messhy 0.8.2 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6cc5f92c8b8a35dfb82b3639ae13d18e962e6f67ff042b845b4e545ed53e9be3
-  data.tar.gz: 8165c8602fdcbb714fe9382dbadd217b399ee94d7c0ab987379c78964af7a166
+  metadata.gz: 14432b60b44c17938ab995bb9e9ca0a360f1381bbfe4f746e3bcc6a07be2e658
+  data.tar.gz: d98203d9b327d971f61e81022611e0f54d9e08673d381ae57fa27b58a55dabeb
 SHA512:
-  metadata.gz: 0d86591c5ccd0e3276785836a0250f1e23d991d10c8c4d30920d852245506cfd1d405904c9adf657d16289c65571c802f87bf7111db16bccf0c7b71024675e79
-  data.tar.gz: 7ce9ada0585d20b2cff7a108b4c5e68843b3489ceeab3aa21a572b7ab56910bd0a6fbe28e95a30f2f0b2dc3f317684ed123a8d576008e46e706a2c3f107e5d0b
+  metadata.gz: c8db3c1b1b7f71680e565c0373b463f4c749d4be645a90f587970a8955ef95d1684dffe2bf46d4cbbaf4de763e4d21482ed7c9e8aa72d4a64c56190c1076038b
+  data.tar.gz: 2e59b8e950931e8f27a4f004a5e9e381176ced1cb670fd16f03045ea4ee0856a2f81e577a5fc07fc5b535d4bd45218989db72b896ec0ab18cfe003af864517aa

data/CHANGELOG.md

@@ -0,0 +1,66 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.9.0] - 2026-09-02
+
+### Added
+
+- Per-node `jump_host` routing for SSH bootstrap without copying private keys to the jump host.
+- Strict known-hosts file configuration, live key import, and sequential
+  `wg syncconf` reconciliation for adding nodes without restarting active interfaces.
+- Optional `lan` transports that route WireGuard directly over a shared named
+  private network and fall back to each peer's public `host` otherwise.
+
+### Changed
+
+- Rename the WireGuard identity from `private_ip` to `mesh_ip`. Existing
+  `private_ip` configuration is normalized at load time for compatibility.
+
+## [0.8.3] - 2026-08-20
+
+### Changed
+
+- Require Ruby 4.0 or newer.
+- Align runtime and development dependencies with the maintained toolchain.
+- Add blocking test, lint, dependency-audit, and package-build CI checks.
+- Add automated Bundler and GitHub Actions dependency updates.
+- Document key custody, SSH trust, and full-mesh security boundaries.
+
+## [0.1.0] - 2025-01-21
+
+### Added
+- Initial release of Messhy
+- Full WireGuard VPN mesh network setup across any VMs
+- Every node connects directly to every other node (full mesh topology)
+- Automated WireGuard installation and configuration
+- Dynamic key generation and distribution
+- Automatic peer configuration across all nodes
+- Rails integration with generators and rake tasks
+- Standalone Ruby support (no Rails dependency required)
+- SSH-based deployment (no Python, Ansible, or Kubernetes)
+- Health checking and status monitoring
+- WireGuard status parsing and connection verification
+- Host trust management for SSH connections
+- Support for both public and private IP addresses
+- YAML-based configuration with ERB support
+- Secret management via environment variables or command execution
+
+### Technical Details
+- Uses SSHKit for SSH operations
+- Thor-based CLI interface with `messhy` command
+- Automatic IP allocation for VPN network (10.8.0.0/24 by default)
+- UDP port configuration (default: 51820)
+- Compatible with Ubuntu 20.04+ servers (Debian-based distributions)
+- Ruby >= 3.4.0 required
+
+### Commands
+- `messhy setup` - Deploy WireGuard mesh network
+- `messhy status` - Check mesh network health and connectivity
+- `messhy add_node` - Add new node to existing mesh
+- `messhy remove_node` - Remove node from mesh

data/README.md

@@ -6,21 +6,10 @@ A Ruby gem that sets up a full WireGuard VPN mesh across any VMs. Every node con
 
 ## Why messhy?
 
-### Problems It Solves
-
-❌ **Without messhy:**
-- Database replication over public IPs (insecure)
-- Complex VPN configurations
-- NAT traversal issues
-- Manual key management
-- Cloud-specific networking (VPC, subnet, security groups)
-
-✅ **With messhy:**
-- Secure encrypted connections (WireGuard)
-- Automatic key generation and distribution
-- Works across any cloud/datacenter
-- Zero application changes (just use 10.8.0.x IPs)
-- Simple configuration
+Messhy generates WireGuard keys and peer configuration, installs it over SSH,
+and gives each node a stable private address. It is intended for small fleets
+whose operators control every host and can explicitly allow WireGuard traffic
+between peers.
 
 ## Installation
 
@@ -49,15 +38,21 @@ production:
   nodes:
     db-primary:
       host: 34.12.234.81
-      private_ip: 10.8.0.10
+      mesh_ip: 10.8.0.10
+      lan:
+        network: aws-virginia
+        ip: 10.70.1.10
 
     db-standby:
       host: 52.23.45.67
-      private_ip: 10.8.0.11
+      mesh_ip: 10.8.0.11
+      lan:
+        network: aws-virginia
+        ip: 10.70.1.11
 
     app-1:
       host: 18.156.78.90
-      private_ip: 10.8.0.20
+      mesh_ip: 10.8.0.20
 ```
 
 2. **Setup mesh**:
@@ -170,6 +165,22 @@ messhy setup --skip-node=app-1            # Skip specific node
 messhy setup --only-node=db-primary       # Setup single node
 ```
 
+For an existing mesh, import its live key material once through trusted SSH,
+then reconcile additions or peer changes without restarting active WireGuard
+interfaces:
+
+```bash
+messhy import-keys --environment=production
+messhy reconcile --environment=production --dry-run
+messhy reconcile --environment=production
+```
+
+`import-keys` writes the same mode-`0600` local secret files as initial setup
+and never prints key material. `reconcile` validates each candidate config,
+applies active peer changes with `wg syncconf`, and restores the previous config
+if a live sync fails. Set `ssh_known_hosts_file` to a reviewed file when the
+mesh should not depend on the operator's global SSH configuration.
+
 ### Status & Monitoring
 
 ```bash
@@ -243,10 +254,15 @@ interface.
 ### Node Configuration
 
 Each node requires:
-- `host`: Public IP or hostname
-- `private_ip`: Private VPN IP (must be within network range)
+
+- `host`: Public IP or hostname used for SSH and as the WireGuard endpoint fallback
+- `mesh_ip`: Stable IP inside the WireGuard network
 
 Optional per-node overrides:
+
+- `lan`: A shared private transport with `network` and `ip`. Peers on the same
+  named network use the LAN IP as their WireGuard endpoint; all other peers use
+  `host`.
 - `ssh_user` / `ssh_port`: Override SSH access details (defaults to top-level `user` and port 22)
 - `ssh_key`: Override SSH key for a specific node
 - `listen_port`: WireGuard UDP port (defaults to top-level `listen_port`)
@@ -285,17 +301,25 @@ iptables -A INPUT -p udp --dport 51820 -j ACCEPT
 - Optimal routing (direct connections)
 - Scales to ~50 nodes
 
-## Performance
+## Capacity and performance
 
-### Benchmarks (compared to no VPN)
+A full mesh creates one peer relationship between every pair of nodes, so the
+configuration grows quadratically. Messhy is designed for small fleets (about
+50 nodes or fewer), not large or frequently changing membership. Throughput,
+latency, and CPU overhead depend on the hosts, network path, MTU, and workload;
+benchmark the actual topology before relying on a capacity estimate.
 
-| Metric | No VPN | WireGuard | Overhead |
-|--------|--------|-----------|----------|
-| Throughput | 1000 Mbps | 950 Mbps | 5% |
-| Latency | 10ms | 10.5ms | +0.5ms |
-| CPU usage | 2% | 3% | +1% |
+## Security boundaries
 
-**WireGuard is FAST!** Negligible overhead for most workloads.
+- `trust-hosts` collects host keys with `ssh-keyscan`; verify fingerprints over
+  a separate trusted channel before relying on them.
+- Anyone with a generated node private key can impersonate that node. Store
+  `.secrets/wireguard` in an encrypted vault and rotate keys after suspected
+  disclosure or membership changes.
+- Messhy configures WireGuard, but it does not replace host firewalls, patching,
+  SSH hardening, or application-level authentication.
+- Full-mesh membership grants direct network reachability. Only enroll hosts
+  that should be able to reach one another.
 
 ## Troubleshooting
 
@@ -330,7 +354,7 @@ messhy setup
 
 ## Requirements
 
-- Ruby 3.0+
+- Ruby 4.0+
 - WireGuard tools (`wg` command)
 - Target servers with Linux kernel 5.6+ (WireGuard built-in)
 - SSH key-based authentication
@@ -345,4 +369,4 @@ The gem is available as open source under the terms of the [MIT License](https:/
 
 ---
 
-Built with ❤️ for the Rails community by [Gaurav](https://github.com/yourusername)
+Maintained by [BoringCache](https://github.com/boringcache).

data/SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please do not open a public issue for a potential vulnerability. Email
+[security@boringcache.com](mailto:security@boringcache.com) or use
+[GitHub private vulnerability reporting](https://github.com/boringcache/messhy/security/advisories/new).
+
+Include the affected version, expected impact, and enough reproduction detail
+for us to investigate. Do not include live credentials, private keys, customer
+data, or production configuration.
+
+## Supported Versions
+
+Only the latest published release is supported. Security fixes are normally
+shipped in a new release rather than backported.
+
+## Scope
+
+Reports about WireGuard key handling, SSH host verification, generated network
+configuration, command execution, or release integrity are welcome.

