Julian Boldt
f5dbe8a41a
Release / verify (push) Canceled after 0s
CI / checks (push) Canceled after 0s
CI / frontend (push) Canceled after 0s
CI / backend (push) Canceled after 0s
Release / test (push) Canceled after 0s
Release / publish (backend) (push) Canceled after 0s
Release / publish (frontend) (push) Canceled after 0s
Release / publish (proxy) (push) Canceled after 0s
Release / publish (updater) (push) Canceled after 0s
- **Management-Tunnel** (System › Management-Tunnel): Firewalls hinter NAT/CGNAT verwalten. Ein optionaler WireGuard-Hub auf dem OPNexus-Server (Compose-Profil `overlay`, Container `wg-hub` aus dem Backend-Image mit `NET_ADMIN`) nimmt die Firewalls entgegen, die sich nach außen einwählen; OPNexus erreicht deren API über einen kleinen CONNECT-Proxy des Hubs, der nur ins Tunnel-Netz verbindet. Je Firewall eine Tunnel-Adresse und ein eigener Pre-Shared Key, Anleitung mit kopierbaren Werten, Live-Status (Handshake, Datenmenge). Der Hub nimmt keine neuen Verbindungen aus dem Tunnel an. Ende-zu-Ende gegen eine echte OPNsense 26.7 geprüft (Handshake, API, Zertifikat festsetzen). Neue Tabellen `overlay_settings`, `overlay_peers` (Migration `0015`); das Backend-Image enthält jetzt `wireguard-tools`, `iproute2`, `iptables`.
46 lines
1.1 KiB
Python
46 lines
1.1 KiB
Python
from datetime import datetime
|
|
import uuid
|
|
|
|
from pydantic import BaseModel, Field
|
|
|
|
|
|
class OverlaySettingsRead(BaseModel):
|
|
enabled: bool
|
|
endpoint: str | None
|
|
subnet: str
|
|
listen_port: int
|
|
hub_public_key: str | None
|
|
hub_address: str
|
|
hub_state: str # running | stale | absent
|
|
|
|
|
|
class OverlaySettingsUpdate(BaseModel):
|
|
enabled: bool | None = None
|
|
endpoint: str | None = Field(default=None, max_length=255)
|
|
subnet: str | None = Field(default=None, max_length=18)
|
|
listen_port: int | None = Field(default=None, ge=1, le=65535)
|
|
|
|
|
|
class PeerCreate(BaseModel):
|
|
name: str = Field(min_length=1, max_length=80)
|
|
|
|
|
|
class PeerUpdate(BaseModel):
|
|
public_key: str | None = Field(default=None, max_length=44)
|
|
host_id: uuid.UUID | None = None
|
|
clear_host: bool = False
|
|
|
|
|
|
class PeerRead(BaseModel):
|
|
id: uuid.UUID
|
|
name: str
|
|
ip: str
|
|
public_key: str | None
|
|
host_id: uuid.UUID | None
|
|
host_name: str | None
|
|
connected: bool
|
|
last_handshake_at: datetime | None
|
|
rx_bytes: int
|
|
tx_bytes: int
|
|
remote_endpoint: str | None
|