[PATCH 1/1] make the systemd unit example more general

[PATCH 1/1] make the systemd unit example more general

[Christian Hesse]

From: Christian Hesse <mail@eworm.de>

Signed-off-by: Christian Hesse <mail@eworm.de>
---
 contrib/examples/systemd/README            |  5 +++--
 contrib/examples/systemd/example.address   |  1 +
 contrib/examples/systemd/example.conf      |  8 ++++++++
 contrib/examples/systemd/wgserver.service  | 15 ---------------
 contrib/examples/systemd/wgserver@.service | 15 +++++++++++++++
 5 files changed, 27 insertions(+), 17 deletions(-)
 create mode 100644 contrib/examples/systemd/example.address
 create mode 100644 contrib/examples/systemd/example.conf
 delete mode 100644 contrib/examples/systemd/wgserver.service
 create mode 100644 contrib/examples/systemd/wgserver@.service

diff --git a/contrib/examples/systemd/README b/contrib/examples/systemd/README
index 1ef51aa..b8f4455 100644
--- a/contrib/examples/systemd/README
+++ b/contrib/examples/systemd/README
@@ -1,5 +1,6 @@
 Until WireGuard receives full integration to the various network
 management utilities, there are a number of ways of setting up
 a WireGuard tunnel at boot time. This systemd unit file is one
-such way of doing things. Probably it should be tweaked before
-using.
+such way of doing things.
+Configuration files example.address and example.conf are expected
+in /etc/wireguard/, then start service wgserver@example.service.
diff --git a/contrib/examples/systemd/example.address b/contrib/examples/systemd/example.address
new file mode 100644
index 0000000..983bb76
--- /dev/null
+++ b/contrib/examples/systemd/example.address
@@ -0,0 +1 @@
+ADDRESS=10.10.10.1/24
diff --git a/contrib/examples/systemd/example.conf b/contrib/examples/systemd/example.conf
new file mode 100644
index 0000000..1cfc5ee
--- /dev/null
+++ b/contrib/examples/systemd/example.conf
@@ -0,0 +1,8 @@
+[Interface]
+PrivateKey = gI6EdUSYvn8ugXOt8QQD6Yc+JyiZxIhp3GInSWRfWGE=
+ListenPort = 21841
+
+[Peer]
+PublicKey = HIgo9xNzJMWLKASShiTqIybxZ0U3wGLiUeJ1PKf8ykw=
+Endpoint = 192.95.5.69:41414
+AllowedIPs = 10.10.10.0/24
diff --git a/contrib/examples/systemd/wgserver.service b/contrib/examples/systemd/wgserver.service
deleted file mode 100644
index dfce1e9..0000000
--- a/contrib/examples/systemd/wgserver.service
+++ /dev/null
@@ -1,15 +0,0 @@
-[Unit]
-Description=WireGuard Server
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-ExecStart=/bin/ip link add dev wgserver type wireguard
-ExecStart=/bin/ip address add 192.168.177.1/24 dev wgserver
-ExecStart=/usr/bin/wg setconf wgserver /etc/wireguard-server.conf
-ExecStart=/bin/ip link set up dev wgserver
-ExecStop=/bin/sh -c 'umask 077; /usr/bin/wg showconf wgserver > /etc/wireguard-server.conf.tmp && mv /etc/wireguard-server.conf.tmp /etc/wireguard-server.conf'
-ExecStop=/bin/ip link del dev wgserver
-
-[Install]
-WantedBy=multi-user.target
diff --git a/contrib/examples/systemd/wgserver@.service b/contrib/examples/systemd/wgserver@.service
new file mode 100644
index 0000000..721ce88
--- /dev/null
+++ b/contrib/examples/systemd/wgserver@.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=WireGuard Server %I
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+EnvironmentFile=/etc/wireguard/%i.address
+ExecStart=/bin/ip link add dev %i type wireguard
+ExecStart=/bin/ip address add $ADDRESS dev %i
+ExecStart=/usr/bin/wg setconf %i /etc/wireguard/%i.conf
+ExecStart=/bin/ip link set up dev %i
+ExecStop=/bin/ip link del dev %i
+
+[Install]
+WantedBy=multi-user.target
-- 
2.10.2

Re: [PATCH 1/1] make the systemd unit example more general

[Jason A. Donenfeld]

I like this, but two questions.

