Open pandafy opened 2 years ago
EDIT: Moved details to the issue description.
There will be one separate container for the Flask app (wireguard-updater
). Each WireGuard tunnel will have its separate container (wireguard-<uuid>-<ifname>
). The WireGuard container will mount an NFS volume at /opt/wireguard-openwisp/.openwisp
. This directory will be used to download and store configuration and its checksum from OpenWISP. The same NFS volume will be mounted on the wireguard-updated
container at /opt/wireguard/config/<vpn-uuid>
.
The request to the wireguard-updater
container will contain the ID of the VPN which has to be updated. The Flask app will download the configuration of this VPN in the correct directory, i.e. /opt/wireguard-openwisp/config/<vpn-id>
.
There will be a program (bash script) on each of the WireGuard containers which will look for changes in the /opt/wireguard-openwisp/.openwisp
. Whenever it finds any changes, it should reload the WireGuard configuration.
Since replicas will share the same NFS volume, they will observe file change at the same time and will reload their configuration in small time interval. Thus, making the configuration consistent on both the containers.
Instead of NFS, we will use Redis to co-ordinate configuration changes
The request to the Flask app will contain VPN_ID
which needs to be updated. The Flask app will write the current timestamp in the Redis server with VPN_ID
as key.
There will be a process running on the WireGuard containers that will poll the Redis server continuously. This process will reload the configuration if the timestamp is different from the local one.
We are deferring support for VXLAN over WireGuard for later. https://github.com/openwisp/docker-openwisp/issues/228
We are deferring automated tests for the WireGuard container for later (https://github.com/openwisp/docker-openwisp/issues/229). In the current implementation, the WireGuard VPN is not created by default in OpenWISP. This creates a challenge for adding an automated test.
Add an image/container for deploying WireGuard and install the flask app required for updating the configuration just like we did it in https://github.com/openwisp/ansible-wireguard-openwisp
We can use the linuxserver/wireguard as the base docker image for the WireGuard container.
We need to provide the same level of configurability as the ansible-wireguard-openwisp. Following environment variables should be added
WIREGUARD_VPN_DOMAIN
WIREGUARD_CONTROLLER_URL
WIREGUARD_VPN_UUID
WIREGUARD_VPN_KEY
WIREGUARD_FLASK_KEY
WIREGUARD_FLASK_PORT
WIREGUARD_FLASK_HOST
WIREGUARD_FLASK_ENDPOINT
WIREGUARD_CURL_INSECURE
Provisioning of SSL certificate for the Flask application should be done in a similar way it is done for the
dashboard
andapi
containers. The container should create a self-signed certificate for development and pull certificates from Let's Encrypt for the production environment. It should be also possible for users to specify the SSL certificates.We shall re-use the Flask app and WireGuard updater scripts from the ansible role. We shall configure the WSGI such that it is accessible from both the internal hostname and FQDN.
Managing multiple WireGuard interfaces
In this iteration, we can defer the management of multiple WireGuard interfaces. If a user needs more than one WireGuard interface on the server, they'll have to spin up a new container.
Automatically creating WireGuard VPN server object
In this iteration, we will not enable WireGuard by default. If a user wants to use WireGuard they will have to first create a VPN server object and then spin up a container with the right environment values.
Explain the steps in the documentation for spinning up multiple WireGuard container. Explicitly mention that user will need to set environment variables for individual container because some variables will create conflicts.