data/lib/messhy/cli.rb

@@ -26,6 +26,23 @@ module Messhy
       handle_ssh_error(e, config)
     end
 
+    desc 'reconcile', 'Apply mesh changes without restarting active WireGuard interfaces'
+    option :dry_run, type: :boolean, default: false
+    def reconcile
+      config = load_config
+      Installer.new(config, dry_run: options[:dry_run]).reconcile
+    rescue SSHKit::Runner::ExecuteError => e
+      handle_ssh_error(e, config)
+    end
+
+    desc 'import-keys', 'Import existing mesh key material into the local secrets directory'
+    def import_keys
+      config = load_config
+      Installer.new(config).import_keys
+    rescue SSHKit::Runner::ExecuteError => e
+      handle_ssh_error(e, config)
+    end
+
     desc 'dns', 'Setup mesh DNS (dnsmasq)'
     option :dry_run, type: :boolean, default: false
     option :skip_node, type: :string
@@ -107,7 +124,7 @@ module Messhy
     def list
       config = load_config
       config.each_node do |name, node_config|
-        puts "#{name}: #{node_config['host']} (#{node_config['private_ip']})"
+        puts "#{name}: #{node_config['host']} (#{node_config['mesh_ip']})"
       end
     end
 
@@ -123,7 +140,7 @@ module Messhy
 
       puts "Node: #{name}"
       puts "Host: #{node_config['host']}"
-      puts "Private IP: #{node_config['private_ip']}"
+      puts "Mesh IP: #{node_config['mesh_ip']}"
       puts "Region: #{node_config['region']}" if node_config['region']
 
       health_checker = HealthChecker.new(config)

data/lib/messhy/configuration.rb

@@ -10,6 +10,7 @@ module Messhy
                 :dns,
                 :user,
                 :ssh_key,
+                :ssh_known_hosts_file,
                 :mtu,
                 :listen_port,
                 :keepalive,
@@ -20,10 +21,11 @@ module Messhy
       env_config = config_hash[environment] || {}
 
       @network = env_config['network'] || '10.8.0.0/24'
-      @nodes = env_config['nodes'] || {}
+      @nodes = normalize_nodes(env_config['nodes'] || {})
       @dns = env_config['dns'] || {}
       @user = env_config['user'] || 'ubuntu'
       @ssh_key = File.expand_path(env_config['ssh_key'] || '~/.ssh/id_rsa')
+      @ssh_known_hosts_file = optional_path(env_config['ssh_known_hosts_file'])
       @mtu = env_config['mtu'] || 1280
       @listen_port = env_config['listen_port'] || 51_820
       @keepalive = env_config['keepalive'] || 25
@@ -47,6 +49,16 @@ module Messhy
       @nodes[name]
     end
 
+    def peer_endpoint_for(node_name, peer_name)
+      node = node_config(node_name)
+      peer = node_config(peer_name)
+
+      return peer['host'] unless node['lan'] && peer['lan']
+      return peer['host'] unless node.dig('lan', 'network') == peer.dig('lan', 'network')
+
+      peer.dig('lan', 'ip')
+    end
+
     def each_node(&)
       @nodes.each(&)
     end
@@ -65,10 +77,7 @@ module Messhy
     def validate!
       raise Error, 'No nodes defined' if @nodes.empty?
 
-      @nodes.each do |name, config|
-        raise Error, "Node #{name} missing 'host'" unless config['host']
-        raise Error, "Node #{name} missing 'private_ip'" unless config['private_ip']
-      end
+      @nodes.each { |name, config| validate_node!(name, config) }
 
       if dns_enabled?
         raise Error, 'DNS domain is required when dns is enabled' if dns_domains.empty?
@@ -83,6 +92,13 @@ module Messhy
       true
     end
 
+    def jump_host_config(name)
+      jump_host = node_config(name)&.dig('jump_host')
+      return unless jump_host
+
+      node_config(jump_host) || raise(Error, "Node #{name} jump_host not found: #{jump_host}")
+    end
+
     def verify_host_key_mode
       case @verify_host_key
       when true, 'always', :always
@@ -149,5 +165,48 @@ module Messhy
 
       @dns['auto_records'] == true
     end
+
+    private
+
+    def optional_path(path)
+      File.expand_path(path) if path
+    end
+
+    def normalize_nodes(nodes)
+      nodes.to_h do |name, config|
+        [name, normalize_node(name, config)]
+      end
+    end
+
+    def normalize_node(name, config)
+      config = config.dup
+      legacy_mesh_ip = config.delete('private_ip')
+
+      if config['mesh_ip'] && legacy_mesh_ip && config['mesh_ip'] != legacy_mesh_ip
+        raise Error, "Node #{name} has conflicting 'mesh_ip' and deprecated 'private_ip' values"
+      end
+
+      config['mesh_ip'] ||= legacy_mesh_ip
+      config
+    end
+
+    def validate_node!(name, config)
+      raise Error, "Node #{name} missing 'host'" unless config['host']
+      raise Error, "Node #{name} missing 'mesh_ip'" unless config['mesh_ip']
+
+      validate_lan!(name, config['lan']) if config['lan']
+
+      jump_host = config['jump_host']
+      return unless jump_host
+
+      raise Error, "Node #{name} cannot use itself as jump_host" if jump_host == name
+      raise Error, "Node #{name} jump_host not found: #{jump_host}" unless node_config(jump_host)
+    end
+
+    def validate_lan!(name, lan)
+      raise Error, "Node #{name} 'lan' must be a mapping" unless lan.is_a?(Hash)
+      raise Error, "Node #{name} lan missing 'network'" if lan['network'].to_s.empty?
