messhy 0.8.2 → 0.8.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6cc5f92c8b8a35dfb82b3639ae13d18e962e6f67ff042b845b4e545ed53e9be3
-  data.tar.gz: 8165c8602fdcbb714fe9382dbadd217b399ee94d7c0ab987379c78964af7a166
+  metadata.gz: c1c3b2d1ed2cc9058e323f73a2df9e9a9543709583cead2e9d9a23632c91a18f
+  data.tar.gz: c10668cc8cfab172b6dd6b267265fbc310baa4d31323661efb6b2fc32062d152
 SHA512:
-  metadata.gz: 0d86591c5ccd0e3276785836a0250f1e23d991d10c8c4d30920d852245506cfd1d405904c9adf657d16289c65571c802f87bf7111db16bccf0c7b71024675e79
-  data.tar.gz: 7ce9ada0585d20b2cff7a108b4c5e68843b3489ceeab3aa21a572b7ab56910bd0a6fbe28e95a30f2f0b2dc3f317684ed123a8d576008e46e706a2c3f107e5d0b
+  metadata.gz: 5f1f2154ec3f236ae9aeb741ffa338af96a9ac4a4ba29db327da04bc2e21c719bde98bd1b1e572cb1d415a1fadf64c5d3f54e2807fd27f2909fddf3dcb18af12
+  data.tar.gz: 4ee6e07ed4089a669ab5d11e7c1c074a845fff98782a42c282088c62289d96707df99ab287c4001065d0c097601e75cd1388019afaf60ee195f6be4fc4662ec9

data/CHANGELOG.md

@@ -0,0 +1,51 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.8.3] - 2026-08-20
+
+### Changed
+
+- Require Ruby 4.0 or newer.
+- Align runtime and development dependencies with the maintained toolchain.
+- Add blocking test, lint, dependency-audit, and package-build CI checks.
+- Add automated Bundler and GitHub Actions dependency updates.
+- Document key custody, SSH trust, and full-mesh security boundaries.
+
+## [0.1.0] - 2025-01-21
+
+### Added
+- Initial release of Messhy
+- Full WireGuard VPN mesh network setup across any VMs
+- Every node connects directly to every other node (full mesh topology)
+- Automated WireGuard installation and configuration
+- Dynamic key generation and distribution
+- Automatic peer configuration across all nodes
+- Rails integration with generators and rake tasks
+- Standalone Ruby support (no Rails dependency required)
+- SSH-based deployment (no Python, Ansible, or Kubernetes)
+- Health checking and status monitoring
+- WireGuard status parsing and connection verification
+- Host trust management for SSH connections
+- Support for both public and private IP addresses
+- YAML-based configuration with ERB support
+- Secret management via environment variables or command execution
+
+### Technical Details
+- Uses SSHKit for SSH operations
+- Thor-based CLI interface with `messhy` command
+- Automatic IP allocation for VPN network (10.8.0.0/24 by default)
+- UDP port configuration (default: 51820)
+- Compatible with Ubuntu 20.04+ servers (Debian-based distributions)
+- Ruby >= 3.4.0 required
+
+### Commands
+- `messhy setup` - Deploy WireGuard mesh network
+- `messhy status` - Check mesh network health and connectivity
+- `messhy add_node` - Add new node to existing mesh
+- `messhy remove_node` - Remove node from mesh

data/README.md

@@ -6,21 +6,10 @@ A Ruby gem that sets up a full WireGuard VPN mesh across any VMs. Every node con
 
 ## Why messhy?
 
-### Problems It Solves
-
-❌ **Without messhy:**
-- Database replication over public IPs (insecure)
-- Complex VPN configurations
-- NAT traversal issues
-- Manual key management
-- Cloud-specific networking (VPC, subnet, security groups)
-
-✅ **With messhy:**
-- Secure encrypted connections (WireGuard)
-- Automatic key generation and distribution
-- Works across any cloud/datacenter
-- Zero application changes (just use 10.8.0.x IPs)
-- Simple configuration
+Messhy generates WireGuard keys and peer configuration, installs it over SSH,
+and gives each node a stable private address. It is intended for small fleets
+whose operators control every host and can explicitly allow WireGuard traffic
+between peers.
 
 ## Installation
 
@@ -285,17 +274,25 @@ iptables -A INPUT -p udp --dport 51820 -j ACCEPT
 - Optimal routing (direct connections)
 - Scales to ~50 nodes
 
-## Performance
+## Capacity and performance
 
-### Benchmarks (compared to no VPN)
+A full mesh creates one peer relationship between every pair of nodes, so the
+configuration grows quadratically. Messhy is designed for small fleets (about
+50 nodes or fewer), not large or frequently changing membership. Throughput,
+latency, and CPU overhead depend on the hosts, network path, MTU, and workload;
+benchmark the actual topology before relying on a capacity estimate.
 
