmal den Endpoint + unter Einstellungen neu speichern (oder mit Port angeben), dann einen neuen Peer anlegen. ### Behoben - **Peer-QR-Code ließ sich am Handy nicht scannen („keine gültige WireGuard-Konfiguration").** Der diff --git a/config/clusev.php b/config/clusev.php index 405d133..7b35d1f 100644 --- a/config/clusev.php +++ b/config/clusev.php @@ -2,7 +2,7 @@ return [ // First tagged release is v0.1.0 (semantic, not -dev). - 'version' => '0.9.42', + 'version' => '0.9.43', // Deployed commit + branch. install.sh bakes these into .env from the host's .git (the prod // image ships no .git); the Versions page prefers them and falls back to a live .git read in diff --git a/docker/wg/clusev-wg.sh b/docker/wg/clusev-wg.sh index 6437d02..5b3f03a 100755 --- a/docker/wg/clusev-wg.sh +++ b/docker/wg/clusev-wg.sh @@ -318,6 +318,9 @@ _setup_noninteractive() { # and the first-peer add, since those differ (error style return-vs-die, _peer_add vs cmd_add_peer). _write_server_conf() { local subnet="$1" server_ip="$2" port="$3" endpoint="$4" + # WireGuard requires the endpoint as host:port. If the operator gave a bare host (no colon), + # append the listen port — otherwise every client config has an invalid `Endpoint =` line. + case "$endpoint" in *:*) ;; *) endpoint="${endpoint}:${port}" ;; esac umask 077; mkdir -p "$WG_DIR" "$STATE_DIR" local srv_priv srv_pub prefix srv_priv="$(wg genkey)"; srv_pub="$(printf '%s' "$srv_priv" | wg pubkey)" @@ -491,6 +494,13 @@ _set_endpoint() { local ep="$1"; require_setup # Re-validated here (defence-in-depth): the bare CLI path cmd_set_endpoint passes $1 unchecked. case "$ep" in *[!A-Za-z0-9.:_-]*|'') echo "bad endpoint" >&2; return 1 ;; esac + # WireGuard requires host:port — append the listen port if the operator gave a bare host (no colon). + if [ "${ep#*:}" = "$ep" ]; then + local _p + # shellcheck disable=SC1090 + _p="$( . "$WG_ENV" 2>/dev/null; printf '%s' "${WG_PORT:-51820}" )" + ep="${ep}:${_p}" + fi sed -i "s#^WG_ENDPOINT=.*#WG_ENDPOINT=${ep}#" "$WG_ENV" } diff --git a/lang/de/wireguard.php b/lang/de/wireguard.php index c7cc6d3..46ea970 100644 --- a/lang/de/wireguard.php +++ b/lang/de/wireguard.php @@ -83,7 +83,7 @@ return [ 'setup_subnet' => 'Subnetz', 'setup_port' => 'Listen-Port (UDP)', 'setup_endpoint' => 'Öffentlicher Endpoint (optional)', - 'setup_endpoint_hint' => 'Leer = automatisch erkannte öffentliche IP. Hinter NAT/Cloud-LB manuell setzen.', + 'setup_endpoint_hint' => 'Leer = automatisch erkannte öffentliche IP. Format host:port (z. B. 10.10.90.165:51820) — fehlt der Port, wird der Listen-Port ergänzt.', 'setup_peer' => 'Name des ersten Clients', 'setup_submit' => 'Einrichten', 'no_host_response' => 'Keine Antwort vom Host — der WireGuard-Host-Dienst läuft nicht. Stack aktualisieren (Version-Seite) und erneut versuchen.', diff --git a/lang/en/wireguard.php b/lang/en/wireguard.php index e664936..985f574 100644 --- a/lang/en/wireguard.php +++ b/lang/en/wireguard.php @@ -83,7 +83,7 @@ return [ 'setup_subnet' => 'Subnet', 'setup_port' => 'Listen port (UDP)', 'setup_endpoint' => 'Public endpoint (optional)', - 'setup_endpoint_hint' => 'Empty = auto-detected public IP. Behind NAT/cloud LB set it manually.', + 'setup_endpoint_hint' => 'Empty = auto-detected public IP. Format host:port (e.g. 10.10.90.165:51820) — if the port is missing the listen port is appended.', 'setup_peer' => 'First client name', 'setup_submit' => 'Set up', 'no_host_response' => 'No response from the host — the WireGuard host service is not running. Update the stack (Versions page) and try again.',