diff options
| -rw-r--r-- | prompts/skills/f3s/references/bootstrap-netbsd-pi.md | 72 | ||||
| -rw-r--r-- | prompts/skills/f3s/references/wireguard.md | 6 |
2 files changed, 36 insertions, 42 deletions
diff --git a/prompts/skills/f3s/references/bootstrap-netbsd-pi.md b/prompts/skills/f3s/references/bootstrap-netbsd-pi.md index 2d80375..673c2c9 100644 --- a/prompts/skills/f3s/references/bootstrap-netbsd-pi.md +++ b/prompts/skills/f3s/references/bootstrap-netbsd-pi.md @@ -65,48 +65,42 @@ path: pkgin -y install wireguard-go wireguard-tools ``` -Pull this host's private key and the three PSKs (`blowfish`, `fishfinger`, -`rocky`) from `~/git/wireguardmeshgenerator/keys/` — do not regenerate. -Peer pubkeys/endpoints/AllowedIPs come from `dist/<host>/etc/wireguard/wg0.conf` -(generator output) or another live node's `/etc/wireguard/wg0.conf` (same -endpoints for every Pi, only `AllowedIPs`/PSK differ per host). +**`wireguardmeshgenerator` (`~/git/wireguardmeshgenerator`) has full NetBSD +support** — for a host with `os: NetBSD` in `wireguardmeshgenerator.yaml`, +`--generate` produces both the stripped `tun0.conf` (no `Address`/`DNS` lines +— `wg setconf` rejects wg-quick extensions with "Line unrecognized") and the +`/etc/rc.d/wireguard` script itself, with one `route add`/`delete` pair per +peer AllowedIPs prefix (wg-quick would normally manage these automatically; +`wg` only does the crypto/routing decision inside the tunnel). `--install` +uploads and places both files with the right ownership/permissions and +restarts the service. Per-host YAML fields that matter for a NetBSD entry: + +```yaml +pi0: + os: NetBSD + ssh: + user: paul + conf_dir: /usr/pkg/etc/wireguard + sudo_cmd: doas + reload_cmd: /etc/rc.d/wireguard restart + wg_bin: /usr/pkg/bin/wg # doas's PATH excludes /usr/pkg/bin +``` -Key facts: +Key facts the generator's implementation encodes: - The interface **must** be named `tunN` (`wireguard-go` rejects `wg0`: - "Interface name must be tun[0-9]*"). Use `tun0`. -- **Address the interface before starting `wireguard-go`**, or its read loop - dies immediately with `EHOSTDOWN` ("host is down") and does not retry: - ```sh - ifconfig tun0 create - ifconfig tun0 inet <wg-ip> <wg-ip> netmask 255.255.255.255 - ifconfig tun0 inet6 <wg-ipv6> - ifconfig tun0 up - wireguard-go tun0 # daemonizes on its own - ``` -- Apply crypto config with the real `wg` CLI (supports `PersistentKeepalive`, - unlike the native `wgconfig` tool which has no keepalive flag at all): - ```sh - wg setconf tun0 /usr/pkg/etc/wireguard/tun0.conf - ``` - `tun0.conf` is the normal `[Interface]`/`[Peer]` format — same content as - what `wireguardmeshgenerator` renders to `dist/<host>/etc/wireguard/wg0.conf`, - just handed to `wg` instead of `wg-quick`. -- **No `wg-quick` means no automatic routes.** Each peer's AllowedIPs needs an - explicit host route via the local tun IP: - ```sh - route add -inet <peer-allowed-ip>/32 <local-tun4-ip> -iface - route add -inet6 <peer-allowed-ipv6>/128 <local-tun6-ip> -iface - ``` - -Wire all of this into a custom `/etc/rc.d/wireguard` (there's no stock rc.d -for this combination). Enable with `wireguard=YES` in `/etc/rc.conf`. - -**Known gap**: `wireguardmeshgenerator.rb` only branches on -`os == 'Linux' | 'FreeBSD' | 'OpenBSD'` and always emits `wg-quick`-style -files; the generator's YAML still lists `pi0`/`pi1` as `os: Linux`. Until it -gains NetBSD support, both nodes' WireGuard configs are manually-maintained -exceptions that a future `--generate`/`--install` regen would clobber. + "Interface name must be tun[0-9]*"). The generator always uses `tun0`. +- **The interface must be addressed before `wireguard-go` starts**, or its + read loop dies immediately with `EHOSTDOWN` ("host is down") and does not + retry — the generated rc.d script's `wireguard_start` does `ifconfig` + before `wireguard-go`. +- `doas` on NetBSD resets `PATH` to exclude both `/usr/pkg/bin` (hence the + `wg_bin` override above) and `/usr/sbin` (hence the generator using a full + path for `chown` during install — caught by actually running `--install` + against a live host, not by inspection). + +To (re)deploy after any topology change: `ruby wireguardmeshgenerator.rb +--generate --install --hosts=pi0,pi1`. ## Webserver — bozohttpd diff --git a/prompts/skills/f3s/references/wireguard.md b/prompts/skills/f3s/references/wireguard.md index ec7403e..be3c2e3 100644 --- a/prompts/skills/f3s/references/wireguard.md +++ b/prompts/skills/f3s/references/wireguard.md @@ -26,10 +26,10 @@ The `wg` kernel module documented above does **not** ship in the evbarm-aarch64 - Interface must be named `tunN` (`wireguard-go` on NetBSD requires this — `wg0` is rejected: "Interface name must be tun[0-9]*"). Used `tun0`. - Bring the interface up **and address it** (`ifconfig tun0 inet <ip> <ip> netmask 255.255.255.255`) *before* starting `wireguard-go`, or its read loop dies immediately with `EHOSTDOWN` ("host is down") and does not retry. -- `wg setconf tun0 <conf>` takes the normal `[Interface]`/`[Peer]` format (including `PersistentKeepalive`, unlike native `wgconfig` which has no keepalive flag at all) — same keys/PSKs as the `wg-quick`-format file `wireguardmeshgenerator` already renders to `dist/pi0/etc/wireguard/wg0.conf`, just fed to a different tool. +- `wg setconf tun0 <conf>` takes the normal `[Interface]`/`[Peer]` format (including `PersistentKeepalive`, unlike native `wgconfig` which has no keepalive flag at all) — but strictly rejects wg-quick extensions like `Address`/`DNS` ("Line unrecognized"), so the config fed to it has neither; the interface address is applied separately via `ifconfig`. - No `wg-quick` means **no automatic routes**: each peer's AllowedIPs needs an explicit `route add -inet <ip>/32 <local-tun-ip> -iface` (and `-inet6` for the v6 ones) — `wg` only does the crypto/routing decision inside the tunnel, not the OS route table. - All of this is wired into a custom `/etc/rc.d/wireguard` script (there's no stock rc.d for this) since there's no native `ifconfig.wg0`/wg-quick integration to hook into. -- Follow-up not yet done: `wireguardmeshgenerator.rb` only branches on `os == 'Linux' | 'FreeBSD' | 'OpenBSD'` and always emits `wg-quick`-style files; `wireguardmeshgenerator.yaml`'s `pi0:`/`pi1:` entries still say `os: Linux` with a `systemctl reload wg-quick@wg0.service` `reload_cmd`. Until the generator gains NetBSD support, both nodes' WireGuard configs are manually-maintained exceptions that a future `--generate`/`--install` regen would otherwise clobber. +- `wireguardmeshgenerator` (`~/git/wireguardmeshgenerator`) generates both the `tun0.conf` and the `/etc/rc.d/wireguard` script (routes included, derived from each host's peer list) for `os: NetBSD` entries, and installs/reloads them over SSH the same way it does for every other OS. `doas` on NetBSD resets `PATH` to exclude both `/usr/pkg/bin` (hence the per-host `wg_bin` override in the YAML) and `/usr/sbin` (hence the generator using a full path for `chown` there). ## WireGuard IP Assignments @@ -259,7 +259,7 @@ The script generates all configs and can push them via SSH. Current mesh-specific notes: -- `pi0` and `pi1` are defined in the generator's YAML as Rocky Linux hosts (now stale — both are NetBSD; the generator has no NetBSD support yet, see above) and excluded from most non-gateway peers, so they only tunnel to `blowfish`, `fishfinger`, and `rocky` +- `pi0` and `pi1` are defined in the generator's YAML as `os: NetBSD` and excluded from most non-gateway peers, so they only tunnel to `blowfish`, `fishfinger`, and `rocky` - Installed config ownership must be OS-specific: - Linux: `root:root` - BSD: `root:wheel` |