messhy 0.9.0 → 0.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 14432b60b44c17938ab995bb9e9ca0a360f1381bbfe4f746e3bcc6a07be2e658
-  data.tar.gz: d98203d9b327d971f61e81022611e0f54d9e08673d381ae57fa27b58a55dabeb
+  metadata.gz: fd61d3c3a60ea6d3f5decc20c10c17168607ff1e752e688ad0aec6f22c37be79
+  data.tar.gz: b6552633a9762e716b3bee6380c318eecefd8e3280fb44a100bd921f4c82c816
 SHA512:
-  metadata.gz: c8db3c1b1b7f71680e565c0373b463f4c749d4be645a90f587970a8955ef95d1684dffe2bf46d4cbbaf4de763e4d21482ed7c9e8aa72d4a64c56190c1076038b
-  data.tar.gz: 2e59b8e950931e8f27a4f004a5e9e381176ced1cb670fd16f03045ea4ee0856a2f81e577a5fc07fc5b535d4bd45218989db72b896ec0ab18cfe003af864517aa
+  metadata.gz: c2a44398671a4801cab1170cc5889ac55c4da1ffa1005422664d8b783ee30933eca79c30ccdd2b905b36cc7c82b9049ae97fec9ddc61fd11e42611682dd92ac1
+  data.tar.gz: e159a7b8575b572f348d10867a6ff3797bc765d87552b134eb8ea1d2a910359a24b54b7e66023633bac4725af5adaf846558b1c998429e1c4b7a06546fb63ad0

data/CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.1] - 2026-09-02
+
+### Fixed
+
+- Preserve live peers outside the source-owned mesh during reconciliation.
+  Exact-source pruning is available only through the explicit `--prune` option.
+
 ## [0.9.0] - 2026-09-02
 
 ### Added

data/README.md

@@ -178,8 +178,11 @@ messhy reconcile --environment=production
 `import-keys` writes the same mode-`0600` local secret files as initial setup
 and never prints key material. `reconcile` validates each candidate config,
 applies active peer changes with `wg syncconf`, and restores the previous config
-if a live sync fails. Set `ssh_known_hosts_file` to a reviewed file when the
-mesh should not depend on the operator's global SSH configuration.
+if a live sync fails. Existing peers outside the source configuration are
+preserved by default so another system can own adjacent mesh members. Pass
+`--prune` only when the source configuration should remove those peers. Set
+`ssh_known_hosts_file` to a reviewed file when the mesh should not depend on
+the operator's global SSH configuration.
 
 ### Status & Monitoring
 

data/lib/messhy/cli.rb

@@ -28,9 +28,10 @@ module Messhy
 
     desc 'reconcile', 'Apply mesh changes without restarting active WireGuard interfaces'
     option :dry_run, type: :boolean, default: false
+    option :prune, type: :boolean, default: false, desc: 'Remove live peers absent from the source configuration'
     def reconcile
       config = load_config
-      Installer.new(config, dry_run: options[:dry_run]).reconcile
+      Installer.new(config, dry_run: options[:dry_run], prune: options[:prune]).reconcile
     rescue SSHKit::Runner::ExecuteError => e
       handle_ssh_error(e, config)
     end

data/lib/messhy/installer.rb

@@ -9,11 +9,12 @@ require 'base64'
 module Messhy
   # rubocop:disable Metrics/ClassLength
   class Installer
-    attr_reader :config, :dry_run, :ssh_executor
+    attr_reader :config, :dry_run, :prune, :ssh_executor
 
-    def initialize(config, dry_run: false, ssh_executor: SSHExecutor.new(config))
+    def initialize(config, dry_run: false, prune: false, ssh_executor: SSHExecutor.new(config))
       @config = config
       @dry_run = dry_run
+      @prune = prune
       @ssh_executor = ssh_executor
       @node_keys = load_existing_keys
       @psk_map = load_existing_psks
@@ -52,6 +53,7 @@ module Messhy
         if dry_run
           puts "  [DRY RUN] Would reconcile #{node_name}"
         else
+          config_content = preserve_unmanaged_peers(node_name, config_content) unless prune
           ssh_executor.reconcile_config(node_name, config_content)
           puts "  ✓ Reconciled #{node_name}"
         end
@@ -179,6 +181,12 @@ module Messhy
 
     private
 
+    def preserve_unmanaged_peers(node_name, config_content)
+      current = WireguardConfig.parse(ssh_executor.read_wireguard_config(node_name))
+      managed_peer_names = config.node_names - [node_name]
+      current.preserve_unmanaged_peers_in(config_content, managed_peer_names: managed_peer_names)
+    end
+
     def validate_imported_address!(node_name, node_config, snapshot)
       address = snapshot.interface['Address'].to_s.split('/').first
       return if address == node_config['mesh_ip']

data/lib/messhy/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Messhy
-  VERSION = '0.9.0'
+  VERSION = '0.9.1'
 end

data/lib/messhy/wireguard_config.rb

@@ -36,5 +36,33 @@ module Messhy
 
       self
     end
+
+    def preserve_unmanaged_peers_in(candidate_content, managed_peer_names:)
+      candidate = self.class.parse(candidate_content)
+      candidate_public_keys = candidate.peers.filter_map { |peer| peer['PublicKey'] }
+      managed_peer_names = managed_peer_names.to_set
+
+      unmanaged_peers = peers.reject do |peer|
+        managed_peer_names.include?(peer['Name']) || candidate_public_keys.include?(peer['PublicKey'])
+      end
+
+      return candidate_content if unmanaged_peers.empty?
+
+      [candidate_content.rstrip, *unmanaged_peers.map { |peer| render_peer(peer) }, ''].join("\n\n")
+    end
+
+    private
+
+    def render_peer(peer)
+      lines = []
+      lines << "# Peer: #{peer['Name']}" if peer['Name']
+      lines << '[Peer]'
+      peer.each do |key, value|
+        next if key == 'Name'
+
+        lines << "#{key} = #{value}"
+      end
+      lines.join("\n")
+    end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: messhy
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.9.1
 platform: ruby
 authors:
 - BoringCache