messhy 0.9.2 → 0.9.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fbcab708f43ed1ee21e30b2162ce6ec7aa4e762dfebeea5874d4f0f7d55a46d1
-  data.tar.gz: 5085a9ad4d3f8429e22544d32ca60275eda1079934f4dd63c5a80dd54c0944ec
+  metadata.gz: 461686d1f8da9181c5eddeece3d651a0f364fb2be1fe944a174b91bc6bf77d8e
+  data.tar.gz: 06aacac73369872bc1c63c0083b200125a97813a0be83ce85857e27d8a0785ee
 SHA512:
-  metadata.gz: 490c2acab762f4f14b39731a1c33408b0e9131316dff4f52ec2b1083d0b03273e475709d47a435cf7566f524013bff90ae7fb4cdb70cfbf5d2b4fc15fe62def8
-  data.tar.gz: 2f29f271a42b84f6f9b205233c175f203fa0a69efe5fc65b119e570a2029cafc2a8e6b4f4cc725aa7da6ac07eabf8216e7c745cf53d66ada9e53e88a89ae649a
+  metadata.gz: 9a90d59ae7a33d8e741a2917bdd20919fa5bce750b93037ac2b7ea4dbd94f5e17b48449b8533fbb10d820d776f184f2fe80036a65611d5439a94497e5d204741
+  data.tar.gz: 4b91ddf4f75e331ffe080c1cdb8b27aa3e311c950b249e5f4fff03e847dcd8f56fdf4be22ca79a958b42b5c71e523c0d265d397e148ec90c042b09b7d8319552

data/CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.3] - 2026-10-05
+
+### Fixed
+
+- Keep temporary WireGuard configurations private during reconciliation and
+  remove them after successful updates or failed updates with rollback.
+
 ## [0.9.2] - 2026-10-02
 
 ### Changed

data/README.md

@@ -103,6 +103,13 @@ Apply DNS without touching WireGuard:
 messhy dns --environment=production
 ```
 
+Use `messhy reconcile --environment=production` to update active peers without
+restarting their WireGuard interfaces. Reconciliation uploads configuration
+inside a private temporary directory and passes a separate owner-only file to
+`wg syncconf`. Both temporary files are removed after a successful update or
+a failed update with rollback. The installed and previous configurations remain
+root-owned with mode `0600`.
+
 ## Secret Management
 
 `messhy setup` stores generated WireGuard key pairs inside `.secrets/wireguard/*.yml` with `0600` permissions. Each node gets its own YAML file (`.secrets/wireguard/<node>.yml`) and all peer pre‑shared keys live in `.secrets/wireguard/psks.yml`. The directory is gitignored by default, and the Rails generator ensures the ignore rules are present in your application. After provisioning, copy the YAML files into 1Password (or another vault) and remove them from disk if you do not want long‑lived local copies.

data/lib/messhy/ssh_executor.rb

@@ -127,11 +127,22 @@ module Messhy
     end
 
     def reconcile_config(node_name, config_content)
-      temp_file = '/tmp/messhy-wg0.conf'
-      script = reconcile_script(temp_file)
+      executor = self
       execute_on_node(node_name) do
-        upload! StringIO.new(config_content), temp_file
-        execute :sudo, :bash, '-lc', Shellwords.escape(script)
+        temp_directory = capture(:mktemp, '-d', '/tmp/messhy-reconcile.XXXXXXXXXX').strip
+        unless temp_directory.match?(%r{\A/tmp/messhy-reconcile\.[A-Za-z0-9]+\z})
+          raise Error, 'Could not create a private WireGuard upload directory'
+        end
+
+        temp_file = File.join(temp_directory, 'wg0.conf')
+        begin
+          upload! StringIO.new(config_content), temp_file
+          script = executor.send(:reconcile_script, temp_file)
+          execute :sudo, :bash, '-lc', Shellwords.escape(script)
+        ensure
+          execute :rm, '-f', temp_file
+          execute :rmdir, temp_directory
+        end
       end
     end
 
@@ -397,9 +408,11 @@ module Messhy
         target=/etc/wireguard/wg0.conf
         candidate=/etc/wireguard/wg0.next.conf
         previous=/etc/wireguard/wg0.conf.previous
-        stripped=/tmp/messhy-wg0.stripped
+        stripped=$(mktemp /tmp/messhy-wg0.XXXXXXXXXX)
+        trap 'rm -f "$stripped"' EXIT
+        trap 'exit 1' HUP INT TERM
 
-        install -o root -g root -m 600 #{temp_file} "$candidate"
+        install -o root -g root -m 600 #{Shellwords.escape(temp_file)} "$candidate"
         wg-quick strip "$candidate" > "$stripped"
 
         if systemctl is-active --quiet wg-quick@wg0; then
@@ -421,7 +434,6 @@ module Messhy
           fi
         fi
 
-        rm -f "$stripped" #{temp_file}
       SCRIPT
     end
   end

data/lib/messhy/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Messhy
-  VERSION = '0.9.2'
+  VERSION = '0.9.3'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: messhy
 version: !ruby/object:Gem::Version
-  version: 0.9.2
+  version: 0.9.3
 platform: ruby
 authors:
 - BoringCache
@@ -99,7 +99,7 @@ homepage: https://github.com/boringcache/messhy
 licenses:
 - MIT
 metadata:
-  source_code_uri: https://github.com/boringcache/messhy/tree/v0.9.2
+  source_code_uri: https://github.com/boringcache/messhy/tree/v0.9.3
   documentation_uri: https://github.com/boringcache/messhy/blob/main/README.md
   changelog_uri: https://github.com/boringcache/messhy/blob/main/CHANGELOG.md
   bug_tracker_uri: https://github.com/boringcache/messhy/issues