lofyerandfactory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
1b227c2470
- Interface model with per-interface subnet/port/keys; import/adopt existing wg-quick configs (key-less imported peers, optional key rotation), cascade delete - Split wireguard.py into a package (keys via cryptography X25519, status, addressing, conf parse/render, sync, host tuning) - ECharts horizontal topology view (interface -> peers -> site subnets) - Advanced options: MTU, MSS clamping, FwMark/Table, custom PostUp/PostDown, per-peer keepalive override - Runtime settings (sample interval/retention, online threshold, UI refresh) with traffic sample pruning; host tuning (UDP buffers, backlog, GRO forwarding) - Precompiled Tailwind CSS replacing Play CDN runtime (fixes FOUC); stable table layout and diffed polling renders - Host network mode in compose; NAT/isolation iptables moved into app sync Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
27 lines
1.2 KiB
Bash
27 lines
1.2 KiB
Bash
#!/bin/sh
|
|
set -e
|
|
|
|
# Host network mode shares the host network namespace, so forwarding is
|
|
# enabled here instead of via per-container sysctls.
|
|
sysctl -w net.ipv4.ip_forward=1 >/dev/null 2>&1 || \
|
|
echo "WARN: could not enable net.ipv4.ip_forward, set it on the host"
|
|
sysctl -w net.ipv4.conf.all.src_valid_mark=1 >/dev/null 2>&1 || true
|
|
|
|
# NAT and peer isolation rules are managed per interface by the app
|
|
# (app/wireguard/sync.py) when configs are applied.
|
|
|
|
# Relay wg clients into extra networks (e.g. another wg tunnel on the host).
|
|
WG_SUBNET="${WG_SUBNET:-10.8.0.0/24}"
|
|
OLD_IFS="$IFS"; IFS=','
|
|
for subnet in ${WG_RELAY_SUBNETS:-}; do
|
|
subnet="$(echo "$subnet" | tr -d ' ')"
|
|
[ -n "$subnet" ] || continue
|
|
relay_iface="$(ip route get "${subnet%/*}" 2>/dev/null | awk '/dev/ {for (i=1;i<NF;i++) if ($i=="dev") print $(i+1); exit}')"
|
|
[ -n "$relay_iface" ] || { echo "WARN: no route to relay subnet $subnet, skipping"; continue; }
|
|
iptables -t nat -C POSTROUTING -s "$WG_SUBNET" -d "$subnet" -o "$relay_iface" -j MASQUERADE 2>/dev/null \
|
|
|| iptables -t nat -A POSTROUTING -s "$WG_SUBNET" -d "$subnet" -o "$relay_iface" -j MASQUERADE
|
|
done
|
|
IFS="$OLD_IFS"
|
|
|
|
exec uvicorn app.main:app --host 0.0.0.0 --port 8000
|