+      raise Error, "Node #{name} lan missing 'ip'" if lan['ip'].to_s.empty?
+    end
   end
 end

data/lib/messhy/dns_manager.rb

@@ -31,14 +31,14 @@ module Messhy
       interface = config.dns_interface
       ttl = config.dns_ttl
       server_nodes = config.dns_server_nodes
-      server_ips = server_nodes.map { |name| config.node_config(name)['private_ip'] }
+      server_ips = server_nodes.map { |name| config.node_config(name)['mesh_ip'] }
 
       records = build_records(domain)
 
       server_nodes.each do |node|
         next if @skip && node == @skip
 
-        server_ip = config.node_config(node)['private_ip']
+        server_ip = config.node_config(node)['mesh_ip']
         conf = build_dnsmasq_conf(domain, interface, server_ip, records, ttl)
 
         if dry_run
@@ -79,7 +79,7 @@ module Messhy
           execute :sudo, 'resolvectl', 'flush-caches', raise_on_error: false
         elsif test('[ -d /etc/resolvconf/resolv.conf.d ]', raise_on_error: false)
           head_path = '/etc/resolvconf/resolv.conf.d/head'
-          content = server_ips.map { |ip| "nameserver #{ip}" }.join("\n") + "\n"
+          content = "#{server_ips.map { |ip| "nameserver #{ip}" }.join("\n")}\n"
           upload! StringIO.new(content), '/tmp/messhy-resolv.conf'
           execute :sudo, 'mv', '/tmp/messhy-resolv.conf', head_path
           execute :sudo, 'chmod', '644', head_path
@@ -97,7 +97,7 @@ module Messhy
         config.each_node do |name, node_config|
           hostname = "#{sanitize_dns_label(name)}.#{domain}"
           records[hostname] ||= []
-          records[hostname] << node_config['private_ip']
+          records[hostname] << node_config['mesh_ip']
         end
       end
 
@@ -112,14 +112,14 @@ module Messhy
         end
       end
 
-      records.transform_values { |ips| ips.uniq }
+      records.transform_values(&:uniq)
     end
 
     def resolve_target(target)
       return '' if target.nil?
 
       node = config.node_config(target.to_s)
-      return node['private_ip'] if node
+      return node['mesh_ip'] if node
 
       target.to_s
     end
@@ -159,7 +159,7 @@ module Messhy
         end
       end
 
-      lines.join("\n") + "\n"
+      "#{lines.join("\n")}\n"
     end
   end
 end

data/lib/messhy/health_checker.rb

@@ -43,7 +43,7 @@ module Messhy
         peers = status.scan(/peer: (.+?)$/).flatten
 
         if peers.any?
-          puts "✓ #{node_name} (#{node_config['private_ip']})#{label_display} - connected to #{peers.size} peers"
+          puts "✓ #{node_name} (#{node_config['mesh_ip']})#{label_display} - connected to #{peers.size} peers"
 
           # Show basic peer info
           status.split('peer:').drop(1).each do |peer_block|
@@ -54,10 +54,10 @@ module Messhy
             puts "  └─ Peer: #{endpoint} - #{stats[:received]} rx, #{stats[:sent]} tx"
           end
         else
-          puts "✗ #{node_name} (#{node_config['private_ip']})#{label_display} - 0 peers (DOWN)"
+          puts "✗ #{node_name} (#{node_config['mesh_ip']})#{label_display} - 0 peers (DOWN)"
         end
       rescue StandardError => e
-        puts "✗ #{node_name} (#{node_config['private_ip']})#{label_display} - Error: #{e.message}"
+        puts "✗ #{node_name} (#{node_config['mesh_ip']})#{label_display} - Error: #{e.message}"
       end
     end
 
@@ -69,12 +69,12 @@ module Messhy
       if node_or_ip =~ /^\d+\.\d+\.\d+\.\d+$/
         # It's an IP
         target_ip = node_or_ip
-        target_node = config.nodes.find { |_, cfg| cfg['private_ip'] == target_ip }&.first
+        target_node = config.nodes.find { |_, cfg| cfg['mesh_ip'] == target_ip }&.first
       else
         # It's a node name
         target_node = node_or_ip
         node_config = config.node_config(target_node)
-        target_ip = node_config['private_ip'] if node_config
+        target_ip = node_config['mesh_ip'] if node_config
       end
 
       unless target_ip
@@ -94,7 +94,6 @@ module Messhy
       end
     end
 
-    # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
     def test_all
       puts '==> Testing mesh connectivity...'
       puts
@@ -116,7 +115,7 @@ module Messhy
 
           tested_pairs.add(pair_key)
           test_count += 1
-          target_ip = target_config['private_ip']
+          target_ip = target_config['mesh_ip']
 
           print "[#{test_count}/#{total_tests}] Testing #{source_name} → #{target_name} (#{target_ip})... "
           $stdout.flush
@@ -133,7 +132,7 @@ module Messhy
 
           if success
             puts '✓'
-          elsif handshake_recent?(source_name, target_config['private_ip'], status_cache)
+          elsif handshake_recent?(source_name, target_config['mesh_ip'], status_cache)
             puts '✓ (handshake)'
           else
             puts '✗ (ICMP/TCP may be blocked, and no recent WireGuard handshake)'
@@ -148,7 +147,6 @@ module Messhy
       puts 'If a pair still reports a failure, there has been no recent handshake—check UDP 51820 and ' \
            'keepalive/route settings.'
