fix(devcontainer): bake wg + qrencode into the image instead of splitting the VPN procedure across host and container
Operator correction: "sop, wg, and any other tool requirement is supposed to be
baked into the devcontainer."
My previous commit discovered that `wg` existed only on the host, `sops` only in
the container, and `qrencode` on neither -- and fixed it the wrong way, by
splitting every step of the key procedure across the boundary and telling the
operator to `dnf install qrencode` on their workstation. That breaks CLAUDE.md §5
and the devcontainer README's "Don't install the toolchain on the host", produces
a procedure that cannot be reproduced in CI, and is miserable to follow.
wireguard-tools + qrencode are now distro packages in the Containerfile. Both are
in Fedora 44's repos (wireguard-tools 1.0.20260223 -- the same upstream version as
the image this component runs -- and qrencode 4.1.1), unpinned like every other
dnf package there: the pinned thing is the Fedora base, and neither is a gate tool
whose version changes what green means.
Three things got SIMPLER rather than merely relocated, which is the tell that the
rule was right:
* Step 2 is one pipeline in one shell -- `sops set ... "$(wg genkey)"` writes the
key straight into the already-encrypted document. No staged copy in .cache, no
`*.key`-suffix warning, no sha256 comparison to prove the right bytes landed.
* new-peer.sh derives the server public key from wg-server-key.sops.yaml itself
(`sops -d --extract | wg pubkey`), so there is no local key copy to keep in
step with the encrypted one, and no magic host path it must live at.
* `.cache/` is gitignored at the repo root (mirroring infra/ansible/.gitignore),
giving the container a persistent non-committable scratch dir. new-peer.sh
writes profiles to .cache/wg-peers/ -- necessary because the repo bind-mount is
the container's only persistent read-write mount, so a profile in /tmp there is
gone before it can reach a desktop. Its blanket "refuse to write inside the
checkout" guard is now a `git check-ignore` test of the real property.
Verified by execution, not reasoning: the image rebuilds; wg/qrencode/sops all
resolve in it; `sops -d | wg pubkey` runs in one shell; new-peer.sh refuses the
REPLACE-ME placeholder with an actionable message; and a full run with a throwaway
server key renders a correct profile at 0600 under a 0700 gitignored dir, prints
the QR, and refuses a non-ignored destination inside the repo.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
This commit is contained in:
jakman85andClaude Opus 5 committed
1 parent
e35612dc7e
commit
8059297036
7 files changed
+212
-123
No files matched your search
@@ -32,9 +32,23 @@ ARG TARGETARCH=amd64
|
||||
# Distro packages: libvirt client libs (harmless disk-image utilities), ansible, ssh,
|
||||
# disk-image + cloud-init seed tooling, python3-pip (for the pip-installed test tools),
|
||||
# diffutils (provides `diff`, used by L1 golden render checks), and common utilities.
|
||||
#
|
||||
# wireguard-tools + qrencode serve the REMOTE-ACCESS VPN (platform/vpn-ingress):
|
||||
# * wireguard-tools gives `wg genkey` / `wg pubkey`, needed to mint the server key and to derive
|
||||
# every client profile's `[Peer] PublicKey` (infra/vpn-ingress/new-peer.sh).
|
||||
# * qrencode renders a client profile as a QR code, which is how a PHONE gets enrolled.
|
||||
# They are here rather than on the operator's host because this image is THE toolchain
|
||||
# (CLAUDE.md §5; README "Don't install the toolchain on the host"). That rule was briefly broken
|
||||
# by a runbook that told the operator to run `wg` on the host and `sops` in here, and then split
|
||||
# every step across the boundary to work around it — a procedure nobody should have to follow, and
|
||||
# one that cannot be reproduced in CI. Both tools in one image means `sops -d … | wg pubkey` is
|
||||
# just a pipeline again.
|
||||
# Unpinned on purpose, like every other dnf package here: the Fedora base is what is pinned
|
||||
# (FEDORA_VERSION), and these are not gate tools whose version changes what green means.
|
||||
RUN dnf -y install --setopt=install_weak_deps=False \
|
||||
libvirt-client qemu-img cloud-utils genisoimage openssh-clients \
|
||||
ansible-core python3-libvirt python3-pip diffutils \
|
||||
wireguard-tools qrencode \
|
||||
git make jq unzip tar gzip xz which ca-certificates curl \
|
||||
&& dnf clean all
|
||||
|
||||
|
||||
@@ -14,6 +14,7 @@ baseline, and the *same* binaries CI uses.
