sasa/wireguard-scripts
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(clients): add transactional client creation

Browse Source
This commit is contained in:
sasa
2026-10-13 00:25:19 +03:00
parent 4e3c5347f2
commit 2e40d5bd1a
9 changed files with 1008 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
PLANS.md
+28 -14
View File
@@ -258,20 +258,20 @@ These decisions are fixed for the MVP unless the user explicitly changes them:
Allowed status values: `NOT STARTED`, `IN PROGRESS`, `BLOCKED`, `DONE`.
| Milestone | Status | Outcome |
|---|---|---|
| M0 | DONE | Test harness and safe project skeleton |
| M1 | DONE | Runtime foundation, CLI shell, and config loading |
| M2 | DONE | WireGuard parser, client model, `status`, and `list` |
| M3 | DONE | Locking, backups, atomic apply, and rollback engine |
| M4 | NOT STARTED | Safe client creation |
| M5 | NOT STARTED | Client detail, config export, and QR display |
| M6 | NOT STARTED | Safe client removal and archival |
| M7 | NOT STARTED | Diagnostics engine and report |
| M8 | NOT STARTED | Backup listing/restoration and audit log UX |
| M9 | NOT STARTED | TUI foundation, dashboard, and read-only screens |
| M10 | NOT STARTED | Complete TUI mutation workflows |
| M11 | NOT STARTED | Hardening, documentation, and MVP acceptance |
| Milestone | Status | Outcome |
| --------- | ----------- | ---------------------------------------------------- |
| M0 | DONE | Test harness and safe project skeleton |
| M1 | DONE | Runtime foundation, CLI shell, and config loading |
| M2 | DONE | WireGuard parser, client model, `status`, and `list` |
| M3 | DONE | Locking, backups, atomic apply, and rollback engine |
| M4 | DONE | Safe client creation |
| M5 | NOT STARTED | Client detail, config export, and QR display |
| M6 | NOT STARTED | Safe client removal and archival |
| M7 | NOT STARTED | Diagnostics engine and report |
| M8 | NOT STARTED | Backup listing/restoration and audit log UX |
| M9 | NOT STARTED | TUI foundation, dashboard, and read-only screens |
| M10 | NOT STARTED | Complete TUI mutation workflows |
| M11 | NOT STARTED | Hardening, documentation, and MVP acceptance |
---
@@ -1607,6 +1607,20 @@ Use this template:
- Suggested commit message: `feat(safety): add atomic WireGuard mutation and rollback engine`
- Next milestone: M4
## 2026-10-13 — M4 — DONE
- Implemented: strict `add NAME` CLI parsing; deterministic IPv4 and optional IPv6 allocation; managed peer, full-tunnel/split-tunnel client configuration, key, PSK, and metadata generation; restrictive artifact publication integrated with the M3 transaction; collision, rollback, interruption, test-hook confinement, and secret-safety coverage using only fixtures and mocks.
- Coordinator: `gpt-5.6-sol` (`high`)
- Subagents: `milestone_worker` / `milestone_repairer`, `gpt-5.6-luna` (`medium`)
- Repair cycles: 11
- Sol review: fixed configuration-load ordering, missing PSK persistence, pre-commit artifact publication, publish-race and INT/TERM consistency, incomplete rollback and staging cleanup, unsafe test-hook confinement, multiline key-output acceptance, mixed IPv6 collision handling, missing allocation/collision/key-contract matrices, silent expected failures, misleading fixtures, and insufficient secret/mode evidence; every material defect received focused regression coverage.
- Verification: `bash -n wg-manager.sh`, `bash -n tests/run.sh`, `bash -n tests/mocks/bin/wg`, `bash tests/run.sh add-client`, `bash tests/run.sh address-allocation`, `bash tests/run.sh add-collisions`, `bash tests/run.sh add-rollback`, `bash tests/run.sh secret-modes`, `bash tests/run.sh no-secret-logs`, `bash tests/run.sh add-golden-config`, `bash tests/run.sh add-invalid-names`, `bash tests/run.sh transaction`, `bash tests/run.sh rollback`, `bash tests/run.sh locking`, `bash tests/run.sh config`, `bash tests/run.sh`, `git diff --check`, permission, scope, and secret-pattern review.
- Result: all required checks passed; add-client/address-allocation/add-collisions/add-rollback/secret-modes/no-secret-logs/golden/invalid-name suites passed 39/65/104/78/66/41/44/12 assertions, transaction/rollback/locking/config passed 51/65/19/128 assertions, and the full suite passed 355 assertions. Optional `shellcheck wg-manager.sh tests/*.sh tests/mocks/bin/*` was `SKIP` because ShellCheck is unavailable.
- Decisions: none
- Known limitations: real WireGuard, `/etc/wireguard`, networking, systemd, firewall, routes, sysctl, journal, and deployment-server behavior were not accessed or tested; M4 verification is fixture- and mock-based as required. Audit-log creation remains scheduled for M8, so M4 secret checks cover captured stdout, stderr, xtrace, mock logs, generated artifacts, and fixtures.
- Suggested commit message: `feat(clients): add transactional client creation`
- Next milestone: M5
# 8. Final completion rule
The MVP is complete only when: