nuno / gistfile1.txt

function cmd::identity::help() { cat <<EOF Usage: wgctl identity <subcommand> [options] Manage peer identities. Subcommands: list List all identities show --name <name> Show identity details and device status add --name <name> Manually attach a peer to an identity --peer <peer> remove --name <name> Remove identity and all associated peers migrate [--dry-run] Create identities from existing peer names rule assign --name <name> Assign a rule to an identity --rule <rule> rule unassign --name <name> Remove rule from an identity rule show --name <name> Show current identity rule options --name <name> Set identity options [--policy <policy>] [--set-strict-rule | --unset-strict-rule] [--set-auto-apply | --unset-auto-apply] Examples: wgctl identity list wgctl identity show --name nuno wgctl identity rule assign --name nuno --rule admin wgctl identity rule unassign --name nuno wgctl identity options --name guests-identity --policy guest wgctl identity options --name nuno --set-strict-rule EOF } function cmd::rule::help() { cat <<EOF Usage: wgctl rule <subcommand> [options] Manage firewall rules with inheritance support. Rules can extend base rules to compose reusable access policies. Service names from 'wgctl net' can be used instead of raw IPs/ports. Subcommands: list, ls List all rules show, inspect Show rule details and inheritance add, new, create Create a new rule update, edit Update a rule and re-apply to peers remove, rm, del Remove a rule assign Assign a rule to a peer unassign Remove rule from a peer reapply Re-apply rule to all assigned peers migrate Apply default rules to unassigned peers Options for list: --base Show only base rules --no-base Hide base rules section --group <name> Filter by group (case insensitive) --detailed Show rule entries inline Options for add: --name <name> Rule name --desc <description> Description --group <group> Display group (e.g. VM Rules, Users) --extends <rule,...> Inherit from base rules (comma-separated) --base Create as base rule (not directly assignable) --allow-ip <ip/cidr> Allow IP or subnet (repeatable) --allow-port <ip:port:proto> Allow specific port (repeatable) --block-ip <ip/cidr> Block IP or subnet (repeatable) --block-port <ip:port:proto> Block specific port (repeatable) --block-service <name> Block named service (repeatable) --allow-service <name> Allow named service (repeatable) --dns-redirect Force DNS through Pi-hole Options for update: (same as add, plus:) --add-extends <rule,...> Add inherited base rules --remove-extends <rule,...> Remove inherited base rules --remove-allow-ip <ip> Remove allow IP entry --remove-allow-port <entry> Remove allow port entry --remove-block-ip <ip> Remove block IP entry --remove-block-port <entry> Remove block port entry Options for show: --name <name> Rule name --resolved Show resolved/merged entries --no-peers Hide assigned peers Options for reapply: --name <name> Rule name --all Reapply all rules Examples: wgctl rule list wgctl rule list --detailed wgctl rule list --group "VM Rules" wgctl rule show --name guest wgctl rule show --name moonlight-02 --resolved wgctl rule add --name no-proxmox --base --block-service proxmox wgctl rule add --name dev-01 --desc "Dev access" --extends no-lan wgctl rule assign --name dev-01 --peer laptop-nuno wgctl rule reapply --all EOF }