|
||||
| Provisioning | OpenTofu (`bpg/proxmox` provider), `ansible-core`, `openssh-clients` |
|
||||
| GitOps / cluster | `flux`, `kubectl`, `helm` |
|
||||
| Secrets | `sops`, `age` + `age-keygen` |
|
||||
| VPN (`platform/vpn-ingress`) | `wg` (wireguard-tools) — mint the server key, derive client public keys; `qrencode` — render a client profile as a phone-scannable QR |
|
||||
| **CI gate** | `yamllint`, `check-jsonschema`, `kyverno` CLI, `kyverno-json`, `chainsaw`, `yq`, `diffutils`, `make` |
|
||||
| Misc | `qemu-img`, `cloud-utils`/`genisoimage`, `libvirt-client` (disk-image utilities only — leftovers from the libvirt era, harmless) |
|
||||
|
||||
|
||||
@@ -2,10 +2,24 @@
|
||||
# =================================================================================================
|
||||
# new-peer.sh — enrol one device on the remote-access VPN (platform/vpn-ingress).
|
||||
#
|
||||
# Generates a WireGuard keypair ON THIS MACHINE, renders the device's client profile, optionally
|
||||
# prints a QR code for a phone, and prints the one `[Peer]` stanza to paste into
|
||||
# platform/vpn-ingress/peers.yaml. The private half NEVER leaves this machine: it is not sent to the
|
||||
# cluster, not committed, and not written to any log.
|
||||
# Generates a WireGuard keypair, renders the device's client profile, prints a QR code for a phone,
|
||||
# and prints the one `[Peer]` stanza to paste into platform/vpn-ingress/peers.yaml. The device's
|
||||
# private half is written to ONE 0600 file and nowhere else: not sent to the cluster, not committed,
|
||||
# never logged.
|
||||
#
|
||||
# RUN IT IN THE DEV CONTAINER — that is where the toolchain lives (CLAUDE.md §5):
|
||||
#
|
||||
# ./infra/devcontainer/dev.sh run bash -c './infra/vpn-ingress/new-peer.sh pixel-8 2'
|
||||
#
|
||||
# It needs `wg` (wireguard-tools), `qrencode` and `sops`, all three baked into the image. It will
|
||||
# run on a host that happens to have them too, but the container is the supported way and the only
|
||||
# one that is reproducible.
|
||||
#
|
||||
# THE SERVER'S PUBLIC KEY IS DERIVED FROM THE ENCRYPTED FILE, not from a copy you keep lying around:
|
||||
# `sops -d` the private half out of platform/vpn-ingress/wg-server-key.sops.yaml and pipe it
|
||||
# straight into `wg pubkey`. The plaintext never touches disk and never reaches a terminal. (This
|
||||
# is why both tools being in ONE image matters — see the Containerfile comment.) Override with
|
||||
# WG_SERVER_PUBKEY or WG_SERVER_KEY_FILE if you are working off-tree.
|
||||
#
|
||||
# WHY A SCRIPT AND NOT A RUNBOOK STEP. Three of these fields are easy to get wrong in ways that are
|
||||
# either silently insecure or silently broken, and all three are mechanical:
|
||||
@@ -25,17 +39,23 @@
|
||||
# <last-octet> 2-254, the device's address inside WG_CLIENT_CIDR. Must be unused.
|
||||
# --split split tunnel: route ONLY the LAN and the tunnel subnet. Default is a FULL
|
||||
# tunnel (0.0.0.0/0) so the device also egresses the house WAN.
|
||||
# --out DIR where to write the profile (default: a 0700 dir under $TMPDIR).
|
||||
# --out DIR where to write the profile. Default: `.cache/wg-peers/` in the repo, which is
|
||||
# GITIGNORED (`.gitignore` `.cache/`) and, unlike /tmp inside the container,
|
||||
# survives the container exiting — the repo is its only persistent read-write
|
||||
# mount, so a profile written anywhere else is gone before you can move it to a
|
||||
# desktop. The script refuses any destination git does not ignore.
|
||||