-| Metric | No VPN | WireGuard | Overhead |
-|--------|--------|-----------|----------|
-| Throughput | 1000 Mbps | 950 Mbps | 5% |
-| Latency | 10ms | 10.5ms | +0.5ms |
-| CPU usage | 2% | 3% | +1% |
+## Security boundaries
 
-**WireGuard is FAST!** Negligible overhead for most workloads.
+- `trust-hosts` collects host keys with `ssh-keyscan`; verify fingerprints over
+  a separate trusted channel before relying on them.
+- Anyone with a generated node private key can impersonate that node. Store
+  `.secrets/wireguard` in an encrypted vault and rotate keys after suspected
+  disclosure or membership changes.
+- Messhy configures WireGuard, but it does not replace host firewalls, patching,
+  SSH hardening, or application-level authentication.
+- Full-mesh membership grants direct network reachability. Only enroll hosts
+  that should be able to reach one another.
 
 ## Troubleshooting
 
@@ -330,7 +327,7 @@ messhy setup
 
 ## Requirements
 
-- Ruby 3.0+
+- Ruby 4.0+
 - WireGuard tools (`wg` command)
 - Target servers with Linux kernel 5.6+ (WireGuard built-in)
 - SSH key-based authentication
@@ -345,4 +342,4 @@ The gem is available as open source under the terms of the [MIT License](https:/
 
 ---
 
-Built with ❤️ for the Rails community by [Gaurav](https://github.com/yourusername)
+Maintained by [BoringCache](https://github.com/boringcache).

data/SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please do not open a public issue for a potential vulnerability. Email
+[security@boringcache.com](mailto:security@boringcache.com) or use
+[GitHub private vulnerability reporting](https://github.com/boringcache/messhy/security/advisories/new).
+
+Include the affected version, expected impact, and enough reproduction detail
+for us to investigate. Do not include live credentials, private keys, customer
+data, or production configuration.
+
+## Supported Versions
+
+Only the latest published release is supported. Security fixes are normally
+shipped in a new release rather than backported.
+
+## Scope
+
+Reports about WireGuard key handling, SSH host verification, generated network
+configuration, command execution, or release integrity are welcome.

data/lib/messhy/dns_manager.rb

@@ -79,7 +79,7 @@ module Messhy
           execute :sudo, 'resolvectl', 'flush-caches', raise_on_error: false
         elsif test('[ -d /etc/resolvconf/resolv.conf.d ]', raise_on_error: false)
           head_path = '/etc/resolvconf/resolv.conf.d/head'
-          content = server_ips.map { |ip| "nameserver #{ip}" }.join("\n") + "\n"
+          content = "#{server_ips.map { |ip| "nameserver #{ip}" }.join("\n")}\n"
           upload! StringIO.new(content), '/tmp/messhy-resolv.conf'
           execute :sudo, 'mv', '/tmp/messhy-resolv.conf', head_path
           execute :sudo, 'chmod', '644', head_path
@@ -112,7 +112,7 @@ module Messhy
         end
       end
 
-      records.transform_values { |ips| ips.uniq }
+      records.transform_values(&:uniq)
     end
 
     def resolve_target(target)
@@ -159,7 +159,7 @@ module Messhy
         end
       end
 
-      lines.join("\n") + "\n"
+      "#{lines.join("\n")}\n"
     end
   end
 end

data/lib/messhy/health_checker.rb

@@ -94,7 +94,6 @@ module Messhy
       end
     end
 
-    # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
     def test_all
       puts '==> Testing mesh connectivity...'
       puts
@@ -148,7 +147,6 @@ module Messhy
       puts 'If a pair still reports a failure, there has been no recent handshake—check UDP 51820 and ' \
            'keepalive/route settings.'
     end
-    # rubocop:enable Metrics/AbcSize, Metrics/MethodLength
 
     def show_stats(node: nil)
       if node
@@ -179,10 +177,10 @@ module Messhy
             service = capture(:systemctl, 'is-active', 'dnsmasq', raise_on_non_zero_exit: false).strip
             messhy_records = capture(:bash, '-c',
                                      "sudo awk 'BEGIN{c=0} /^address=\\//{c++} END{print c}' " \
-                                     "/etc/dnsmasq.d/messhy.conf 2>/dev/null || true").strip
+                                     '/etc/dnsmasq.d/messhy.conf 2>/dev/null || true').strip
             ap_records = capture(:bash, '-c',
                                  "sudo awk 'BEGIN{c=0} /^address=\\//{c++} END{print c}' " \
-                                 "/etc/dnsmasq.d/active_postgres.conf 2>/dev/null || true").strip
+                                 '/etc/dnsmasq.d/active_postgres.conf 2>/dev/null || true').strip
 
             status_icon = service == 'active' ? '✓' : '✗'
             puts "#{status_icon} #{node_name} (#{node_config['private_ip']})#{label_display} - dnsmasq #{service}"
@@ -224,7 +222,7 @@ module Messhy
       end
 
       max_name_len = node_names.map(&:length).max
-      header = ' ' * (max_name_len + 2) + node_names.map { |n| n[0..7].rjust(8) }.join(' ')
+      header = (' ' * (max_name_len + 2)) + node_names.map { |n| n[0..7].rjust(8) }.join(' ')
       puts header
       puts '-' * header.length
 

