Implement Plan 03 limen-side WireGuard control plane and Forculus client - #20
Merged
Conversation
- ForculusHttp contracts (PeerSpec, ConfigSnapshot) in Limen.Contracts - WireGuardConfig added to EnrollResponse; replaces TunnelSubnet string - WireGuardPeer domain entity + EF configuration + Tunnels migration - ITunnelCoordinator + TunnelCoordinator: Curve25519 keygen via NSec 25.4.0, 10.42.0.0/24 IP allocation - IForculusClient + ForculusHttpClient: HTTP peer upsert/remove - EnrollAgentCommand now allocates tunnel IP, persists WireGuardPeer, pushes to Forculus (failure swallowed), returns WireGuardConfig - GET /api/forculus/config endpoint (GetForculusConfigQuery) for Forculus boot and reconcile - ForculusSettings and WgServerSettings options classes in Application layer - EnrollAgentCommandTests updated: 5 cases covering happy path, Forculus failure tolerance, expired/used/unknown key
PianoNic
added
feature
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PeerSpec,ConfigSnapshot) toLimen.ContractsEnrollResponsenow carriesWireGuardConfig(private key returned once, never stored); replaces the placeholderTunnelSubnetstringWireGuardPeerdomain entity + EF config +Tunnelsmigration (wireguard_peerstable, unique indexes onPublicKeyandTunnelIp)ITunnelCoordinator+TunnelCoordinator: Curve25519 keypair generation via NSec 25.4.0, 10.42.0.0/24 sequential IP allocationIForculusClient+ForculusHttpClient: typed HTTP client for peer upsert/remove against ForculusEnrollAgentCommandnow allocates tunnel IP, persistsWireGuardPeer, pushes peer to Forculus (failure swallowed — reconcile loop will sync), and returnsWireGuardConfigto agentGET /api/forculus/configendpoint viaGetForculusConfigQueryfor Forculus boot-time config pull and reconcileForculusSettingsandWgServerSettingsoption classes placed inLimen.Applicationlayer (not Infrastructure) to avoid layer violationLimentinus WireGuard client integration is a separate follow-up PR. Closes #19
Test plan
EnrollAgentCommandTestsupdated: 5 cases (happy path with peer row + coordinator + Forculus call assertions, Forculus failure tolerance, expired key, used key, unknown key)wireguard_peerswith expected columns and unique indexes