36 lines
1.7 KiB
Markdown
36 lines
1.7 KiB
Markdown
# wireguard-scripts
|
|
|
|
## M1 runtime foundation
|
|
|
|
The current entry point provides dependency-free `help` and `version` commands. The
|
|
planned operational commands are recognized but remain unavailable until later
|
|
milestones.
|
|
|
|
Runtime locations default to the project directory and can be redirected for an
|
|
isolated run with absolute paths using these environment variables:
|
|
|
|
`WG_MANAGER_CONFIG`, `WG_MANAGER_BACKUP_DIR`, `WG_MANAGER_LOG_DIR`,
|
|
`WG_MANAGER_METADATA_DIR`, `WG_MANAGER_ARCHIVE_DIR`, and `WG_MANAGER_LOCK_FILE`.
|
|
|
|
`WG_MANAGER_GUM` selects an executable `gum` explicitly; otherwise the bundled
|
|
`bin/gum` and then `PATH` are checked in that order. Configuration is parsed as
|
|
restricted `KEY=VALUE` data and is never executed as shell code. Blank lines and
|
|
full-line `#` comments are ignored; spaces around the key, `=`, and value are
|
|
trimmed. Values are either one unquoted token or a double-quoted value without
|
|
escapes, and only documented keys are accepted.
|
|
|
|
For deterministic read-only tests, `WG_MANAGER_NOW` may override the current
|
|
epoch when set to decimal seconds; invalid values are rejected.
|
|
|
|
M2 adds read-only `status` and `list`. They parse the configured WireGuard file
|
|
and, when available, `wg show <interface> dump`; a stopped or unavailable
|
|
runtime is reported as unavailable and disk-only peers remain visible. `list`
|
|
uses stable tab-separated output with English machine fields `state` and
|
|
`origin` (`managed`, `legacy`, or `unmanaged`) and never prints private or
|
|
preshared keys.
|
|
|
|
The explicit peer comment marker is `# wg-manager-client: NAME`; it is only a
|
|
display candidate. A peer is considered managed only when its exact public key
|
|
and configured addresses match a valid metadata record with `MANAGED=1`.
|
|
|