fix: WireGuard peers keep their tunnel key when others come and go (#32) #33

Merged

christianmanivong merged 2 commits from fix/wireguard-stable-keys-32 into main 2026-10-27 09:06:56 +00:00

Conversation 0 Commits 2 Files Changed 5

+190 -48

christianmanivong commented 2026-10-27 08:21:06 +00:00

Owner

Copy link

Copy source

Fixes #32.

get_vpn_tunnels() keyed WireGuard peers with a running counter, so a peer added ahead of an existing one renumbered every peer after it, and whatever a consumer stores per key moved to another peer.

The key is now wireguard-{interface}-{first 8 chars of the public key}, as in napalm-linux, with the base64 made URL-safe (+ → -, / → _) because the key is used as a URL path segment. Two peers sharing the prefix get the whole key; a row without a public key keeps its position. IPsec and OpenVPN keys were already stable.

Every WireGuard key changes once with this change. netOrk carries its per-tunnel metadata and checks across (NetOrk/netork#1654), so that change has to be deployed before or together with this pin.

Checked read-only against a live OPNsense 26.7 firewall with four peers on three interfaces: four distinct keys, one of them with a / turned into _.

Fixes #32. `get_vpn_tunnels()` keyed WireGuard peers with a running counter, so a peer added ahead of an existing one renumbered every peer after it, and whatever a consumer stores per key moved to another peer. The key is now `wireguard-{interface}-{first 8 chars of the public key}`, as in napalm-linux, with the base64 made URL-safe (`+` → `-`, `/` → `_`) because the key is used as a URL path segment. Two peers sharing the prefix get the whole key; a row without a public key keeps its position. IPsec and OpenVPN keys were already stable. **Every WireGuard key changes once with this change.** netOrk carries its per-tunnel metadata and checks across (NetOrk/netork#1654), so that change has to be deployed before or together with this pin. Checked read-only against a live OPNsense 26.7 firewall with four peers on three interfaces: four distinct keys, one of them with a `/` turned into `_`.

christianmanivong added 1 commit 2026-10-27 08:21:06 +00:00

fix: WireGuard peers keep their tunnel key when others come and go (#32) ... 9f45952605

get_vpn_tunnels() keyed WireGuard peers with a running counter over the
peer rows, so a peer added ahead of an existing one renumbered every peer
after it. Whatever a consumer stores per key moved with it: netOrk's site
link and tunnel check ended up on a new, offline peer and alarmed while the
real tunnel was up.

The key is now the interface and the start of the public key, as in
napalm-linux, made URL-safe because the key is a path segment. Two peers
sharing the prefix get the whole key; a row without a public key keeps its
position. IPsec and OpenVPN keys were already stable.

Every WireGuard key changes once; netOrk carries its
per-tunnel metadata across (netork#1654).

christianmanivong added 1 commit 2026-10-27 09:03:30 +00:00

refactor: WireGuard tunnels are read in their own module (#32) ... eaafa540e5

get_vpn_tunnels() grew past the quality baseline with the key fix. The
WireGuard part is pure parsing of /api/wireguard/service/show, like the
listen ports in listening.py, so it moves to wireguard.py and the driver
calls it. opnsense.py shrinks from 3125 to 3082 lines.

christianmanivong merged commit 9115628abe into main 2026-10-27 09:06:56 +00:00

christianmanivong deleted branch fix/wireguard-stable-keys-32 2026-10-27 09:06:56 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something is broken

enhancement

New feature or request

tech-debt

Refactoring / cleanup / deferred debt

prio

P0

Road blocker: blocks other work, drop everything

prio

P1

Critical

prio

P2

Important and urgent

prio

P3

Important, not urgent

prio

P4

Neither important nor urgent

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

christianmanivong

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: NAPALM/napalm-opnsense#33