From: Adrian Larsen <alarsen@maidenheadbridge.com>
To: wireguard@lists.zx2c4.com
Subject: Re: Continued use of `wg-quick save` and SaveConfig=true?
Date: Mon, 4 Jan 2021 18:41:17 +0000 [thread overview]
Message-ID: <edc99d2b-74f6-f165-993c-4901ddd9fd99@maidenheadbridge.com> (raw)
In-Reply-To: <0619d9f4-c79a-a10d-cdc2-2c08a70d596f@de-vri.es>
Hi Jason,
1) From a manual operation point of view, I feel more comfortable if an
Operator uses:
# wg set wg0 peer ... allowed-ips ...
# wg-quick save wg0
rather than editing manually the config file.
In case the Wire Guard is running multiple peers with production
traffic, I think an Operator can do less damage using the commands if
something goes wrong.
2) From automation point of view, still I think that is easy to use the
commands (on an script):
# wg set wg0 peer ... allowed-ips ...
# wg-quick save wg0
rather than using "sed" or "awk" to modify the config file.
My 2 cents.
Adrian
On 04/01/2021 16:16, Maarten de Vries wrote:
> On 03-01-2021 20:59, Chris Osicki wrote:
>> On Sat, Jan 02, 2021 at 03:37:09PM +0100, Jason A. Donenfeld wrote:
>>> Hi,
>>>
>>> I was thinking recently that most people have switched from a model of
>>> updating the runtime configuration and then reading that back into a
>>> config file, to editing the config file and then syncing that with the
>>> runtime config. In other words, people have moved from doing:
>>>
>>> # wg set wg0 peer ... allowed-ips ...
>>> # wg-quick save wg0
>>>
>>> To doing:
>>>
>>> # vim /etc/wireguard/wg0.conf
>>> # wg syncconf wg0 <(wg-quick strip wg0)
>>>
>>> I think this is mostly a positive change too in terms of reliability.
>>> Reading back the runtime configuration was always a bit hit or miss,
>>> and I suspect that more times than not people have been confused by
>>> SaveConfig=true.
>>>
>>> That raises the question: are there good uses left for SaveConfig=true
>>> and `wg-quick save` that warrant keeping the feature around?
>>> Temporarily caching a roamed endpoint IP, perhaps, but how helpful is
>>> that?
>>>
>>> I haven't thought too deeply about this in order to be wedded to one
>>> outcome over the other yet, but seeing some confusion today, again, in
>>> #wireguard over the feature made me wonder.
>>>
>>> Any opinions on this? Any one on this list actively use this feature
>>> and see replacements for it (e.g. syncconf) as clearly inferior?
>>>
>>> Jason
>> Hi Jason
>>
>> Being an old fashioned Unix admin, ~30 years spent in this job, I
>> vote for the traditional way of doing it:
>> change the config file and let the application reread it.
>> I think the KISS principle is still valid ;-)
>
> I totally agree. Reloading the config file is much nicer :)
>
> I also don't need to save roaming endpoints. All WireGuard tunnels I
> use have at-least one side with a fixed endpoint. And if that's not
> the case I imagine you probably need a more complicated solution than
> wg-quick.
>
>
>> Thanks for the excellent software, Jason!
>
> I also totally agree with this. WireGuard has made my life a lot
> easier :)
>
>
> Regards,
>
> Maarten
>
next prev parent reply other threads:[~2021-01-04 18:41 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-02 14:37 Jason A. Donenfeld
2021-01-03 19:59 ` Chris Osicki
2021-01-04 16:16 ` Maarten de Vries
2021-01-04 18:41 ` Adrian Larsen [this message]
2021-01-04 21:05 ` Maarten de Vries
2021-01-05 0:16 ` Adrian Larsen
2021-01-08 10:42 ` Eicke Herbertz
2021-01-05 2:00 ` Michael B. Williams
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=edc99d2b-74f6-f165-993c-4901ddd9fd99@maidenheadbridge.com \
--to=alarsen@maidenheadbridge.com \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).