Create, rename and remove the devices that dial in

On a tunnel this machine configures — today that means OpenWrt's UCI, which is
where the server here lives — the VPN tab can add a device, rename it and take
it away. A wg-quick host is reported as unmanaged and shows no buttons, because
half-supporting a second configuration format is worse than an honest refusal.

Adding generates the keypair and a pre-shared key on the machine, picks the
lowest free address in the tunnel's range, and hands back the complete client
profile with a QR code for the WireGuard apps. The private key in it is
generated for that one call and stored nowhere, so the profile is shown until
dismissed and then gone — the same bargain as any password this console makes.

Nothing restarts the network, which matters when the interface belongs to the
router the house is behind. `uci commit` writes the file and applies nothing;
`wg set` changes one peer on the live interface and touches nothing else.

The order of the two is chosen so they cannot disagree quietly. Adding writes
the configuration first and rolls it back if the live tunnel refuses, because a
device that works only after the next reboot is the worst of the three outcomes.
Removing does the live tunnel first, since that is the moment access actually
ends, and says plainly if the configuration half then fails.

Removing asks for the device's name to be typed back, at both ends. It is the
one action here that cannot be undone and it sits one tap from a list of devices
that all look alike.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/api/server.go

@@ -282,6 +282,9 @@ func (s *Server) routes() *http.ServeMux {
 	m.HandleFunc("GET /api/hardware", s.auth(s.hardwareReport))
 	m.HandleFunc("GET /api/network", s.auth(s.networkOverview))
 	m.HandleFunc("GET /api/vpn", s.auth(s.vpnReport))
+	m.HandleFunc("POST /api/vpn/{iface}/peers", s.auth(s.addVPNPeer))
+	m.HandleFunc("PATCH /api/vpn/{iface}/peers/{section}", s.auth(s.editVPNPeer))
+	m.HandleFunc("DELETE /api/vpn/{iface}/peers/{section}", s.auth(s.removeVPNPeer))
 	m.HandleFunc("GET /api/network/speedtest", s.auth(s.speedtestState))
 	m.HandleFunc("POST /api/network/speedtest", s.auth(s.speedtestStart))
 	m.HandleFunc("POST /api/network/speedtest/cancel", s.auth(s.speedtestCancel))

internal/api/vpn.go

@@ -1,12 +1,20 @@
 package api
 
-// The VPN tab: this machine's WireGuard tunnels and who is on them. Read-only, and per
-// machine like every other tab — the tunnels shown are the ones on the machine in the
-// switcher, which is the only honest way to show them: the inbound server and an outbound
-// tunnel are different machines here.
+// The VPN tab: this machine's WireGuard tunnels, who is on them, and — where the tunnel is
+// one this machine configures — adding, renaming and removing the devices that dial in.
+//
+// Per machine like every other tab: the tunnels shown and edited are the ones on the machine
+// in the switcher, which is the only honest way to show them, since the inbound server and an
+// outbound tunnel are different machines here.
 
 import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"log"
 	"net/http"
+	"strings"
 
 	"hamlab/internal/vpn"
 )
@@ -14,3 +22,94 @@ import (
 func (s *Server) vpnReport(w http.ResponseWriter, r *http.Request) {
 	jsonOK(w, 200, vpn.Look(r.Context()))
 }
+
+// tunnelOf finds the tunnel a request names, so every editing handler starts from the live
+// state rather than from whatever the page last saw.
+func (s *Server) tunnelOf(ctx context.Context, w http.ResponseWriter, name string) (vpn.Tunnel, bool) {
+	for _, t := range vpn.Look(ctx).Tunnels {
+		if t.Name == name {
+			if !t.Managed {
+				jsonErr(w, 400, vpn.ErrUnmanaged.Error())
+				return t, false
+			}
+			return t, true
+		}
+	}
+	jsonErr(w, 404, "no such tunnel on this machine")
+	return vpn.Tunnel{}, false
+}
+
+// addVPNPeer makes a device and hands back its profile. The profile holds a private key that
+// is generated for this call and stored nowhere, so it is the only time it can be read — the
+// same bargain as any password this console generates.
+func (s *Server) addVPNPeer(w http.ResponseWriter, r *http.Request) {
+	t, ok := s.tunnelOf(r.Context(), w, r.PathValue("iface"))
+	if !ok {
+		return
+	}
+	var body vpn.NewPeer
+	if err := json.NewDecoder(io.LimitReader(r.Body, 8<<10)).Decode(&body); err != nil {
+		jsonErr(w, 400, "bad request")
+		return
+	}
+	made, err := vpn.AddPeer(r.Context(), t, body)
+	if err != nil {
+		code := 400
+		if errors.Is(err, vpn.ErrUnmanaged) {
+			code = 409
+		}
+		jsonErr(w, code, err.Error())
+		return
+	}
+	// The name and address are worth a log line; the profile is emphatically not.
+	log.Printf("vpn: device %q added to %s as %s (by %s)", made.Name, t.Name, made.Address, clientIP(r))
+	jsonOK(w, 200, made)
+}
+
+func (s *Server) editVPNPeer(w http.ResponseWriter, r *http.Request) {
+	t, ok := s.tunnelOf(r.Context(), w, r.PathValue("iface"))
+	if !ok {
+		return
+	}
+	var body struct{ Name, Address string }
+	if err := json.NewDecoder(io.LimitReader(r.Body, 4<<10)).Decode(&body); err != nil {
+		jsonErr(w, 400, "bad request")
+		return
+	}
+	section := r.PathValue("section")
+	if err := vpn.EditPeer(r.Context(), t, section, body.Name, body.Address); err != nil {
+		jsonErr(w, 400, err.Error())
+		return
+	}
+	log.Printf("vpn: device %s on %s changed (by %s)", section, t.Name, clientIP(r))
+	w.WriteHeader(204)
+}
+
+func (s *Server) removeVPNPeer(w http.ResponseWriter, r *http.Request) {
+	t, ok := s.tunnelOf(r.Context(), w, r.PathValue("iface"))
+	if !ok {
+		return
+	}
+	section := r.PathValue("section")
+	var body struct{ Confirm string }
+	_ = json.NewDecoder(io.LimitReader(r.Body, 4<<10)).Decode(&body)
+	// The name has to be typed back. Removing a device is the one action here that cannot be
+	// undone — the key is gone and the profile on the device stops working — and it is one tap
+	// away from a list of devices that all look alike.
+	var want string
+	for _, p := range t.Peers {
+		if p.Section == section {
+			want = p.Name
+		}
+	}
+	if want != "" && !strings.EqualFold(strings.TrimSpace(body.Confirm), want) {
+		jsonErr(w, 400, "type the device's name to remove it")
+		return
+	}
+	if err := vpn.DeletePeer(r.Context(), t, section); err != nil {
+		jsonErr(w, 400, err.Error())
+		return
+	}
+	log.Printf("vpn: device %s (%s) removed from %s (by %s)", section, want, t.Name, clientIP(r))
+	w.WriteHeader(204)
+}