Mitchell-JohnsonandClaude Opus 5
6f634bbe11
Beside Network, per machine. Every WireGuard interface on the machine in the switcher, with its address, listen port and public key, and under it the peers: name, allowed addresses, last handshake, where they connect from, and what they have moved. Per machine is the point rather than a limitation. The tunnel devices dial into and a tunnel a machine dials out through are different boxes here, and putting them on one page would invite the question of which box you were looking at. The kernel is the truth and the configuration only supplies names: wg show all dump has the handshakes and the counters and knows nothing but public keys, so the # comment above a peer in a wg-quick file, or a UCI section's description on OpenWrt, is read alongside purely to label them. Whether a tunnel is dialled or dialling is worked out from the shape of its peers, and says neither when it cannot tell. Online means a handshake in the last three minutes, and the tab says so in as many words: WireGuard is silent when idle, so there is no connection to be in. Read-only, and no secrets leave: the private key is the second column of the dump and is read past, pre-shared keys are noted as present and never read. The Network tab keeps listing tunnels as the interfaces they are, and hands off to here for anything about them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
17 lines
479 B
Go
17 lines
479 B
Go
package api
|
|
|
|
// The VPN tab: this machine's WireGuard tunnels and who is on them. Read-only, and per
|
|
// machine like every other tab — the tunnels shown are the ones on the machine in the
|
|
// switcher, which is the only honest way to show them: the inbound server and an outbound
|
|
// tunnel are different machines here.
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"hamlab/internal/vpn"
|
|
)
|
|
|
|
func (s *Server) vpnReport(w http.ResponseWriter, r *http.Request) {
|
|
jsonOK(w, 200, vpn.Look(r.Context()))
|
|
}
|