messhy 0.8.3 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c1c3b2d1ed2cc9058e323f73a2df9e9a9543709583cead2e9d9a23632c91a18f
-  data.tar.gz: c10668cc8cfab172b6dd6b267265fbc310baa4d31323661efb6b2fc32062d152
+  metadata.gz: 14432b60b44c17938ab995bb9e9ca0a360f1381bbfe4f746e3bcc6a07be2e658
+  data.tar.gz: d98203d9b327d971f61e81022611e0f54d9e08673d381ae57fa27b58a55dabeb
 SHA512:
-  metadata.gz: 5f1f2154ec3f236ae9aeb741ffa338af96a9ac4a4ba29db327da04bc2e21c719bde98bd1b1e572cb1d415a1fadf64c5d3f54e2807fd27f2909fddf3dcb18af12
-  data.tar.gz: 4ee6e07ed4089a669ab5d11e7c1c074a845fff98782a42c282088c62289d96707df99ab287c4001065d0c097601e75cd1388019afaf60ee195f6be4fc4662ec9
+  metadata.gz: c8db3c1b1b7f71680e565c0373b463f4c749d4be645a90f587970a8955ef95d1684dffe2bf46d4cbbaf4de763e4d21482ed7c9e8aa72d4a64c56190c1076038b
+  data.tar.gz: 2e59b8e950931e8f27a4f004a5e9e381176ced1cb670fd16f03045ea4ee0856a2f81e577a5fc07fc5b535d4bd45218989db72b896ec0ab18cfe003af864517aa

data/CHANGELOG.md

@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-09-02
+
+### Added
+
+- Per-node `jump_host` routing for SSH bootstrap without copying private keys to the jump host.
+- Strict known-hosts file configuration, live key import, and sequential
+  `wg syncconf` reconciliation for adding nodes without restarting active interfaces.
+- Optional `lan` transports that route WireGuard directly over a shared named
+  private network and fall back to each peer's public `host` otherwise.
+
+### Changed
+
+- Rename the WireGuard identity from `private_ip` to `mesh_ip`. Existing
+  `private_ip` configuration is normalized at load time for compatibility.
+
 ## [0.8.3] - 2026-08-20
 
 ### Changed

data/README.md

@@ -38,15 +38,21 @@ production:
   nodes:
     db-primary:
       host: 34.12.234.81
-      private_ip: 10.8.0.10
+      mesh_ip: 10.8.0.10
+      lan:
+        network: aws-virginia
+        ip: 10.70.1.10
 
     db-standby:
       host: 52.23.45.67
-      private_ip: 10.8.0.11
+      mesh_ip: 10.8.0.11
+      lan:
+        network: aws-virginia
+        ip: 10.70.1.11
 
     app-1:
       host: 18.156.78.90
-      private_ip: 10.8.0.20
+      mesh_ip: 10.8.0.20
 ```
 
 2. **Setup mesh**:
@@ -159,6 +165,22 @@ messhy setup --skip-node=app-1            # Skip specific node
 messhy setup --only-node=db-primary       # Setup single node
 ```
 
+For an existing mesh, import its live key material once through trusted SSH,
+then reconcile additions or peer changes without restarting active WireGuard
+interfaces:
+
+```bash
+messhy import-keys --environment=production
+messhy reconcile --environment=production --dry-run
+messhy reconcile --environment=production
+```
+
+`import-keys` writes the same mode-`0600` local secret files as initial setup
+and never prints key material. `reconcile` validates each candidate config,
+applies active peer changes with `wg syncconf`, and restores the previous config
+if a live sync fails. Set `ssh_known_hosts_file` to a reviewed file when the
+mesh should not depend on the operator's global SSH configuration.
+
 ### Status & Monitoring
 
 ```bash
@@ -232,10 +254,15 @@ interface.
 ### Node Configuration
 
 Each node requires:
-- `host`: Public IP or hostname
-- `private_ip`: Private VPN IP (must be within network range)
+
+- `host`: Public IP or hostname used for SSH and as the WireGuard endpoint fallback
+- `mesh_ip`: Stable IP inside the WireGuard network
 
 Optional per-node overrides:
+
+- `lan`: A shared private transport with `network` and `ip`. Peers on the same
+  named network use the LAN IP as their WireGuard endpoint; all other peers use
+  `host`.