1. Why did you get rid of the ExecStop config saving line?
2. You're not planning to actually package this unit file, are you?

Re: [PATCH 1/1] make the systemd unit example more general

[Christian Hesse]

[-- Attachment #1: Type: text/plain, Size: 1015 bytes --]

"Jason A. Donenfeld" <Jason@zx2c4.com> on Thu, 2016/12/08 12:18:
> I like this, but two questions.
> 
> 1. Why did you get rid of the ExecStop config saving line?

I do not like units altering configuration. If you want to save configuration
on stop create a second unit with correct dependencies an ordering that
writes the configuration.

> 2. You're not planning to actually package this unit file, are you?

Not sure about that. :-p At least I left it in examples directory. ;)

In first place this is a RFC. Nevertheless we should polish things a bit and
provide a usable systemd unit.

I still do not like to have two files that hold the settings... But no idea
how to get rid of that in a clean way. Having shell code in a systemd unit is
even worse...
-- 
main(a){char*c=/*    Schoene Gruesse                         */"B?IJj;MEH"
"CX:;",b;for(a/*    Best regards             my address:    */=0;b=c[a++];)
putchar(b-1/(/*    Chris            cc -ox -xc - && ./x    */b/42*2-3)*42);}

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH 1/1] make the systemd unit example more general

[Jason A. Donenfeld]

On Thu, Dec 8, 2016 at 12:33 PM, Christian Hesse <list@eworm.de> wrote:
> "Jason A. Donenfeld" <Jason@zx2c4.com> on Thu, 2016/12/08 12:18:
>> I like this, but two questions.
>>
>> 1. Why did you get rid of the ExecStop config saving line?
>
> I do not like units altering configuration. If you want to save configuration
> on stop create a second unit with correct dependencies an ordering that
> writes the configuration.

That's fair. Want to submit a v2, then, with a shutdown unit too?
(By the way, please prefix the commit message with "contrib: ".)

> Not sure about that. :-p At least I left it in examples directory. ;)
>
> In first place this is a RFC. Nevertheless we should polish things a bit and
> provide a usable systemd unit.

Alright then. By the way, there's some work upstream with systemd to
include this in systemd-networkd, which would probably be the "more
correct" way of doing it. But I guess a unit would nonetheless be
useful for folks who don't use systemd-networkd.

>
> I still do not like to have two files that hold the settings... But no idea
> how to get rid of that in a clean way. Having shell code in a systemd unit is
> even worse...

Yea, it's not nice. There's some additional logic: adding allowed-ips
to routes for the device, if the allowed-ips aren't already included
in the device's address prefix route.

I've thought about just adding this to `wg(8)` itself, and letting it
be specified in the config file. This would indeed be _nice_, but it
still seems like the wrong place to be doing these things. Maybe it'd
be useful to have an extra shell-script in contrib called wg-config.sh
that takes a device name, a `wg(8)`, config file, a list of IPs given
by --address=, a list of additional routes given by --route=, and the
ability to disable auto-route-from-allowed-ips-adding via
--no-auto-routes. Maybe I'll code this up myself -- it should only
take a few minutes to do...

Re: [PATCH 1/1] make the systemd unit example more general

[Jason A. Donenfeld]

On Thu, Dec 8, 2016 at 1:48 PM, Jason A. Donenfeld <Jason@zx2c4.com> wrote:
> still seems like the wrong place to be doing these things. Maybe it'd
> be useful to have an extra shell-script in contrib called wg-config.sh
> that takes a device name, a `wg(8)`, config file, a list of IPs given
> by --address=, a list of additional routes given by --route=, and the
> ability to disable auto-route-from-allowed-ips-adding via
> --no-auto-routes. Maybe I'll code this up myself -- it should only
> take a few minutes to do...

https://git.zx2c4.com/WireGuard/tree/contrib/examples/wg-config/README

That was pretty easy.

Is this useful somehow?