#
|
||||
# ENVIRONMENT
|
||||
# WG_SERVER_KEY_FILE server PRIVATE key (default ~/.config/wireguard-home/server.key); its public
|
||||
# half is derived from it. Alternatively set WG_SERVER_PUBKEY directly.
|
||||
# WG_SERVER_PUBKEY the server's public key, if you want to skip the SOPS decrypt entirely.
|
||||
# WG_SERVER_KEY_FILE a local copy of the server PRIVATE key to derive the public half from,
|
||||
# instead of reading the SOPS file.
|
||||
# WG_SERVER_SOPS_FILE default platform/vpn-ingress/wg-server-key.sops.yaml
|
||||
# WG_ENDPOINT_HOST default wan.home.keithjackson.dev
|
||||
# WG_CLIENT_CIDR default 10.90.0.0/24 (must match clusters/base/cluster-vars.yaml)
|
||||
# WG_LAN_CIDR default 192.168.2.0/24 (prod LAN_CIDR)
|
||||
# WG_DNS default 192.168.2.23 (prod PIHOLE_DNS_VIP)
|
||||
#
|
||||
# REQUIRES: wireguard-tools (`wg`). `qrencode` is optional and only used for the QR code.
|
||||
# REQUIRES: `wg`, `qrencode`, `sops` — all three in the dev container.
|
||||
# =================================================================================================
|
||||
set -euo pipefail
|
||||
|
||||
@@ -51,7 +71,7 @@ PEERS_FILE="${REPO_ROOT}/platform/vpn-ingress/peers.yaml"
|
||||
: "${WG_CLIENT_CIDR:=10.90.0.0/24}" # clusters/base/cluster-vars.yaml
|
||||
: "${WG_LAN_CIDR:=192.168.2.0/24}" # clusters/prod LAN_CIDR
|
||||
: "${WG_DNS:=192.168.2.23}" # clusters/prod PIHOLE_DNS_VIP
|
||||
: "${WG_SERVER_KEY_FILE:=${HOME}/.config/wireguard-home/server.key}"
|
||||
: "${WG_SERVER_SOPS_FILE:=${REPO_ROOT}/platform/vpn-ingress/wg-server-key.sops.yaml}"
|
||||
# wan.<base-domain> is an UNPROXIED A record that platform/externaldns/ddns.yaml keeps pointed at
|
||||
# the current WAN IP (checked every 5 min). Use it, never a literal address: this house has a
|
||||
# DYNAMIC WAN IP, and a profile pinned to today's address stops working without warning and with no
|
||||
@@ -83,14 +103,28 @@ printf '%s' "$NAME" | grep -Eq '^[a-z0-9][a-z0-9-]{0,30}$' \
|
||||
printf '%s' "$OCTET" | grep -Eq '^[0-9]+$' || die "octet must be a number: got '$OCTET'"
|
||||
[ "$OCTET" -ge 2 ] && [ "$OCTET" -le 254 ] || die "octet must be 2-254 (.1 is the server): got '$OCTET'"
|
||||
|
||||
command -v wg >/dev/null || die "wireguard-tools not installed ('wg' not on PATH). Debian/Ubuntu: apt install wireguard-tools"
|
||||
command -v wg >/dev/null || die "'wg' not on PATH. Run this inside the dev container:
|
||||
./infra/devcontainer/dev.sh run bash -c './infra/vpn-ingress/new-peer.sh $NAME $OCTET'"
|
||||
|
||||
# --- the server's public key --------------------------------------------------------------------
|
||||
# Order: an explicit pubkey, then a local private-key file, then the SOPS file in the tree. The
|
||||
# last is the normal path and needs no local copy of anything.
|
||||
if [ -z "${WG_SERVER_PUBKEY:-}" ]; then
|
||||
[ -r "$WG_SERVER_KEY_FILE" ] || die "cannot read server key '$WG_SERVER_KEY_FILE'.
|
||||
Either point WG_SERVER_KEY_FILE at it, or set WG_SERVER_PUBKEY to the public half.
|
||||
If the server key does not exist yet, see runbooks/vpn-remote-access.md step 2."
|
||||
WG_SERVER_PUBKEY="$(tr -d ' \r\n' < "$WG_SERVER_KEY_FILE" | wg pubkey)"
|
||||
if [ -n "${WG_SERVER_KEY_FILE:-}" ]; then
|
||||
[ -r "$WG_SERVER_KEY_FILE" ] || die "cannot read WG_SERVER_KEY_FILE '$WG_SERVER_KEY_FILE'"
|
||||
WG_SERVER_PUBKEY="$(tr -d ' \r\n' < "$WG_SERVER_KEY_FILE" | wg pubkey)"
|
||||
else
|
||||
command -v sops >/dev/null || die "'sops' not on PATH. Run this inside the dev container (see --help)."