 - `ssh_user` / `ssh_port`: Override SSH access details (defaults to top-level `user` and port 22)
 - `ssh_key`: Override SSH key for a specific node
 - `listen_port`: WireGuard UDP port (defaults to top-level `listen_port`)

data/lib/messhy/cli.rb

@@ -26,6 +26,23 @@ module Messhy
       handle_ssh_error(e, config)
     end
 
+    desc 'reconcile', 'Apply mesh changes without restarting active WireGuard interfaces'
+    option :dry_run, type: :boolean, default: false
+    def reconcile
+      config = load_config
+      Installer.new(config, dry_run: options[:dry_run]).reconcile
+    rescue SSHKit::Runner::ExecuteError => e
+      handle_ssh_error(e, config)
+    end
+
+    desc 'import-keys', 'Import existing mesh key material into the local secrets directory'
+    def import_keys
+      config = load_config
+      Installer.new(config).import_keys
+    rescue SSHKit::Runner::ExecuteError => e
+      handle_ssh_error(e, config)
+    end
+
     desc 'dns', 'Setup mesh DNS (dnsmasq)'
     option :dry_run, type: :boolean, default: false
     option :skip_node, type: :string
@@ -107,7 +124,7 @@ module Messhy
     def list
       config = load_config
       config.each_node do |name, node_config|
-        puts "#{name}: #{node_config['host']} (#{node_config['private_ip']})"
+        puts "#{name}: #{node_config['host']} (#{node_config['mesh_ip']})"
       end
     end
 
@@ -123,7 +140,7 @@ module Messhy
 
       puts "Node: #{name}"
       puts "Host: #{node_config['host']}"
-      puts "Private IP: #{node_config['private_ip']}"
+      puts "Mesh IP: #{node_config['mesh_ip']}"
       puts "Region: #{node_config['region']}" if node_config['region']
 
       health_checker = HealthChecker.new(config)

data/lib/messhy/configuration.rb

@@ -10,6 +10,7 @@ module Messhy
                 :dns,
                 :user,
                 :ssh_key,
+                :ssh_known_hosts_file,
                 :mtu,
                 :listen_port,
                 :keepalive,
@@ -20,10 +21,11 @@ module Messhy
       env_config = config_hash[environment] || {}
 
       @network = env_config['network'] || '10.8.0.0/24'
-      @nodes = env_config['nodes'] || {}
+      @nodes = normalize_nodes(env_config['nodes'] || {})
       @dns = env_config['dns'] || {}
       @user = env_config['user'] || 'ubuntu'
       @ssh_key = File.expand_path(env_config['ssh_key'] || '~/.ssh/id_rsa')
+      @ssh_known_hosts_file = optional_path(env_config['ssh_known_hosts_file'])
       @mtu = env_config['mtu'] || 1280
       @listen_port = env_config['listen_port'] || 51_820
       @keepalive = env_config['keepalive'] || 25
@@ -47,6 +49,16 @@ module Messhy
       @nodes[name]
     end
 
+    def peer_endpoint_for(node_name, peer_name)
+      node = node_config(node_name)
+      peer = node_config(peer_name)
+
+      return peer['host'] unless node['lan'] && peer['lan']
+      return peer['host'] unless node.dig('lan', 'network') == peer.dig('lan', 'network')
+
+      peer.dig('lan', 'ip')
+    end
+
     def each_node(&)
       @nodes.each(&)
     end
@@ -65,10 +77,7 @@ module Messhy
     def validate!
       raise Error, 'No nodes defined' if @nodes.empty?
 
-      @nodes.each do |name, config|
-        raise Error, "Node #{name} missing 'host'" unless config['host']
-        raise Error, "Node #{name} missing 'private_ip'" unless config['private_ip']
-      end
+      @nodes.each { |name, config| validate_node!(name, config) }
 
       if dns_enabled?
         raise Error, 'DNS domain is required when dns is enabled' if dns_domains.empty?