     end
-    # rubocop:enable Metrics/AbcSize, Metrics/MethodLength
 
     def show_stats(node: nil)
       if node
@@ -179,17 +177,17 @@ module Messhy
             service = capture(:systemctl, 'is-active', 'dnsmasq', raise_on_non_zero_exit: false).strip
             messhy_records = capture(:bash, '-c',
                                      "sudo awk 'BEGIN{c=0} /^address=\\//{c++} END{print c}' " \
-                                     "/etc/dnsmasq.d/messhy.conf 2>/dev/null || true").strip
+                                     '/etc/dnsmasq.d/messhy.conf 2>/dev/null || true').strip
             ap_records = capture(:bash, '-c',
                                  "sudo awk 'BEGIN{c=0} /^address=\\//{c++} END{print c}' " \
-                                 "/etc/dnsmasq.d/active_postgres.conf 2>/dev/null || true").strip
+                                 '/etc/dnsmasq.d/active_postgres.conf 2>/dev/null || true').strip
 
             status_icon = service == 'active' ? '✓' : '✗'
-            puts "#{status_icon} #{node_name} (#{node_config['private_ip']})#{label_display} - dnsmasq #{service}"
+            puts "#{status_icon} #{node_name} (#{node_config['mesh_ip']})#{label_display} - dnsmasq #{service}"
             puts "  └─ records: messhy=#{messhy_records.to_i} active_postgres=#{ap_records.to_i}"
           end
         rescue StandardError => e
-          puts "✗ #{node_name} (#{node_config['private_ip']})#{label_display} - DNS check failed: #{e.message}"
+          puts "✗ #{node_name} (#{node_config['mesh_ip']})#{label_display} - DNS check failed: #{e.message}"
         end
       end
 
@@ -216,7 +214,7 @@ module Messhy
           next if tested_pairs.include?(pair_key)
 
           tested_pairs.add(pair_key)
-          target_ip = config.node_config(target)['private_ip']
+          target_ip = config.node_config(target)['mesh_ip']
           latency = @ssh_executor.measure_latency(source, target_ip)
           latencies[[source, target]] = latency
           latencies[[target, source]] = latency
@@ -224,7 +222,7 @@ module Messhy
       end
 
       max_name_len = node_names.map(&:length).max
-      header = ' ' * (max_name_len + 2) + node_names.map { |n| n[0..7].rjust(8) }.join(' ')
+      header = (' ' * (max_name_len + 2)) + node_names.map { |n| n[0..7].rjust(8) }.join(' ')
       puts header
       puts '-' * header.length
 
@@ -259,7 +257,7 @@ module Messhy
     def show_node_stats(node_name)
       node_config = config.node_config(node_name)
 
-      puts "==> Stats for #{node_name} (#{node_config['private_ip']})"
+      puts "==> Stats for #{node_name} (#{node_config['mesh_ip']})"
 
       begin
         status = @ssh_executor.get_wireguard_status(node_name)

data/lib/messhy/installer.rb

@@ -11,14 +11,63 @@ module Messhy
   class Installer
     attr_reader :config, :dry_run, :ssh_executor
 
-    def initialize(config, dry_run: false)
+    def initialize(config, dry_run: false, ssh_executor: SSHExecutor.new(config))
       @config = config
       @dry_run = dry_run
-      @ssh_executor = SSHExecutor.new(config)
+      @ssh_executor = ssh_executor
       @node_keys = load_existing_keys
       @psk_map = load_existing_psks
     end
 
+    def import_keys
+      puts '==> Importing existing WireGuard key material'
+      config.validate!
+
+      imported_psks = {}
+      config.each_node do |node_name, node_config|
+        snapshot = WireguardConfig.parse(ssh_executor.read_wireguard_config(node_name))
+        validate_imported_address!(node_name, node_config, snapshot)
+        import_node_key(node_name, snapshot)
+        import_peer_psks(node_name, snapshot, imported_psks)
+        puts "  ✓ Imported #{node_name}"
+      end
+
+      @psk_map.merge!(imported_psks)
+      persist_psk_map
+      puts "✓ Imported #{config.node_names.size} node keys and #{@psk_map.size} peer keys"
+    end
+
+    def reconcile
+      puts '==> Reconciling WireGuard mesh without restarting active interfaces'
+      config.validate!
+
+      puts "\n==> Installing missing WireGuard tools..."
+      install_wireguard_on_all_nodes
+      puts "\n==> Ensuring key material exists..."
+      generate_all_keys
+
+      configs = MeshBuilder.new(config, @node_keys, @psk_map || {}).build_all_configs
+      puts "\n==> Applying configurations sequentially..."
+      configs.each do |node_name, config_content|
+        if dry_run
+          puts "  [DRY RUN] Would reconcile #{node_name}"
+        else
+          ssh_executor.reconcile_config(node_name, config_content)
+          puts "  ✓ Reconciled #{node_name}"
+        end
+      end
+
+      puts "\n==> Verifying mesh connectivity..."
