Wireguard: "Patching" AllowedIps and interface PostUp

[sirthias]

Dear all,

I've just set up a wireguard VPN server on my Cloudron instance and love the simplicity and instant success! Great stuff!

However, I have one little question:

One of my VPN peers is a MikroTik LTE router with a private subnet 192.168.99.0/24 behind it.
After the VPN app is started I currently run the following two commands in the app's web terminal to make the nodes in the subnet behind the router reachable to all VPN peers:

wg set wg0 peer <key> allowed-ips 172.26.99.3/32,192.168.99.0/24
ip route add 192.168.99.0/24 via 172.26.99.3

These two commands add the subnet 192.168.99.0/24 to the AllowedIps of the routers wireguard peer entry and add a respective route.
This works great and everything functions exactly as it should.

However, these changes get lost when the VPN app is restarted.
In order to make them persist across app restarted I tried patching the /app/data/wg/wg0.conf file, but apparently this file gets regenerated on every app restart.

Does anyone have an idea of how to best make these two tweaks permanent?

Cheers
Mathias

[robi]

Look for a start.sh or run.sh file which gets called on start.

[sirthias]

Thank you, robi, I've seen /app/code/start.sh and it'd be a great place to put the needed changes, but this file is not in the /app/data/ folder and -- as such -- isn't writeable.
It seems to me I have to somehow sneak something into /app/data/ as that's the only place I have influence over.

One thought: Could I simply patch /app/data/wg/wg0.conf and chmod -r it to prevent it being rewritten on app restart?

[robi]

@sirthias probably not -r, how would the app read it?

Needs some TLC from staff and a package fix

[sirthias]

Ah, of course I meant -w to prevent the rewrite.

I don't think there is a lot of TLC required.
One additional line in start.sh would suffice, which simply checks for the existence of a custom script like /app/data/poststart.sh and calls it if it exists.
So, a hook for custom logic to run after the app has started and the tunnel is up.
Where can I best propose/submit this little feature request?

[robi]

This is it, however it is the weekend and staff need a break

[girish]

@sirthias if I understand correctly, you are adding a device that has a network behind it. What do you think of taking this network IP (or a list of IPs) when adding a new device? This way we don't need the special scripts.

[girish]

Something like this:

[robi]

@girish It would still be useful to expose an editable configuration file for future remote control or even API management.

Automation

[sirthias]

@girish Yes, of course, it'd be great it the VPN App had native support for routed networks behind a device.
This would make it easier for users who are less experienced with networking setups to quickly set this up.

I'd be happy to test-drive an update if you'd like to make one available.

Nevertheless I agree with @robi in that providing a simple hook for a custom script in the /app/data/ directory would also work and be even more flexible.
It wouldn't even have to become part of the UI and thus be somewhat less intrusive to the clean nature of the app.

Cheers
Mathias

[girish]

We prefer a UI-based and use case driven configuration approach to our software. You can even say flexibility is not a goal for this app. There is no way we can support complicated VPN setups that would arise from all the various configurations. Part of the reason this app exists is that the OpenVPN without the UI is really complicated to use for normal people. Of course, people are free to change the source to match their philosophy of how software should be :).

@sirthias I pushed a change with minimal testing, please check.

[sirthias]

I completely understand @girish. It's great that you have a clear vision for Cloudron's development which acts as a good guideline in cases like this.

@sirthias I pushed a change with minimal testing, please check.

Where can I see/find that change and how can I test it best?

[girish]

@sirthias it's an update to the VPN app. If you click on Updates -> Check for updates, you should see it. The source code of the app is at https://git.cloudron.io/packages/vpn-app (but this is only if you are interested in the source)

[sirthias]

Thank you, @girish, for the very quick implementation!
I just upgraded and so far things appear to be working as expected.
I'll test a bit more and report back with any issues I might come across...
Thanks again and cheers from Germany!