@@ -83,6 +92,13 @@ module Messhy
       true
     end
 
+    def jump_host_config(name)
+      jump_host = node_config(name)&.dig('jump_host')
+      return unless jump_host
+
+      node_config(jump_host) || raise(Error, "Node #{name} jump_host not found: #{jump_host}")
+    end
+
     def verify_host_key_mode
       case @verify_host_key
       when true, 'always', :always
@@ -149,5 +165,48 @@ module Messhy
 
       @dns['auto_records'] == true
     end
+
+    private
+
+    def optional_path(path)
+      File.expand_path(path) if path
+    end
+
+    def normalize_nodes(nodes)
+      nodes.to_h do |name, config|
+        [name, normalize_node(name, config)]
+      end
+    end
+
+    def normalize_node(name, config)
+      config = config.dup
+      legacy_mesh_ip = config.delete('private_ip')
+
+      if config['mesh_ip'] && legacy_mesh_ip && config['mesh_ip'] != legacy_mesh_ip
+        raise Error, "Node #{name} has conflicting 'mesh_ip' and deprecated 'private_ip' values"
+      end
+
+      config['mesh_ip'] ||= legacy_mesh_ip
+      config
+    end
+
+    def validate_node!(name, config)
+      raise Error, "Node #{name} missing 'host'" unless config['host']
+      raise Error, "Node #{name} missing 'mesh_ip'" unless config['mesh_ip']
+
+      validate_lan!(name, config['lan']) if config['lan']
+
+      jump_host = config['jump_host']
+      return unless jump_host
+
+      raise Error, "Node #{name} cannot use itself as jump_host" if jump_host == name
+      raise Error, "Node #{name} jump_host not found: #{jump_host}" unless node_config(jump_host)
+    end
+
+    def validate_lan!(name, lan)
+      raise Error, "Node #{name} 'lan' must be a mapping" unless lan.is_a?(Hash)
+      raise Error, "Node #{name} lan missing 'network'" if lan['network'].to_s.empty?
+      raise Error, "Node #{name} lan missing 'ip'" if lan['ip'].to_s.empty?
+    end
   end
 end

data/lib/messhy/dns_manager.rb

@@ -31,14 +31,14 @@ module Messhy
       interface = config.dns_interface
       ttl = config.dns_ttl
       server_nodes = config.dns_server_nodes
-      server_ips = server_nodes.map { |name| config.node_config(name)['private_ip'] }
+      server_ips = server_nodes.map { |name| config.node_config(name)['mesh_ip'] }
 
       records = build_records(domain)
 
       server_nodes.each do |node|
         next if @skip && node == @skip
 
-        server_ip = config.node_config(node)['private_ip']
+        server_ip = config.node_config(node)['mesh_ip']
         conf = build_dnsmasq_conf(domain, interface, server_ip, records, ttl)
 
         if dry_run
@@ -97,7 +97,7 @@ module Messhy
         config.each_node do |name, node_config|
           hostname = "#{sanitize_dns_label(name)}.#{domain}"
           records[hostname] ||= []
-          records[hostname] << node_config['private_ip']
+          records[hostname] << node_config['mesh_ip']
         end
       end
 
@@ -119,7 +119,7 @@ module Messhy
       return '' if target.nil?
 
       node = config.node_config(target.to_s)
-      return node['private_ip'] if node
+      return node['mesh_ip'] if node
 
       target.to_s
     end

data/lib/messhy/health_checker.rb

@@ -43,7 +43,7 @@ module Messhy
         peers = status.scan(/peer: (.+?)$/).flatten
 
         if peers.any?