Re: [PATCH 1/1] make the systemd unit example more general

[Anonymous Anonymous]

[-- Attachment #1: Type: text/plain, Size: 3447 bytes --]

It will be super cool if ip/netmask functionality will be addressed by wgconf
Currently we testing this systemd units for wireguard ppa:
: wireguard.service
# This service is actually a systemd target,
# but we are using a service since targets cannot be reloaded.

[Unit]
Description=WireGuard service
After=network.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/true
ExecReload=/bin/true

[Install]
WantedBy=multi-user.target

:wireguard@.service
[Unit]
Description=WireGuard connection to %i
PartOf=wireguard.service
ReloadPropagatedFrom=wireguard.service
Before=systemd-user-sessions.service

[Service]
Type=oneshot
EnvironmentFile=-/etc/default/wireguard

# %i is your connection name created from .conf files in /etc/wireguard
# For ex.: Use systemctl enable wireguard@server.service to enable server example setup
# You can store unlimited amount of various connections in /etc/wireguard

ExecStart=/bin/ip link add dev wg%i type wireguard
ExecStartPre=/bin/sh -c "/bin/systemctl set-environment ip=$(/usr/bin/head -1 /etc/wireguard/%i.conf | awk '{print $2}')"
ExecStart=/bin/ip address add ${ip} dev wg%i
ExecStart=/usr/bin/wg setconf wg%i /etc/wireguard/%i.conf
ExecStart=/bin/ip link set up dev wg%i

# We can't predict routing in your environment, but we can make it easier to setup in /etc/default/wireguard
#ExecStart=/bin/ip route add $0_1 dev wg%i
#ExecStart=/bin/ip route add $128_1 dev wg%i
#ExecStart=/bin/ip add $demo via $common_router dev eth0
#ExecStart=/bin/ip route add 
#ExecStart=/bin/ip route add 
#ExecStart=/bin/ip route add 
#ExecStart=/bin/ip route add 

ExecReload=/bin/ip link del dev wg%i

[Install]
WantedBy=multi-user.target
:/etc/default/wireguard
# Common values could help you setup routing faster
# You can set routing rules in /lib/systemd/wireguard@.service file

0_1="0.0.0.0/1"
128_1="128.0.0.0/1"
# demo.wireguard.io
demo="163.172.161.0/32"
common_router="192.168.1.1"

And test files:
: server.conf
# 192.168.177.1/24
# Since you need to set ip address manually with ip or ifconfig we use workaround and read ip/netmask from first line of every config file
[Interface]
    # You can generate own public and private keys with: wg genkey | tee privatekey | wg pubkey > publickey
    # Its strongly recomended for you to generate own keys!
    PrivateKey = qFstR3l2HG5WQJ0qoQG0G87c039kXR5zN7vV+bUKb0Q=
    ListenPort = 41414

[Peer]
    PublicKey = 40UuwEq4H1gaY1rpmwuW0hUyOnGvXuoQIMctOyOrEAs=
    # Outside world access blocked in example setup
    AllowedIPs = 127.0.0.1/32
    #AllowedIPs = 0.0.0.0/0
:client.conf
# 192.168.4.5/24
# Since you need to set ip address manually with ip or ifconfig we use workaround and read ip/netmask from first line of every config file
[Interface]
    # You can generate own public and private keys with: wg genkey | tee privatekey | wg pubkey > publickey
    PrivateKey = WEAuaVuhdyscyTCXVfBDJR6nf9zxD75jmJzrfhkyE3Y=

[Peer]
    PublicKey = Uha1fHzOY6hPhq54fcrElVdNF/XQDzQ90rDT7+IqIgA=
    Endpoint = demo.wireguard.io:12912
    AllowedIPs = 0.0.0.0/0
    PersistentKeepalive = 25

After some talking with ">Egbert, I think to move routing to separate unit, but still read routing configuration from conf files. I just like ovpn way, when for user is just enough to copy single configuration file.
If ip/netmask and routing will be done with wgconf, and will be located inside single config file, this will be huge success for all users.



[-- Attachment #2: Type: text/html, Size: 4247 bytes --]