sasa/wireguard-admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Handle client keys, encrypted vault

Browse Source
This commit is contained in:
sasa
2026-10-19 23:11:29 +03:00
parent 766059e6d1
commit c879a8101b
11 changed files with 4267 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+23 -5
View File
@@ -1,10 +1,10 @@
# wireguard-admin
This repository contains the initial Rust package, startup boundary, validated
settings loader, client domain model, and a pure in-memory WireGuard server
configuration parser/editor. The terminal management interface, file
persistence, vault, client import workflow, backups, and VPN operations have not
been implemented yet.
This repository contains the Rust package, startup boundary, validated settings
loader, client domain model, a byte-preserving in-memory WireGuard configuration
editor, and library APIs for encrypted client vaults and read-only client import.
The terminal management interface, installed vault persistence, backups, and VPN
operations have not been implemented yet.
The package requires Rust 1.97.1 or newer and uses the Rust 2024 edition. From
the repository root, run:
@@ -69,3 +69,21 @@ let bytes_to_review = updated.render(); // no persistence or VPN operation
Management startup still exits with an explicit “not implemented” error after
its root check; the library APIs are not yet connected to a management session.
## Vault and existing-client import library
`wireguard_admin::vault` provides WireGuard key handling, an encrypted versioned
vault bundle, caller-buffer client configuration parsing, and reconciliation
against a supplied server document. The source adapter can prepare an initial
encrypted bundle or explicitly import candidates into an existing prepared
bundle. These operations return in-memory data only: they do not install or save
a vault, edit source files or server configuration, Commit, or touch the VPN.
Directory scans use the resolved `client_source_directory` only. A candidate is
an immediate regular file whose name ends in `.conf` (case-insensitive); the
adapter does not recurse, follow symlinks, or read files larger than 1 MiB. A
scan is limited to 4,096 directory entries, 1,024 candidates, and 32 MiB total
input. Per-file failures are redacted and do not prevent other files from being
examined. Enumeration, read, or limit failures mark the scan incomplete. The
original files remain untouched. Adapter examples and behavior are covered with
synthetic temporary directories in `tests/vault_import.rs`.