-          puts "✓ #{node_name} (#{node_config['private_ip']})#{label_display} - connected to #{peers.size} peers"
+          puts "✓ #{node_name} (#{node_config['mesh_ip']})#{label_display} - connected to #{peers.size} peers"
 
           # Show basic peer info
           status.split('peer:').drop(1).each do |peer_block|
@@ -54,10 +54,10 @@ module Messhy
             puts "  └─ Peer: #{endpoint} - #{stats[:received]} rx, #{stats[:sent]} tx"
           end
         else
-          puts "✗ #{node_name} (#{node_config['private_ip']})#{label_display} - 0 peers (DOWN)"
+          puts "✗ #{node_name} (#{node_config['mesh_ip']})#{label_display} - 0 peers (DOWN)"
         end
       rescue StandardError => e
-        puts "✗ #{node_name} (#{node_config['private_ip']})#{label_display} - Error: #{e.message}"
+        puts "✗ #{node_name} (#{node_config['mesh_ip']})#{label_display} - Error: #{e.message}"
       end
     end
 
@@ -69,12 +69,12 @@ module Messhy
       if node_or_ip =~ /^\d+\.\d+\.\d+\.\d+$/
         # It's an IP
         target_ip = node_or_ip
-        target_node = config.nodes.find { |_, cfg| cfg['private_ip'] == target_ip }&.first
+        target_node = config.nodes.find { |_, cfg| cfg['mesh_ip'] == target_ip }&.first
       else
         # It's a node name
         target_node = node_or_ip
         node_config = config.node_config(target_node)
-        target_ip = node_config['private_ip'] if node_config
+        target_ip = node_config['mesh_ip'] if node_config
       end
 
       unless target_ip
@@ -115,7 +115,7 @@ module Messhy
 
           tested_pairs.add(pair_key)
           test_count += 1
-          target_ip = target_config['private_ip']
+          target_ip = target_config['mesh_ip']
 
           print "[#{test_count}/#{total_tests}] Testing #{source_name} → #{target_name} (#{target_ip})... "
           $stdout.flush
@@ -132,7 +132,7 @@ module Messhy
 
           if success
             puts '✓'
-          elsif handshake_recent?(source_name, target_config['private_ip'], status_cache)
+          elsif handshake_recent?(source_name, target_config['mesh_ip'], status_cache)
             puts '✓ (handshake)'
           else
             puts '✗ (ICMP/TCP may be blocked, and no recent WireGuard handshake)'
@@ -183,11 +183,11 @@ module Messhy
                                  '/etc/dnsmasq.d/active_postgres.conf 2>/dev/null || true').strip
 
             status_icon = service == 'active' ? '✓' : '✗'
-            puts "#{status_icon} #{node_name} (#{node_config['private_ip']})#{label_display} - dnsmasq #{service}"
+            puts "#{status_icon} #{node_name} (#{node_config['mesh_ip']})#{label_display} - dnsmasq #{service}"
             puts "  └─ records: messhy=#{messhy_records.to_i} active_postgres=#{ap_records.to_i}"
           end
         rescue StandardError => e
-          puts "✗ #{node_name} (#{node_config['private_ip']})#{label_display} - DNS check failed: #{e.message}"
+          puts "✗ #{node_name} (#{node_config['mesh_ip']})#{label_display} - DNS check failed: #{e.message}"
         end
       end
 
@@ -214,7 +214,7 @@ module Messhy
           next if tested_pairs.include?(pair_key)
 
           tested_pairs.add(pair_key)
-          target_ip = config.node_config(target)['private_ip']
+          target_ip = config.node_config(target)['mesh_ip']
           latency = @ssh_executor.measure_latency(source, target_ip)
           latencies[[source, target]] = latency
           latencies[[target, source]] = latency
@@ -257,7 +257,7 @@ module Messhy
     def show_node_stats(node_name)
       node_config = config.node_config(node_name)
 
-      puts "==> Stats for #{node_name} (#{node_config['private_ip']})"
+      puts "==> Stats for #{node_name} (#{node_config['mesh_ip']})"
 
       begin
         status = @ssh_executor.get_wireguard_status(node_name)

data/lib/messhy/installer.rb

@@ -11,14 +11,63 @@ module Messhy
   class Installer
     attr_reader :config, :dry_run, :ssh_executor
 
-    def initialize(config, dry_run: false)
+    def initialize(config, dry_run: false, ssh_executor: SSHExecutor.new(config))
       @config = config
       @dry_run = dry_run
-      @ssh_executor = SSHExecutor.new(config)
+      @ssh_executor = ssh_executor
       @node_keys = load_existing_keys
       @psk_map = load_existing_psks
     end
 
+    def import_keys
+      puts '==> Importing existing WireGuard key material'
+      config.validate!
