mitchell/hamlab
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 14 Wiki Activity

plan: the VPN tab edits devices, and what that cost in care

Browse Source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Mitchell-Johnson
2026-09-27 23:22:13 -07:00
co-authored by Claude Opus 5
parent 8fb21ee95e
commit 0e82719070
1 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
PLAN.md
+18 -4
View File
@@ -648,10 +648,24 @@ what it has moved.
- **"Online" is a handshake in the last three minutes**, and the tab says so. WireGuard is
silent when idle; there is no connection to be in, and a tab claiming otherwise would be
lying twice a day.
- **Read-only, and no secrets.** Private keys are in the second column of the dump and are
read past; pre-shared keys are noted as present and never read. Adding or editing peers is
not here: it means generating keys and writing the machine's network configuration, which is
a bigger thing than this tab, and a bad thing to get half right.
- **No secrets are read.** Private keys are in the second column of the dump and are read
past; pre-shared keys are noted as present and never read.
- **Devices can be created, renamed and removed** (added 2026-09-27, asked for the same day),
on a tunnel the machine configures — today OpenWrt's UCI, which is where the server here
lives. A wg-quick host is reported unmanaged and shows no buttons: half-supporting a second
configuration format is worse than an honest refusal.
- **Nothing restarts the network.** `uci commit` writes the file and applies nothing; `wg
set` changes one peer on the live interface. Proven on `gate` by the existing peers'
transfer counters surviving a create and a delete — a reload would have zeroed them.
- **The two halves are ordered so they cannot disagree quietly.** Adding writes the
configuration first and rolls it back if the live tunnel refuses, because a device that
works only after the next reboot is the worst of the three outcomes. Removing does the
live tunnel first, since that is the moment access ends, and says so plainly if the
configuration half then fails.
- **The keypair is generated on the machine** and the profile, with its QR, is shown once.
The private key is stored nowhere — the same bargain as a guest login's password.
- **Removing asks for the name to be typed back**, at both ends. It cannot be undone and it
sits one tap from a list of devices that all look alike.
## To do