search

NHAS / wag

Simple Wireguard 2FA
BSD 3-Clause "New" or "Revised" License
506 stars 27 forks source link

External State Management #116

Open ChrisPortman opened 4 months ago

ChrisPortman commented 4 months ago

I would like to be able to run a WAG instance in a cloud environment where it is deployed as a single instance that is periodically replaced by a new vm (e.g. EC2) instance. The instance cannot run NAT so that we preserve the traffic source information in application logs - hence the single instance.

Currently the stable version uses an sqlite database local on the machine, and the new beta appears to be using an in process etcd solution.

Ideally, it would be great if the users/device/other_state could be stored in a database SaaS offering (RDS postgres or similar) so that WAG servers could by brutally replaced without loosing state. Potentially allowing WAG to connect to an external etcd cluster could be an option, but it doesnt appear like any of the cloud providers provide a SaaS etcd service akin to RDS.

Perhaps if the state management could be restructured as an interface, so that a sqlite, etcd, other data store implementation could be supported, i'd be keen to contribute a postgres option

NHAS commented 4 months ago

Hi Chris, Im going to assume you want to destroy the wag boxes aggressively so it becomes incredibly difficult for an attacker to maintain persistence on your ingress machine?

Or is this for updates/infra as code?

I'd be more than happy for this to be an addition to wag as I think it makes sense.

I am currently working on a couple things which will delay my involvement in this. Such as moving on from eBPF, Websocket challenge response, and better etcd cluster roaming.

ChrisPortman commented 4 months ago

Hi Chris, Im going to assume you want to destroy the wag boxes aggressively so it becomes incredibly difficult for an attacker to maintain persistence on your ingress machine?

Or is this for updates/infra as code?

Yep, both of these essentially. :) Happy to help

Such as moving on from eBPF

Side Note: Are you looking to replace eBPF?

I am currently working on a couple things which will delay my involvement in this.

I'm happy to help - let me see how my next few weeks are shaping up, might be able to have a stab at it.

NHAS commented 4 months ago

I am indeed looking to replace eBPF because I've realized my solution is much more complicated than it needs to be and it can all be squashed into just pure go.

There are also a bunch of other thing its may enable, like better cluster roaming as then I may fork wireguard-go and add in the ability to set keypairs for different peers. Which would mean that even under aggressive loadbalancing users would never face downtime

NHAS commented 4 months ago

Im more than happy for anyone (yourself included) to open pull requests! With the obvious caveat that I might be quite picky with what people implement.