messhy 0.9.1 → 0.9.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fd61d3c3a60ea6d3f5decc20c10c17168607ff1e752e688ad0aec6f22c37be79
-  data.tar.gz: b6552633a9762e716b3bee6380c318eecefd8e3280fb44a100bd921f4c82c816
+  metadata.gz: 461686d1f8da9181c5eddeece3d651a0f364fb2be1fe944a174b91bc6bf77d8e
+  data.tar.gz: 06aacac73369872bc1c63c0083b200125a97813a0be83ce85857e27d8a0785ee
 SHA512:
-  metadata.gz: c2a44398671a4801cab1170cc5889ac55c4da1ffa1005422664d8b783ee30933eca79c30ccdd2b905b36cc7c82b9049ae97fec9ddc61fd11e42611682dd92ac1
-  data.tar.gz: e159a7b8575b572f348d10867a6ff3797bc765d87552b134eb8ea1d2a910359a24b54b7e66023633bac4725af5adaf846558b1c998429e1c4b7a06546fb63ad0
+  metadata.gz: 9a90d59ae7a33d8e741a2917bdd20919fa5bce750b93037ac2b7ea4dbd94f5e17b48449b8533fbb10d820d776f184f2fe80036a65611d5439a94497e5d204741
+  data.tar.gz: 4b91ddf4f75e331ffe080c1cdb8b27aa3e311c950b249e5f4fff03e847dcd8f56fdf4be22ca79a958b42b5c71e523c0d265d397e148ec90c042b09b7d8319552

data/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.3] - 2026-10-05
+
+### Fixed
+
+- Keep temporary WireGuard configurations private during reconciliation and
+  remove them after successful updates or failed updates with rollback.
+
+## [0.9.2] - 2026-10-02
+
+### Changed
+
+- Update development dependencies.
+- Link gem source metadata to the matching release tag.
+
 ## [0.9.1] - 2026-09-02
 
 ### Fixed

data/README.md

@@ -103,6 +103,13 @@ Apply DNS without touching WireGuard:
 messhy dns --environment=production
 ```
 
+Use `messhy reconcile --environment=production` to update active peers without
+restarting their WireGuard interfaces. Reconciliation uploads configuration
+inside a private temporary directory and passes a separate owner-only file to
+`wg syncconf`. Both temporary files are removed after a successful update or
+a failed update with rollback. The installed and previous configurations remain
+root-owned with mode `0600`.
+
 ## Secret Management
 
 `messhy setup` stores generated WireGuard key pairs inside `.secrets/wireguard/*.yml` with `0600` permissions. Each node gets its own YAML file (`.secrets/wireguard/<node>.yml`) and all peer pre‑shared keys live in `.secrets/wireguard/psks.yml`. The directory is gitignored by default, and the Rails generator ensures the ignore rules are present in your application. After provisioning, copy the YAML files into 1Password (or another vault) and remove them from disk if you do not want long‑lived local copies.

data/lib/messhy/host_trust_manager.rb

@@ -8,7 +8,7 @@ module Messhy
     DEFAULT_TIMEOUT = 5
     DEFAULT_KEY_TYPES = %w[ed25519 ecdsa rsa].freeze
 
-    # rubocop:disable Metrics/ParameterLists
+    # rubocop:disable-next Metrics/ParameterLists
     def initialize(config,
                    known_hosts_path: File.expand_path('~/.ssh/known_hosts'),
                    timeout: DEFAULT_TIMEOUT,
@@ -22,7 +22,6 @@ module Messhy
       @hash_hosts = hash_hosts
       @replace_existing = replace_existing
     end
-    # rubocop:enable Metrics/ParameterLists
 
     def trust_all_hosts
       ensure_ssh_keyscan!

data/lib/messhy/installer.rb

@@ -7,7 +7,7 @@ require 'digest'
 require 'base64'
 
 module Messhy
-  # rubocop:disable Metrics/ClassLength
+  # rubocop:disable-next Metrics/ClassLength
   class Installer
     attr_reader :config, :dry_run, :prune, :ssh_executor
 
@@ -422,5 +422,4 @@ module Messhy
       base[0, 44]
     end
   end
-  # rubocop:enable Metrics/ClassLength
 end

data/lib/messhy/mesh_builder.rb

@@ -12,7 +12,7 @@ module Messhy
       @psk_map = psk_map
     end
 
-    # rubocop:disable Metrics/AbcSize
+    # rubocop:disable-next Metrics/AbcSize
     def build_config_for_node(node_name)
       node_config = config.node_config(node_name)
       raise Error, "Node not found: #{node_name}" unless node_config
@@ -73,7 +73,6 @@ module Messhy
       binding_context = binding
       template.result(binding_context)
     end
-    # rubocop:enable Metrics/AbcSize
 
     def build_all_configs
       configs = {}

data/lib/messhy/ssh_executor.rb

@@ -127,11 +127,22 @@ module Messhy
     end
 
     def reconcile_config(node_name, config_content)
-      temp_file = '/tmp/messhy-wg0.conf'
-      script = reconcile_script(temp_file)
+      executor = self
       execute_on_node(node_name) do
-        upload! StringIO.new(config_content), temp_file
-        execute :sudo, :bash, '-lc', Shellwords.escape(script)
+        temp_directory = capture(:mktemp, '-d', '/tmp/messhy-reconcile.XXXXXXXXXX').strip
+        unless temp_directory.match?(%r{\A/tmp/messhy-reconcile\.[A-Za-z0-9]+\z})
+          raise Error, 'Could not create a private WireGuard upload directory'
+        end
+
+        temp_file = File.join(temp_directory, 'wg0.conf')
+        begin
+          upload! StringIO.new(config_content), temp_file
+          script = executor.send(:reconcile_script, temp_file)
+          execute :sudo, :bash, '-lc', Shellwords.escape(script)
+        ensure
+          execute :rm, '-f', temp_file
+          execute :rmdir, temp_directory
+        end
       end
     end
 
@@ -397,9 +408,11 @@ module Messhy
         target=/etc/wireguard/wg0.conf
         candidate=/etc/wireguard/wg0.next.conf
         previous=/etc/wireguard/wg0.conf.previous
-        stripped=/tmp/messhy-wg0.stripped
+        stripped=$(mktemp /tmp/messhy-wg0.XXXXXXXXXX)
+        trap 'rm -f "$stripped"' EXIT
+        trap 'exit 1' HUP INT TERM
 
-        install -o root -g root -m 600 #{temp_file} "$candidate"
+        install -o root -g root -m 600 #{Shellwords.escape(temp_file)} "$candidate"
         wg-quick strip "$candidate" > "$stripped"
 
         if systemctl is-active --quiet wg-quick@wg0; then
@@ -421,7 +434,6 @@ module Messhy
           fi
         fi
 
-        rm -f "$stripped" #{temp_file}
       SCRIPT
     end
   end

data/lib/messhy/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Messhy
-  VERSION = '0.9.1'
+  VERSION = '0.9.3'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: messhy
 version: !ruby/object:Gem::Version
-  version: 0.9.1
+  version: 0.9.3
 platform: ruby
 authors:
 - BoringCache
@@ -99,7 +99,7 @@ homepage: https://github.com/boringcache/messhy
 licenses:
 - MIT
 metadata:
-  source_code_uri: https://github.com/boringcache/messhy
+  source_code_uri: https://github.com/boringcache/messhy/tree/v0.9.3
   documentation_uri: https://github.com/boringcache/messhy/blob/main/README.md
   changelog_uri: https://github.com/boringcache/messhy/blob/main/CHANGELOG.md
   bug_tracker_uri: https://github.com/boringcache/messhy/issues