From 0399f45fb2ee6d3096992280892e1b3d5d4423de Mon Sep 17 00:00:00 2001 From: Dorian Date: Mon, 20 Apr 2026 07:10:49 -0400 Subject: [PATCH] fix(vpn,reconcile): restore WG peers on boot + filebrowser spec drift MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to 8b7cb002 (no version bump — same v1.7.0-alpha manifest): * WireGuard peer persistence. Kernel peer state is ephemeral; the add-peer RPC wrote each peer to data_dir/nostr-vpn/peers/*.json but nothing re-pushed them on reboot. Result on .198: wg0 came up listening with zero peers after last night's reboot. Added vpn::restore_wg_peers() — reads the peers dir, waits up to 30s for wg0 to exist, then replays each via `archipelago-wg add-peer`. Spawned from main.rs alongside the other startup tasks. * Reconcile + filebrowser drift. scripts/container-specs.sh load_spec_ filebrowser now declares SPEC_NETWORK="archy-net" (to match what first-boot-containers.sh creates) and pins the filebrowser-data volume + wget-style healthcheck so the reconciler stops reporting network drift. Without this, reconcile would kill the healthy first-boot filebrowser container and recreate it on bridge, breaking the archy-net DNS name the backend proxies to. Manifest binary sha/size refreshed: 6c178a76…3582cc, 40361912 bytes. Rebuilt ISO at image-recipe/results/archipelago-installer-unbundled-x86_64.iso (Apr 20 07:10) carries both fixes baked in. Co-Authored-By: Claude Opus 4.7 (1M context) --- core/archipelago/src/main.rs | 8 ++++ core/archipelago/src/vpn.rs | 83 ++++++++++++++++++++++++++++++++++++ scripts/container-specs.sh | 5 ++- 3 files changed, 94 insertions(+), 2 deletions(-) diff --git a/core/archipelago/src/main.rs b/core/archipelago/src/main.rs index 9d7dacea..0bfe0c17 100644 --- a/core/archipelago/src/main.rs +++ b/core/archipelago/src/main.rs @@ -176,6 +176,14 @@ async fn main() -> Result<()> { // Spawn disk space monitor (warns at 85%, auto-cleans at 90%) disk_monitor::spawn_disk_monitor(config.data_dir.clone()); + // Restore WireGuard peers into wg0 (kernel loses them on every reboot). + { + let data_dir = config.data_dir.clone(); + tokio::spawn(async move { + vpn::restore_wg_peers(&data_dir).await; + }); + } + // Spawn ElectrumX status cache (refreshes every 15s, serves cached data to avoid race conditions) electrs_status::spawn_status_cache(); diff --git a/core/archipelago/src/vpn.rs b/core/archipelago/src/vpn.rs index f2614145..c9403e76 100644 --- a/core/archipelago/src/vpn.rs +++ b/core/archipelago/src/vpn.rs @@ -708,6 +708,89 @@ pub async fn configure_wireguard( Ok(wg_config) } +/// Restore WireGuard peers from `data_dir/nostr-vpn/peers/*.json` into the +/// kernel after a reboot. +/// +/// Kernel peer state is ephemeral. The add-peer RPC persists each peer to +/// a JSON file but only pushes it into wg0 at creation time — without this +/// restore step, every reboot drops all peers and the user has to re-add +/// them via QR. +pub async fn restore_wg_peers(data_dir: &Path) { + let peers_dir = data_dir.join("nostr-vpn/peers"); + let mut entries = match fs::read_dir(&peers_dir).await { + Ok(e) => e, + Err(_) => return, + }; + + // archipelago-wg.service may race us on boot; wait up to 30s for wg0. + for _ in 0..30 { + let up = tokio::process::Command::new("ip") + .args(["link", "show", "wg0"]) + .output() + .await + .map(|o| o.status.success()) + .unwrap_or(false); + if up { + break; + } + tokio::time::sleep(std::time::Duration::from_secs(1)).await; + } + + let mut restored = 0usize; + while let Ok(Some(entry)) = entries.next_entry().await { + let path = entry.path(); + if path.extension().and_then(|s| s.to_str()) != Some("json") { + continue; + } + + let content = match fs::read_to_string(&path).await { + Ok(c) => c, + Err(e) => { + tracing::warn!("VPN restore: read {:?} failed: {}", path, e); + continue; + } + }; + let v: serde_json::Value = match serde_json::from_str(&content) { + Ok(v) => v, + Err(e) => { + tracing::warn!("VPN restore: parse {:?} failed: {}", path, e); + continue; + } + }; + let pubkey = v.get("public_key").and_then(|s| s.as_str()); + let ip = v.get("ip").and_then(|s| s.as_str()); + let (pubkey, ip) = match (pubkey, ip) { + (Some(p), Some(i)) => (p, i), + _ => { + tracing::warn!("VPN restore: {:?} missing public_key or ip", path); + continue; + } + }; + + let out = tokio::process::Command::new("sudo") + .args(["archipelago-wg", "add-peer", pubkey, ip]) + .output() + .await; + match out { + Ok(o) if o.status.success() => restored += 1, + Ok(o) => tracing::warn!( + "VPN restore: add-peer failed for {}: {}", + pubkey, + String::from_utf8_lossy(&o.stderr).trim() + ), + Err(e) => tracing::warn!("VPN restore: add-peer spawn failed: {}", e), + } + } + + if restored > 0 { + tracing::info!( + "🔐 VPN: restored {} WireGuard peer(s) from {}", + restored, + peers_dir.display() + ); + } +} + #[cfg(test)] mod tests { use super::*; diff --git a/scripts/container-specs.sh b/scripts/container-specs.sh index 34df8689..54ea0fa5 100755 --- a/scripts/container-specs.sh +++ b/scripts/container-specs.sh @@ -453,10 +453,11 @@ load_spec_filebrowser() { reset_spec SPEC_NAME="filebrowser" SPEC_IMAGE="${FILEBROWSER_IMAGE}" + SPEC_NETWORK="archy-net" SPEC_PORTS="8083:80" - SPEC_VOLUMES="/var/lib/archipelago/filebrowser:/srv" + SPEC_VOLUMES="/var/lib/archipelago/filebrowser:/srv /var/lib/archipelago/filebrowser-data:/data" SPEC_MEMORY="$(mem_limit filebrowser)" - SPEC_HEALTH_CMD="curl -sf http://localhost:80/ || exit 1" + SPEC_HEALTH_CMD="wget -q --spider http://localhost:80/health || exit 1" SPEC_TIER="3" SPEC_DATA_DIR="/var/lib/archipelago/filebrowser" SPEC_CAPS=""