1.7 KiB
wireguard-scripts
M1 runtime foundation
The current entry point provides dependency-free help and version commands. The
planned operational commands are recognized but remain unavailable until later
milestones.
Runtime locations default to the project directory and can be redirected for an isolated run with absolute paths using these environment variables:
WG_MANAGER_CONFIG, WG_MANAGER_BACKUP_DIR, WG_MANAGER_LOG_DIR,
WG_MANAGER_METADATA_DIR, WG_MANAGER_ARCHIVE_DIR, and WG_MANAGER_LOCK_FILE.
WG_MANAGER_GUM selects an executable gum explicitly; otherwise the bundled
bin/gum and then PATH are checked in that order. Configuration is parsed as
restricted KEY=VALUE data and is never executed as shell code. Blank lines and
full-line # comments are ignored; spaces around the key, =, and value are
trimmed. Values are either one unquoted token or a double-quoted value without
escapes, and only documented keys are accepted.
For deterministic read-only tests, WG_MANAGER_NOW may override the current
epoch when set to decimal seconds; invalid values are rejected.
M2 adds read-only status and list. They parse the configured WireGuard file
and, when available, wg show <interface> dump; a stopped or unavailable
runtime is reported as unavailable and disk-only peers remain visible. list
uses stable tab-separated output with English machine fields state and
origin (managed, legacy, or unmanaged) and never prints private or
preshared keys.
The explicit peer comment marker is # wg-manager-client: NAME; it is only a
display candidate. A peer is considered managed only when its exact public key
and configured addresses match a valid metadata record with MANAGED=1.