From 0e8271907089f845c3d418aa32742d3ff9912f78 Mon Sep 17 00:00:00 2001 From: Mitchell-Johnson Date: Sun, 27 Sep 2026 23:22:13 -0700 Subject: [PATCH] plan: the VPN tab edits devices, and what that cost in care Co-Authored-By: Claude Opus 5 --- PLAN.md | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/PLAN.md b/PLAN.md index ed7c4aa..c5b6102 100644 --- a/PLAN.md +++ b/PLAN.md @@ -648,10 +648,24 @@ what it has moved. - **"Online" is a handshake in the last three minutes**, and the tab says so. WireGuard is silent when idle; there is no connection to be in, and a tab claiming otherwise would be lying twice a day. -- **Read-only, and no secrets.** Private keys are in the second column of the dump and are - read past; pre-shared keys are noted as present and never read. Adding or editing peers is - not here: it means generating keys and writing the machine's network configuration, which is - a bigger thing than this tab, and a bad thing to get half right. +- **No secrets are read.** Private keys are in the second column of the dump and are read + past; pre-shared keys are noted as present and never read. +- **Devices can be created, renamed and removed** (added 2026-09-27, asked for the same day), + on a tunnel the machine configures — today OpenWrt's UCI, which is where the server here + lives. A wg-quick host is reported unmanaged and shows no buttons: half-supporting a second + configuration format is worse than an honest refusal. + - **Nothing restarts the network.** `uci commit` writes the file and applies nothing; `wg + set` changes one peer on the live interface. Proven on `gate` by the existing peers' + transfer counters surviving a create and a delete — a reload would have zeroed them. + - **The two halves are ordered so they cannot disagree quietly.** Adding writes the + configuration first and rolls it back if the live tunnel refuses, because a device that + works only after the next reboot is the worst of the three outcomes. Removing does the + live tunnel first, since that is the moment access ends, and says so plainly if the + configuration half then fails. + - **The keypair is generated on the machine** and the profile, with its QR, is shown once. + The private key is stored nowhere — the same bargain as a guest login's password. + - **Removing asks for the name to be typed back**, at both ends. It cannot be undone and it + sits one tap from a list of devices that all look alike. ## To do