+
+      imported_psks = {}
+      config.each_node do |node_name, node_config|
+        snapshot = WireguardConfig.parse(ssh_executor.read_wireguard_config(node_name))
+        validate_imported_address!(node_name, node_config, snapshot)
+        import_node_key(node_name, snapshot)
+        import_peer_psks(node_name, snapshot, imported_psks)
+        puts "  ✓ Imported #{node_name}"
+      end
+
+      @psk_map.merge!(imported_psks)
+      persist_psk_map
+      puts "✓ Imported #{config.node_names.size} node keys and #{@psk_map.size} peer keys"
+    end
+
+    def reconcile
+      puts '==> Reconciling WireGuard mesh without restarting active interfaces'
+      config.validate!
+
+      puts "\n==> Installing missing WireGuard tools..."
+      install_wireguard_on_all_nodes
+      puts "\n==> Ensuring key material exists..."
+      generate_all_keys
+
+      configs = MeshBuilder.new(config, @node_keys, @psk_map || {}).build_all_configs
+      puts "\n==> Applying configurations sequentially..."
+      configs.each do |node_name, config_content|
+        if dry_run
+          puts "  [DRY RUN] Would reconcile #{node_name}"
+        else
+          ssh_executor.reconcile_config(node_name, config_content)
+          puts "  ✓ Reconciled #{node_name}"
+        end
+      end
+
+      puts "\n==> Verifying mesh connectivity..."
+      verify_mesh
+
+      if config.dns_enabled?
+        puts "\n==> Reconciling mesh DNS..."
+        DnsManager.new(config, ssh_executor: ssh_executor, dry_run: dry_run).setup
+      end
+
+      puts "\n✓ WireGuard mesh reconciled"
+    end
+
     def setup(skip: nil)
       puts '==> Setting up WireGuard mesh network'
       puts "Environment: #{config.environment}"
@@ -130,6 +179,36 @@ module Messhy
 
     private
 
+    def validate_imported_address!(node_name, node_config, snapshot)
+      address = snapshot.interface['Address'].to_s.split('/').first
+      return if address == node_config['mesh_ip']
+
+      raise Error, "Node #{node_name} WireGuard address #{address.inspect} does not match #{node_config['mesh_ip']}"
+    end
+
+    def import_node_key(node_name, snapshot)
+      private_key = snapshot.interface['PrivateKey']
+      raise Error, "Node #{node_name} has no WireGuard private key" if private_key.to_s.empty?
+
+      keypair = { private_key: private_key, public_key: ssh_executor.wireguard_public_key(node_name) }
+      @node_keys[node_name] = keypair
+      store_keypair(node_name, keypair)
+    end
+
+    def import_peer_psks(node_name, snapshot, imported_psks)
+      snapshot.peers.each do |peer|
+        peer_name = peer['Name']
+        psk = peer['PresharedKey']
+        next if peer_name.to_s.empty? || psk.to_s.empty?
+
+        pair_key = [node_name, peer_name].sort.join('-')
+        existing = imported_psks[pair_key]
+        raise Error, "Conflicting WireGuard peer key for #{pair_key}" if existing && existing != psk
+
+        imported_psks[pair_key] = psk
+      end
+    end
+
     def generate_all_keys(skip: nil)
       config.each_node do |node_name, _|
         next if skip && node_name == skip

data/lib/messhy/mesh_builder.rb

@@ -25,7 +25,7 @@ module Messhy
       template = ERB.new(File.read(template_path), trim_mode: '-')
 
       # Prepare data for template
-      interface_ip = node_config['private_ip']
+      interface_ip = node_config['mesh_ip']
       prefix_length = config.network_prefix_length
       private_key = keys[:private_key]
       listen_port = node_config['listen_port'] || config.listen_port
@@ -39,7 +39,7 @@ module Messhy
         dns_domain = config.dns_domain
         dns_interface = config.dns_interface
         dns_server_ips = config.dns_server_nodes.filter_map do |name|
-          config.node_config(name)&.dig('private_ip')
+          config.node_config(name)&.dig('mesh_ip')
         end
       end
 
@@ -56,13 +56,15 @@ module Messhy
         # Get symmetric PSK for this peer pair
         pair_key = [node_name, peer_name].sort.join('-')
         psk = psk_map[pair_key]
+        endpoint = config.peer_endpoint_for(node_name, peer_name)
+        peer_listen_port = peer_config['listen_port'] || config.listen_port
 
         peers << {