|
||||
[ -r "$WG_SERVER_SOPS_FILE" ] || die "cannot read '$WG_SERVER_SOPS_FILE'"
|
||||
# The decrypted private key goes straight into `wg pubkey` — never to a file, never to a tty.
|
||||
# `wg pubkey` fails on the committed REPLACE-ME placeholder, which is the useful error here.
|
||||
WG_SERVER_PUBKEY="$(sops -d --extract '["stringData"]["privatekey"]' "$WG_SERVER_SOPS_FILE" \
|
||||
| tr -d ' \r\n' | wg pubkey 2>/dev/null)" || WG_SERVER_PUBKEY=""
|
||||
[ -n "$WG_SERVER_PUBKEY" ] || die "could not derive the server public key from
|
||||
$WG_SERVER_SOPS_FILE
|
||||
Either it still holds the REPLACE-ME placeholder (see runbooks/vpn-remote-access.md step 2),
|
||||
or this shell cannot decrypt it (the age keyring is mounted at ~/.config/sops in the container)."
|
||||
fi
|
||||
fi
|
||||
|
||||
CLIENT_BASE="${WG_CLIENT_CIDR%/*}"; CLIENT_BASE="${CLIENT_BASE%.*}"
|
||||
@@ -107,14 +141,22 @@ if [ -r "$PEERS_FILE" ] && grep -qi "^ *# *${NAME} " "$PEERS_FILE"; then
|
||||
fi
|
||||
|
||||
# --- output location: 0700, and never inside the repo -------------------------------------------
|
||||
if [ -z "$OUT_DIR" ]; then
|
||||
OUT_DIR="$(mktemp -d "${TMPDIR:-/tmp}/wg-peer-XXXXXX")"
|
||||
else
|
||||
mkdir -p "$OUT_DIR"
|
||||
fi
|
||||
[ -n "$OUT_DIR" ] || OUT_DIR="${REPO_ROOT}/.cache/wg-peers"
|
||||
mkdir -p "$OUT_DIR"
|
||||
chmod 700 "$OUT_DIR"
|
||||
case "$(cd "$OUT_DIR" && pwd)" in
|
||||
"$REPO_ROOT"|"$REPO_ROOT"/*) die "refusing to write a private key inside the git checkout ($OUT_DIR)" ;;
|
||||
OUT_ABS="$(cd "$OUT_DIR" && pwd)"
|
||||
# A profile holds a private key, so the destination must not be committable. Inside the repo that
|
||||
# means git must IGNORE it — test the real property rather than a proxy, because the repo is the
|
||||
# container's only persistent read-write mount and so the only sane place to write. Outside the
|
||||
# repo, anywhere goes.
|
||||
case "$OUT_ABS" in
|
||||
"$REPO_ROOT"|"$REPO_ROOT"/*)
|
||||
if ! git -C "$REPO_ROOT" check-ignore -q "$OUT_ABS/probe.conf" 2>/dev/null; then
|
||||
die "refusing to write a private key to '$OUT_ABS': it is inside the git checkout and NOT
|
||||
gitignored, so the profile would be committable. Use the default (.cache/wg-peers) or add an
|
||||
ignore rule first. Verify with: git check-ignore -v <path>"
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
PROFILE="${OUT_DIR}/${NAME}.conf"
|
||||
|
||||
@@ -190,6 +232,8 @@ if command -v qrencode >/dev/null; then
|
||||
printf ' QR code (this IS the private key — your terminal scrollback now holds a credential):\n\n'
|
||||
qrencode -t ansiutf8 < "$PROFILE"
|
||||
else
|
||||
printf ' qrencode not installed, so no QR code was printed (Debian/Ubuntu: apt install qrencode).\n'
|
||||
printf ' Transfer %s to the device by another route instead.\n' "$PROFILE"
|
||||
# Should not happen in the dev container: qrencode is baked into the image. Kept as a real
|
||||
# fallback for a host run, rather than failing after the profile has already been written.
|
||||
printf ' qrencode not on PATH, so no QR code was printed. It is in the dev container —\n'
|
||||
printf ' rerun there, or transfer %s to the device by another route.\n' "$PROFILE"
|
||||
fi
|
||||
Reference in new issue
Block a user