Wireguard: "Patching" AllowedIps and interface PostUp

[sirthias]

Dear all,

I've just set up a wireguard VPN server on my Cloudron instance and love the simplicity and instant success! Great stuff!

However, I have one little question:

One of my VPN peers is a MikroTik LTE router with a private subnet 192.168.99.0/24 behind it.
After the VPN app is started I currently run the following two commands in the app's web terminal to make the nodes in the subnet behind the router reachable to all VPN peers:

wg set wg0 peer <key> allowed-ips 172.26.99.3/32,192.168.99.0/24
ip route add 192.168.99.0/24 via 172.26.99.3

These two commands add the subnet 192.168.99.0/24 to the AllowedIps of the routers wireguard peer entry and add a respective route.
This works great and everything functions exactly as it should.

However, these changes get lost when the VPN app is restarted.
In order to make them persist across app restarted I tried patching the /app/data/wg/wg0.conf file, but apparently this file gets regenerated on every app restart.

Does anyone have an idea of how to best make these two tweaks permanent?

Cheers
Mathias

[robi]

Look for a start.sh or run.sh file which gets called on start.

[sirthias]

Thank you, robi, I've seen /app/code/start.sh and it'd be a great place to put the needed changes, but this file is not in the /app/data/ folder and -- as such -- isn't writeable.
It seems to me I have to somehow sneak something into /app/data/ as that's the only place I have influence over.

One thought: Could I simply patch /app/data/wg/wg0.conf and chmod -r it to prevent it being rewritten on app restart?