           name: peer_name,
           public_key: peer_keys[:public_key],
           preshared_key: psk,
-          allowed_ips: "#{peer_config['private_ip']}/32",
-          endpoint: "#{peer_config['host']}:#{peer_config['listen_port'] || config.listen_port}",
+          allowed_ips: "#{peer_config['mesh_ip']}/32",
+          endpoint: "#{endpoint}:#{peer_listen_port}",
           keepalive: config.keepalive
         }
       end

data/lib/messhy/ssh_executor.rb

@@ -2,6 +2,8 @@
 
 require 'sshkit'
 require 'sshkit/dsl'
+require 'net/ssh/proxy/command'
+require 'shellwords'
 require 'stringio'
 
 module Messhy
@@ -108,6 +110,31 @@ module Messhy
       end
     end
 
+    def read_wireguard_config(node_name)
+      content = nil
+      execute_on_node(node_name) do
+        content = capture(:sudo, :cat, '/etc/wireguard/wg0.conf')
+      end
+      content
+    end
+
+    def wireguard_public_key(node_name)
+      public_key = nil
+      execute_on_node(node_name) do
+        public_key = capture(:sudo, :wg, 'show', 'wg0', 'public-key').strip
+      end
+      public_key
+    end
+
+    def reconcile_config(node_name, config_content)
+      temp_file = '/tmp/messhy-wg0.conf'
+      script = reconcile_script(temp_file)
+      execute_on_node(node_name) do
+        upload! StringIO.new(config_content), temp_file
+        execute :sudo, :bash, '-lc', Shellwords.escape(script)
+      end
+    end
+
     def upload_and_start_configs(configs)
       hosts = configs.filter_map do |node_name, config_content|
         node_config = config.node_config(node_name)
@@ -277,6 +304,8 @@ module Messhy
         verify_host_key: config.verify_host_key_mode
       }
 
+      options[:user_known_hosts_file] = [config.ssh_known_hosts_file] if config.ssh_known_hosts_file
+
       if File.exist?(config.ssh_key)
         options[:keys] = [config.ssh_key]
         options[:keys_only] = true
@@ -293,16 +322,65 @@ module Messhy
       ssh_port = node_config['ssh_port'] || node_config['port']
       host.port = ssh_port if ssh_port
 
+      host.ssh_options = (host.ssh_options || {}).merge(strict_ssh_options)
+
       if node_config['ssh_key']
         keys = Array(node_config['ssh_key']).map { |path| File.expand_path(path) }
         merged = (host.ssh_options || {}).merge(keys: keys, keys_only: true)
         host.ssh_options = merged
       end
 
+      if (jump_host_config = config.jump_host_config(node_name))
+        merged = (host.ssh_options || {}).merge(proxy: jump_proxy(jump_host_config))
+        host.ssh_options = merged
+      end
+
       manage_property(host.properties, :node_name, node_name)
       host
     end
 
+    def strict_ssh_options
+      options = { verify_host_key: config.verify_host_key_mode }
+      options[:user_known_hosts_file] = [config.ssh_known_hosts_file] if config.ssh_known_hosts_file
+      options
+    end
+
+    def jump_proxy(jump_host_config)
+      jump_user = jump_host_config['ssh_user'] || jump_host_config['user'] || config.user
+      jump_port = jump_host_config['ssh_port'] || jump_host_config['port']
+      jump_key = jump_host_config['ssh_key'] || config.ssh_key
+      command = [
+        'ssh',
+        '-F', '/dev/null',
+        '-o', 'BatchMode=yes',
+        '-o', 'ForwardAgent=no',
+        '-o', "StrictHostKeyChecking=#{open_ssh_host_key_mode}"
+      ]
+
+      command.push('-o', "UserKnownHostsFile=#{config.ssh_known_hosts_file}") if config.ssh_known_hosts_file
+
+      if jump_key && File.exist?(File.expand_path(jump_key))
+        command.push('-i', File.expand_path(jump_key), '-o', 'IdentitiesOnly=yes')
+      end
+
+      command.push('-p', jump_port.to_s) if jump_port
+      command.push('-W', '%h:%p', "#{jump_user}@#{jump_host_config.fetch('host')}")
+
+      command_line = Shellwords.join(command).gsub('\\%h', '%h').gsub('\\%p', '%p')
+      Net::SSH::Proxy::Command.new(command_line)
+    end
+
+    def open_ssh_host_key_mode
+      case config.verify_host_key_mode
+      when :accept_new
+        'accept-new'
+      when :never
+        'no'
+      else
+        'yes'
+      end
+    end
+
     def manage_property(properties, key, value = nil)
       if value.nil?