+      verify_mesh
+
+      if config.dns_enabled?
+        puts "\n==> Reconciling mesh DNS..."
+        DnsManager.new(config, ssh_executor: ssh_executor, dry_run: dry_run).setup
+      end
+
+      puts "\n✓ WireGuard mesh reconciled"
+    end
+
     def setup(skip: nil)
       puts '==> Setting up WireGuard mesh network'
       puts "Environment: #{config.environment}"
@@ -130,6 +179,36 @@ module Messhy
 
     private
 
+    def validate_imported_address!(node_name, node_config, snapshot)
+      address = snapshot.interface['Address'].to_s.split('/').first
+      return if address == node_config['mesh_ip']
+
+      raise Error, "Node #{node_name} WireGuard address #{address.inspect} does not match #{node_config['mesh_ip']}"
+    end
+
+    def import_node_key(node_name, snapshot)
+      private_key = snapshot.interface['PrivateKey']
+      raise Error, "Node #{node_name} has no WireGuard private key" if private_key.to_s.empty?
+
+      keypair = { private_key: private_key, public_key: ssh_executor.wireguard_public_key(node_name) }
+      @node_keys[node_name] = keypair
+      store_keypair(node_name, keypair)
+    end
+
+    def import_peer_psks(node_name, snapshot, imported_psks)
+      snapshot.peers.each do |peer|
+        peer_name = peer['Name']
+        psk = peer['PresharedKey']
+        next if peer_name.to_s.empty? || psk.to_s.empty?
+
+        pair_key = [node_name, peer_name].sort.join('-')
+        existing = imported_psks[pair_key]
+        raise Error, "Conflicting WireGuard peer key for #{pair_key}" if existing && existing != psk
+
+        imported_psks[pair_key] = psk
+      end
+    end
+
     def generate_all_keys(skip: nil)
       config.each_node do |node_name, _|
         next if skip && node_name == skip

data/lib/messhy/mesh_builder.rb

@@ -25,7 +25,7 @@ module Messhy
       template = ERB.new(File.read(template_path), trim_mode: '-')
 
       # Prepare data for template
-      interface_ip = node_config['private_ip']
+      interface_ip = node_config['mesh_ip']
       prefix_length = config.network_prefix_length
       private_key = keys[:private_key]
       listen_port = node_config['listen_port'] || config.listen_port
@@ -38,9 +38,9 @@ module Messhy
       if config.dns_enabled?
         dns_domain = config.dns_domain
         dns_interface = config.dns_interface
-        dns_server_ips = config.dns_server_nodes.filter_map { |name|
-          config.node_config(name)&.dig('private_ip')
-        }
+        dns_server_ips = config.dns_server_nodes.filter_map do |name|
+          config.node_config(name)&.dig('mesh_ip')
+        end
       end
 
       is_dns_server = config.dns_enabled? && config.dns_server_nodes.include?(node_name)
@@ -56,13 +56,15 @@ module Messhy
         # Get symmetric PSK for this peer pair
         pair_key = [node_name, peer_name].sort.join('-')
         psk = psk_map[pair_key]
+        endpoint = config.peer_endpoint_for(node_name, peer_name)
+        peer_listen_port = peer_config['listen_port'] || config.listen_port
 
         peers << {
           name: peer_name,
           public_key: peer_keys[:public_key],
           preshared_key: psk,
-          allowed_ips: "#{peer_config['private_ip']}/32",
-          endpoint: "#{peer_config['host']}:#{peer_config['listen_port'] || config.listen_port}",
+          allowed_ips: "#{peer_config['mesh_ip']}/32",
+          endpoint: "#{endpoint}:#{peer_listen_port}",
           keepalive: config.keepalive
         }
       end

data/lib/messhy/ssh_executor.rb

@@ -2,6 +2,8 @@
 
 require 'sshkit'
 require 'sshkit/dsl'
+require 'net/ssh/proxy/command'
+require 'shellwords'
 require 'stringio'
 
 module Messhy
@@ -108,6 +110,31 @@ module Messhy
       end
     end
 
+    def read_wireguard_config(node_name)
+      content = nil
+      execute_on_node(node_name) do
+        content = capture(:sudo, :cat, '/etc/wireguard/wg0.conf')
+      end
+      content
+    end
+
+    def wireguard_public_key(node_name)
+      public_key = nil
+      execute_on_node(node_name) do
+        public_key = capture(:sudo, :wg, 'show', 'wg0', 'public-key').strip
+      end
+      public_key
+    end
+
+    def reconcile_config(node_name, config_content)
+      temp_file = '/tmp/messhy-wg0.conf'
+      script = reconcile_script(temp_file)
+      execute_on_node(node_name) do
+        upload! StringIO.new(config_content), temp_file
+        execute :sudo, :bash, '-lc', Shellwords.escape(script)
+      end
+    end
+
     def upload_and_start_configs(configs)
       hosts = configs.filter_map do |node_name, config_content|
         node_config = config.node_config(node_name)
@@ -176,9 +203,7 @@ module Messhy
       latency = nil
       execute_on_node(source_node) do