data/lib/messhy/mesh_builder.rb

@@ -38,9 +38,9 @@ module Messhy
       if config.dns_enabled?
         dns_domain = config.dns_domain
         dns_interface = config.dns_interface
-        dns_server_ips = config.dns_server_nodes.filter_map { |name|
+        dns_server_ips = config.dns_server_nodes.filter_map do |name|
           config.node_config(name)&.dig('private_ip')
-        }
+        end
       end
 
       is_dns_server = config.dns_enabled? && config.dns_server_nodes.include?(node_name)

data/lib/messhy/ssh_executor.rb

@@ -176,9 +176,7 @@ module Messhy
       latency = nil
       execute_on_node(source_node) do
         output = capture(:ping, '-c', '3', '-W', '2', '-I', 'wg0', target_ip, raise_on_non_zero_exit: false)
-        if output =~ %r{rtt min/avg/max/mdev = [\d.]+/([\d.]+)/}
-          latency = ::Regexp.last_match(1).to_f
-        end
+        latency = ::Regexp.last_match(1).to_f if output =~ %r{rtt min/avg/max/mdev = [\d.]+/([\d.]+)/}
       end
       latency
     rescue StandardError

data/lib/messhy/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Messhy
-  VERSION = '0.8.2'
+  VERSION = '0.8.3'
 end

data/lib/messhy/wireguard_status_parser.rb

@@ -20,35 +20,50 @@ module Messhy
     def parse_handshake_seconds(desc)
       return nil if desc.strip.casecmp('(none)').zero?
 
-      matches = desc.scan(/(\d+)\s+(second|minute|hour|day)s?/i)
-      return nil if matches.empty?
+      total = 0
+      words = desc.downcase.delete(',').split
 
-      matches.sum do |value, unit|
-        TIME_UNITS_IN_SECONDS[unit.downcase] * value.to_i
+      words.each_cons(2) do |value, unit|
+        unit = unit.delete_suffix('s')
+        next unless integer_token?(value) && TIME_UNITS_IN_SECONDS.key?(unit)
+
+        total += TIME_UNITS_IN_SECONDS.fetch(unit) * value.to_i
       end
+
+      total.positive? ? total : nil
     end
 
     def extract_handshake_time(peer_block)
       return nil unless peer_block
 
-      desc = peer_block[/latest handshake:\s*(.+)/, 1]
+      desc = line_value(peer_block, 'latest handshake: ')
       return nil unless desc&.include?('ago')
 
       parse_handshake_seconds(desc)
     end
 
     def extract_transfer_stats(peer_block)
-      rx = peer_block.match(/transfer: (.+?) received/)&.[](1) || '0 B'
-      tx = peer_block.match(/received, (.+?) sent/)&.[](1) || '0 B'
-      { received: rx, sent: tx }
+      transfer = line_value(peer_block, 'transfer: ')
+      rx, tx = transfer&.split(' received, ', 2)
+      tx = tx&.delete_suffix(' sent')
+
+      { received: rx || '0 B', sent: tx || '0 B' }
     end
 
     def extract_endpoint(peer_block)
-      peer_block[/endpoint: (.+?)$/, 1]
+      line_value(peer_block, 'endpoint: ')
     end
 
     def extract_allowed_ips(peer_block)
-      peer_block[/allowed ips: (.+?)$/, 1]
+      line_value(peer_block, 'allowed ips: ')
+    end
+
+    def line_value(block, prefix)
+      block.each_line(chomp: true).find { |line| line.start_with?(prefix) }&.delete_prefix(prefix)
+    end
+
+    def integer_token?(value)
+      !value.empty? && value.each_char.all? { |char| char.between?('0', '9') }
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: messhy
 version: !ruby/object:Gem::Version
-  version: 0.8.2
+  version: 0.8.3
 platform: ruby
 authors:
 - BoringCache
@@ -29,84 +29,42 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '1.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '1.4'
 - !ruby/object:Gem::Dependency
   name: sshkit
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.21'
+        version: '1.25'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.21'
+        version: '1.25'
 - !ruby/object:Gem::Dependency
   name: thor
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '1.5'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
-- !ruby/object:Gem::Dependency
-  name: minitest
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.0'
-- !ruby/object:Gem::Dependency
-  name: rubocop
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.50'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.50'
-- !ruby/object:Gem::Dependency
-  name: simplecov
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.22'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.5'
 description: Sets up a full WireGuard VPN mesh across any VMs. Every node connects
   directly to every other node for secure private networking.
 email:
@@ -116,8 +74,10 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
 - LICENSE
 - README.md
+- SECURITY.md
 - exe/messhy
 - lib/messhy.rb
 - lib/messhy/cli.rb
@@ -138,10 +98,10 @@ homepage: https://github.com/boringcache/messhy
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/boringcache/messhy
   source_code_uri: https://github.com/boringcache/messhy
   documentation_uri: https://github.com/boringcache/messhy/blob/main/README.md
   changelog_uri: https://github.com/boringcache/messhy/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/boringcache/messhy/issues
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
@@ -150,14 +110,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.4.0
+      version: 4.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.16
 specification_version: 4
 summary: WireGuard VPN mesh for Ruby & Rails apps
 test_files: []