         # Fetch mode
@@ -312,5 +390,39 @@ module Messhy
         properties.respond_to?(:set) ? properties.set(key, value) : properties[key] = value
       end
     end
+
+    def reconcile_script(temp_file)
+      <<~SCRIPT
+        set -euo pipefail
+        target=/etc/wireguard/wg0.conf
+        candidate=/etc/wireguard/wg0.next.conf
+        previous=/etc/wireguard/wg0.conf.previous
+        stripped=/tmp/messhy-wg0.stripped
+
+        install -o root -g root -m 600 #{temp_file} "$candidate"
+        wg-quick strip "$candidate" > "$stripped"
+
+        if systemctl is-active --quiet wg-quick@wg0; then
+          cp -p "$target" "$previous"
+          mv "$candidate" "$target"
+          if ! wg syncconf wg0 "$stripped"; then
+            cp -p "$previous" "$target"
+            wg-quick strip "$target" > "$stripped"
+            wg syncconf wg0 "$stripped"
+            exit 1
+          fi
+        else
+          test ! -f "$target" || cp -p "$target" "$previous"
+          mv "$candidate" "$target"
+          systemctl enable wg-quick@wg0
+          if ! systemctl start wg-quick@wg0; then
+            test ! -f "$previous" || cp -p "$previous" "$target"
+            exit 1
+          fi
+        fi
+
+        rm -f "$stripped" #{temp_file}
+      SCRIPT
+    end
   end
 end

data/lib/messhy/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Messhy
-  VERSION = '0.8.3'
+  VERSION = '0.9.0'
 end

data/lib/messhy/wireguard_config.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Messhy
+  class WireguardConfig
+    attr_reader :interface, :peers
+
+    def self.parse(content)
+      new(content).tap(&:parse!)
+    end
+
+    def initialize(content)
+      @content = content
+      @interface = {}
+      @peers = []
+    end
+
+    def parse!
+      section = nil
+      peer_name = nil
+
+      @content.each_line do |line|
+        stripped = line.strip
+        if (match = stripped.match(/\A# Peer: (.+)\z/))
+          peer_name = match[1]
+        elsif stripped == '[Interface]'
+          section = interface
+        elsif stripped == '[Peer]'
+          section = {}
+          section['Name'] = peer_name if peer_name
+          peers << section
+          peer_name = nil
+        elsif section && (match = stripped.match(/\A([^#=]+?)\s*=\s*(.+)\z/))
+          section[match[1].strip] = match[2].strip
+        end
+      end
+
+      self
+    end
+  end
+end

data/lib/messhy.rb

@@ -2,6 +2,7 @@
 
 require_relative 'messhy/version'
 require_relative 'messhy/configuration'
+require_relative 'messhy/wireguard_config'
 require_relative 'messhy/wireguard_status_parser'
 require_relative 'messhy/installer'
 require_relative 'messhy/mesh_builder'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: messhy
 version: !ruby/object:Gem::Version
-  version: 0.8.3
+  version: 0.9.0
 platform: ruby
 authors:
 - BoringCache
@@ -91,6 +91,7 @@ files:
 - lib/messhy/railtie.rb
 - lib/messhy/ssh_executor.rb
 - lib/messhy/version.rb
+- lib/messhy/wireguard_config.rb
 - lib/messhy/wireguard_status_parser.rb
 - lib/tasks/messhy.rake
 - templates/wg0.conf.erb