         output = capture(:ping, '-c', '3', '-W', '2', '-I', 'wg0', target_ip, raise_on_non_zero_exit: false)
-        if output =~ %r{rtt min/avg/max/mdev = [\d.]+/([\d.]+)/}
-          latency = ::Regexp.last_match(1).to_f
-        end
+        latency = ::Regexp.last_match(1).to_f if output =~ %r{rtt min/avg/max/mdev = [\d.]+/([\d.]+)/}
       end
       latency
     rescue StandardError
@@ -279,6 +304,8 @@ module Messhy
         verify_host_key: config.verify_host_key_mode
       }
 
+      options[:user_known_hosts_file] = [config.ssh_known_hosts_file] if config.ssh_known_hosts_file
+
       if File.exist?(config.ssh_key)
         options[:keys] = [config.ssh_key]
         options[:keys_only] = true
@@ -295,16 +322,65 @@ module Messhy
       ssh_port = node_config['ssh_port'] || node_config['port']
       host.port = ssh_port if ssh_port
 
+      host.ssh_options = (host.ssh_options || {}).merge(strict_ssh_options)
+
       if node_config['ssh_key']
         keys = Array(node_config['ssh_key']).map { |path| File.expand_path(path) }
         merged = (host.ssh_options || {}).merge(keys: keys, keys_only: true)
         host.ssh_options = merged
       end
 
+      if (jump_host_config = config.jump_host_config(node_name))
+        merged = (host.ssh_options || {}).merge(proxy: jump_proxy(jump_host_config))
+        host.ssh_options = merged
+      end
+
       manage_property(host.properties, :node_name, node_name)
       host
     end
 
+    def strict_ssh_options
+      options = { verify_host_key: config.verify_host_key_mode }
+      options[:user_known_hosts_file] = [config.ssh_known_hosts_file] if config.ssh_known_hosts_file
+      options
+    end
+
+    def jump_proxy(jump_host_config)
+      jump_user = jump_host_config['ssh_user'] || jump_host_config['user'] || config.user
+      jump_port = jump_host_config['ssh_port'] || jump_host_config['port']
+      jump_key = jump_host_config['ssh_key'] || config.ssh_key
+      command = [
+        'ssh',
+        '-F', '/dev/null',
+        '-o', 'BatchMode=yes',
+        '-o', 'ForwardAgent=no',
+        '-o', "StrictHostKeyChecking=#{open_ssh_host_key_mode}"
+      ]
+
+      command.push('-o', "UserKnownHostsFile=#{config.ssh_known_hosts_file}") if config.ssh_known_hosts_file
+
+      if jump_key && File.exist?(File.expand_path(jump_key))
+        command.push('-i', File.expand_path(jump_key), '-o', 'IdentitiesOnly=yes')
+      end
+
+      command.push('-p', jump_port.to_s) if jump_port
+      command.push('-W', '%h:%p', "#{jump_user}@#{jump_host_config.fetch('host')}")
+
+      command_line = Shellwords.join(command).gsub('\\%h', '%h').gsub('\\%p', '%p')
+      Net::SSH::Proxy::Command.new(command_line)
+    end
+
+    def open_ssh_host_key_mode
+      case config.verify_host_key_mode
+      when :accept_new
+        'accept-new'
+      when :never
+        'no'
+      else
+        'yes'
+      end
+    end
+
     def manage_property(properties, key, value = nil)
       if value.nil?
         # Fetch mode
@@ -314,5 +390,39 @@ module Messhy
         properties.respond_to?(:set) ? properties.set(key, value) : properties[key] = value
       end
     end
+
+    def reconcile_script(temp_file)
+      <<~SCRIPT
+        set -euo pipefail
+        target=/etc/wireguard/wg0.conf
+        candidate=/etc/wireguard/wg0.next.conf
+        previous=/etc/wireguard/wg0.conf.previous
+        stripped=/tmp/messhy-wg0.stripped
+
+        install -o root -g root -m 600 #{temp_file} "$candidate"
+        wg-quick strip "$candidate" > "$stripped"
+
+        if systemctl is-active --quiet wg-quick@wg0; then
+          cp -p "$target" "$previous"
+          mv "$candidate" "$target"
+          if ! wg syncconf wg0 "$stripped"; then
+            cp -p "$previous" "$target"
+            wg-quick strip "$target" > "$stripped"
+            wg syncconf wg0 "$stripped"
+            exit 1
+          fi
+        else
+          test ! -f "$target" || cp -p "$target" "$previous"
+          mv "$candidate" "$target"
+          systemctl enable wg-quick@wg0
+          if ! systemctl start wg-quick@wg0; then
+            test ! -f "$previous" || cp -p "$previous" "$target"
+            exit 1
+          fi
+        fi
+
+        rm -f "$stripped" #{temp_file}
+      SCRIPT
+    end
   end
 end

data/lib/messhy/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Messhy
-  VERSION = '0.8.2'
+  VERSION = '0.9.0'
 end

data/lib/messhy/wireguard_config.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Messhy
+  class WireguardConfig
+    attr_reader :interface, :peers
+
+    def self.parse(content)
+      new(content).tap(&:parse!)
+    end
+
+    def initialize(content)
+      @content = content
+      @interface = {}
+      @peers = []
+    end
+
+    def parse!
