nuno / add.command.sh

#!/usr/bin/env bash # ============================================ # Lifecycle # ============================================ function cmd::add::on_load() { load_module subnet load_module identity load_module policy flag::register --name flag::register --identity flag::register --type flag::register --subnet flag::register --rule flag::register --group flag::register --ip flag::register --tunnel flag::register --show-qr # Dynamically register --<subnet_name> as shorthand flags local subnet_name while IFS= read -r subnet_name; do [[ -n "$subnet_name" ]] && flag::register "--${subnet_name}" done < <(subnet::list_names) } # ============================================ # Help # ============================================ function cmd::add::help() { cat <<EOF Usage: wgctl add --name <name> --type <type> [options] or: wgctl add --identity <identity> --type <type> [options] Add a new WireGuard client. Options: --name <name> Client name (e.g. nuno) — combined with type: phone-nuno --identity <name> Identity name — auto-names peer with next available index --type <type> Device type: desktop, laptop, phone, tablet, server, iot --subnet <subnet> Subnet to allocate from (default: type-native) --ip <ip> Override auto-assigned IP (optional) --tunnel <mode> Tunnel mode: split|full (overrides policy) --rule <rule> Peer rule (default: from policy default_rule or none) --group <group> Add to group on creation (group must exist) --show-qr Show the WireGuard config as a QR code after creation Subnet shorthands (equivalent to --subnet <name>): --guests, --servers, --iot, ... (see: wgctl subnet list) Examples: wgctl add --name nuno --type phone wgctl add --identity nuno --type phone wgctl add --name zephyr --type desktop --guests wgctl add --identity zephyr --type desktop --guests wgctl add --name visitor --type phone --guests --show-qr wgctl add --name dev --type laptop --rule dev-01 EOF } # ============================================ # Validation # ============================================ function cmd::add::_validate() { local name="$1" identity="$2" type="$3" ip="$4" tunnel="$5" if [[ -z "$name" && -z "$identity" ]]; then log::error "Missing required flag: --name or --identity" return 1 fi if [[ -z "$type" ]]; then log::error "Missing required flag: --type" return 1 fi if ! json::subnet_exists "$(ctx::subnets)" "$type" 2>/dev/null; then log::error "Unknown device type: '${type}'" log::info "Use 'wgctl subnet list' to see valid types and subnets" return 1 fi if [[ -n "$tunnel" && "$tunnel" != "split" && "$tunnel" != "full" ]]; then log::error "Invalid tunnel mode: '${tunnel}' (use 'split' or 'full')" return 1 fi if [[ -n "$ip" ]]; then ip::require_valid "$ip" fi } function cmd::add::_validate_not_exists() { local full_name="$1" if [[ -f "$(ctx::clients)/${full_name}.conf" ]]; then log::error "Client already exists: ${full_name}" return 1 fi } # ============================================ # Display helpers # ============================================ function cmd::add::is_mobile() { local type="$1" [[ "$type" == "phone" || "$type" == "tablet" ]] } # ============================================ # Run # ============================================ function cmd::add::run() { local name="" identity="" type="" subnet_name="" rule="" \ group="" ip="" tunnel="" show_qr=false while [[ $# -gt 0 ]]; do case "$1" in --name) name="$2"; shift 2 ;; --identity) identity="$2"; shift 2 ;; --type) type="$2"; shift 2 ;; --subnet) subnet_name="$2"; shift 2 ;; --rule) rule="$2"; shift 2 ;; --group) group="$2"; shift 2 ;; --ip) ip="$2"; shift 2 ;; --tunnel) tunnel="$2"; shift 2 ;; --show-qr) show_qr=true; shift ;; --help) cmd::add::help; return ;; --*) local flag_name="${1#--}" if subnet::exists "$flag_name" 2>/dev/null; then subnet_name="$flag_name" shift else log::error "Unknown flag: $1" cmd::add::help return 1 fi ;; *) log::error "Unknown flag: $1" cmd::add::help return 1 ;; esac done cmd::add::_validate "$name" "$identity" "$type" "$ip" "$tunnel" || return 1 # Resolve full peer name local full_name if [[ -n "$identity" ]]; then full_name=$(identity::next_peer_name "$identity" "$type") || return 1 log::info "Auto-named: ${full_name}" else full_name="${type}-${name}" fi cmd::add::_validate_not_exists "$full_name" || return 1 # Resolve subnet CIDR and canonical type local resolved_cidr resolved_type resolved_cidr=$(subnet::resolve_for_add "$type" "$subnet_name") || return 1 resolved_type=$(subnet::type_for_add "$type" "$subnet_name") || return 1 # Resolve effective policy local identity_name="${identity:-$(identity::get_name "$full_name")}" local effective_policy effective_policy=$(policy::effective "$subnet_name" "$resolved_type" "$identity_name") # Resolve tunnel mode — flag overrides policy if [[ -z "$tunnel" ]]; then tunnel=$(policy::tunnel_mode "$effective_policy") fi # Resolve peer rule — explicit flag overrides policy default_rule if [[ -z "$rule" ]]; then rule=$(policy::default_rule "$effective_policy") fi # Validate rule if set if [[ -n "$rule" ]]; then rule::exists "$rule" || { log::error "Rule not found: ${rule}"; return 1; } fi local allowed_ips allowed_ips=$(config::allowed_ips_for "$tunnel") || return 1 log::section "Adding client: ${full_name}" # Allocate IP if [[ -n "$ip" ]]; then subnet::require_ip_valid_for "$resolved_cidr" "$ip" || return 1 else ip=$(ip::next_for_subnet "$resolved_cidr") || return 1 fi cmd::add::_log_plan "$full_name" "$type" "$resolved_type" \ "$subnet_name" "$resolved_cidr" "$ip" "$tunnel" \ "$allowed_ips" "${rule:---}" "$effective_policy" keys::generate_pair "$full_name" || return 1 peers::create_client_config "$full_name" "$resolved_type" "$ip" "$allowed_ips" || return 1 # Write meta — type, subnet, rule (if set) peers::set_meta "$full_name" "type" "$resolved_type" if [[ -n "$subnet_name" ]]; then peers::set_meta "$full_name" "subnet" "$subnet_name" fi if [[ -n "$rule" ]]; then peers::set_meta "$full_name" "rule" "$rule" fi cmd::add::_assign_group "$full_name" "$group" local public_key public_key=$(keys::public "$full_name") || return 1 peers::add_to_server "$full_name" "$public_key" "$ip" || return 1 # Apply peer rule if set if [[ -n "$rule" ]]; then rule::apply "$rule" "$ip" "$full_name" || return 1 fi # Auto-attach to identity and apply identity rule if set identity::auto_attach "$full_name" "$resolved_type" cmd::add::_apply_identity_rule "$full_name" "$ip" "$identity_name" "$effective_policy" "$rule" peers::reload || return 1 log::wg_success "Client added: ${full_name} (${ip}) [${tunnel} tunnel]" cmd::add::_show_result "$full_name" "$resolved_type" "$show_qr" } # ============================================ # Internal helpers # ============================================ function cmd::add::_log_plan() { local full_name="${1:-}" type="${2:-}" resolved_type="${3:-}" \ subnet_name="${4:-}" resolved_cidr="${5:-}" ip="${6:-}" \ tunnel="${7:-}" allowed_ips="${8:-}" rule="${9:-}" policy="${10:-}" log::wg_add "Name: ${full_name}" log::wg_add "Type: ${resolved_type}" [[ -n "$subnet_name" ]] && log::wg_add "Subnet: ${subnet_name} (${resolved_cidr})" log::wg_add "IP: ${ip}" log::wg_add "Tunnel: ${tunnel} (${allowed_ips})" log::wg_add "Endpoint: $(config::endpoint)" log::wg_add "Rule: ${rule}" log::wg_add "Policy: ${policy}" } function cmd::add::_assign_group() { local full_name="${1:-}" group="${2:-}" [[ -z "$group" ]] && return 0 if ! group::exists "$group"; then log::wg_warning "Group '${group}' not found — skipping group assignment" return 0 fi group::add_peer "$group" "$full_name" log::wg "Added to group: ${group}" } function cmd::add::_apply_identity_rule() { local full_name="${1:-}" ip="${2:-}" identity_name="${3:-}" \ effective_policy="${4:-}" peer_rule="${5:-}" [[ -z "$identity_name" ]] && return 0 local rules rules=$(identity::rules "$identity_name") if [[ -z "$rules" ]]; then # No identity rules — warn if no peer rule either if [[ -z "$peer_rule" ]]; then policy::warn_no_rule "$full_name" fi return 0 fi # Apply all identity rules rule::_apply_identity_rule "$full_name" "$ip" # Warn based on strict_rule local strict strict=$(identity::rule_flags "$identity_name" "strict_rule") if [[ "$strict" == "true" ]]; then local rule_list rule_list=$(echo "$rules" | tr '\n' ',' | sed 's/,$//') policy::warn_strict_rule "$identity_name" "$effective_policy" "$rule_list" elif [[ -n "$peer_rule" ]]; then local rule_list rule_list=$(echo "$rules" | tr '\n' ',' | sed 's/,$//') policy::warn_additive_rule "$identity_name" "$rule_list" "$peer_rule" fi } function cmd::add::_show_result() { local full_name="${1:-}" type="${2:-}" show_qr="${3:-false}" if $show_qr || cmd::add::is_mobile "$type"; then log::section "Client QR" keys::qr "$full_name" else log::section "Client Config" cat "$(ctx::clients)/${full_name}.conf" fi }