+      section = nil
+      peer_name = nil
+
+      @content.each_line do |line|
+        stripped = line.strip
+        if (match = stripped.match(/\A# Peer: (.+)\z/))
+          peer_name = match[1]
+        elsif stripped == '[Interface]'
+          section = interface
+        elsif stripped == '[Peer]'
+          section = {}
+          section['Name'] = peer_name if peer_name
+          peers << section
+          peer_name = nil
+        elsif section && (match = stripped.match(/\A([^#=]+?)\s*=\s*(.+)\z/))
+          section[match[1].strip] = match[2].strip
+        end
+      end
+
+      self
+    end
+  end
+end

data/lib/messhy/wireguard_status_parser.rb

@@ -20,35 +20,50 @@ module Messhy
     def parse_handshake_seconds(desc)
       return nil if desc.strip.casecmp('(none)').zero?
 
-      matches = desc.scan(/(\d+)\s+(second|minute|hour|day)s?/i)
-      return nil if matches.empty?
+      total = 0
+      words = desc.downcase.delete(',').split
 
-      matches.sum do |value, unit|
-        TIME_UNITS_IN_SECONDS[unit.downcase] * value.to_i
+      words.each_cons(2) do |value, unit|
+        unit = unit.delete_suffix('s')
+        next unless integer_token?(value) && TIME_UNITS_IN_SECONDS.key?(unit)
+
+        total += TIME_UNITS_IN_SECONDS.fetch(unit) * value.to_i
       end
+
+      total.positive? ? total : nil
     end
 
     def extract_handshake_time(peer_block)
       return nil unless peer_block
 
-      desc = peer_block[/latest handshake:\s*(.+)/, 1]
+      desc = line_value(peer_block, 'latest handshake: ')
       return nil unless desc&.include?('ago')
 
       parse_handshake_seconds(desc)
     end
 
     def extract_transfer_stats(peer_block)
-      rx = peer_block.match(/transfer: (.+?) received/)&.[](1) || '0 B'
-      tx = peer_block.match(/received, (.+?) sent/)&.[](1) || '0 B'
-      { received: rx, sent: tx }
+      transfer = line_value(peer_block, 'transfer: ')
+      rx, tx = transfer&.split(' received, ', 2)
+      tx = tx&.delete_suffix(' sent')
+
+      { received: rx || '0 B', sent: tx || '0 B' }
     end
 
     def extract_endpoint(peer_block)
-      peer_block[/endpoint: (.+?)$/, 1]
+      line_value(peer_block, 'endpoint: ')
     end
 
     def extract_allowed_ips(peer_block)
-      peer_block[/allowed ips: (.+?)$/, 1]
+      line_value(peer_block, 'allowed ips: ')
+    end
+
+    def line_value(block, prefix)
+      block.each_line(chomp: true).find { |line| line.start_with?(prefix) }&.delete_prefix(prefix)
+    end
+
+    def integer_token?(value)
+      !value.empty? && value.each_char.all? { |char| char.between?('0', '9') }
     end
   end
 end

data/lib/messhy.rb

@@ -2,6 +2,7 @@
 
 require_relative 'messhy/version'
 require_relative 'messhy/configuration'
+require_relative 'messhy/wireguard_config'
 require_relative 'messhy/wireguard_status_parser'
 require_relative 'messhy/installer'
 require_relative 'messhy/mesh_builder'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: messhy
 version: !ruby/object:Gem::Version
-  version: 0.8.2
+  version: 0.9.0
 platform: ruby
 authors:
 - BoringCache
@@ -29,84 +29,42 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '1.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '1.4'
 - !ruby/object:Gem::Dependency
   name: sshkit
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.21'
+        version: '1.25'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.21'
+        version: '1.25'
 - !ruby/object:Gem::Dependency
   name: thor
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '1.5'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
-- !ruby/object:Gem::Dependency
-  name: minitest
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.0'
-- !ruby/object:Gem::Dependency
-  name: rubocop
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.50'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.50'
-- !ruby/object:Gem::Dependency
-  name: simplecov
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.22'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.5'
 description: Sets up a full WireGuard VPN mesh across any VMs. Every node connects
   directly to every other node for secure private networking.
 email:
@@ -116,8 +74,10 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
 - LICENSE
 - README.md
+- SECURITY.md
 - exe/messhy
 - lib/messhy.rb
 - lib/messhy/cli.rb
@@ -131,6 +91,7 @@ files:
 - lib/messhy/railtie.rb
 - lib/messhy/ssh_executor.rb
 - lib/messhy/version.rb
+- lib/messhy/wireguard_config.rb
 - lib/messhy/wireguard_status_parser.rb
 - lib/tasks/messhy.rake
 - templates/wg0.conf.erb
@@ -138,10 +99,10 @@ homepage: https://github.com/boringcache/messhy
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/boringcache/messhy
   source_code_uri: https://github.com/boringcache/messhy
   documentation_uri: https://github.com/boringcache/messhy/blob/main/README.md
   changelog_uri: https://github.com/boringcache/messhy/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/boringcache/messhy/issues
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
@@ -150,14 +111,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.4.0
+      version: 4.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.16
 specification_version: 4
 summary: WireGuard VPN mesh for Ruby & Rails apps
 test_files: []