@highstate/library 0.20.0 → 0.25.0

package/src/wireguard.ts

@@ -80,7 +80,7 @@ export const networkArgs = {
   /**
    * The extra parameters for the amneziawg backend.
    */
-  amnezia: amneziaParametersSchema.optional(),
+  amnezia: amneziaParametersSchema.default({}),
 }
 
 const configSharedArgs = $args({
@@ -121,6 +121,14 @@ export const networkEntity = defineEntity({
 })
 
 export const nodeExposePolicySchema = z.enum(["always", "when-has-endpoint", "never"])
+export const feedDaemonSyncModeSchema = z.enum(["sse", "polling"])
+export const feedDaemonBackendTypeSchema = z.enum([
+  "wg-quick",
+  "networkmanager",
+  "netns",
+  "windows",
+  "windows-manager",
+])
 
 export const feedDisplayInfoSchema = z.object({
   /**
@@ -171,6 +179,11 @@ export const feedMetadataSchema = z.object({
    * The display information of the tunnel.
    */
   displayInfo: feedDisplayInfoSchema,
+
+  /**
+   * The warning message to display for the tunnel.
+   */
+  warningMessage: z.string().optional(),
 })
 
 export const peerEntity = defineEntity({
@@ -330,6 +343,19 @@ export const configEntity = defineEntity({
      * The file containing the wg-quick configuration.
      */
     file: fileEntity,
+
+    /**
+     * The identity for which the config is generated.
+     */
+    identity: identityEntity,
+
+    /**
+     * The peers included in the config.
+     */
+    peers: {
+      entity: peerEntity,
+      multiple: true,
+    },
   },
 
   schema: z.object({
@@ -354,6 +380,8 @@ export type Network = EntityValue<typeof networkEntity>
 export type Identity = EntityValue<typeof identityEntity>
 export type Peer = EntityValue<typeof peerEntity>
 export type NodeExposePolicy = z.infer<typeof nodeExposePolicySchema>
+export type FeedDaemonSyncMode = z.infer<typeof feedDaemonSyncModeSchema>
+export type FeedDaemonBackendType = z.infer<typeof feedDaemonBackendTypeSchema>
 export type Config = EntityValue<typeof configEntity>
 
 export type NetworkInput = EntityInput<typeof networkEntity>
@@ -364,6 +392,40 @@ export type ConfigInput = EntityInput<typeof configEntity>
 export type FeedDisplayInfo = z.infer<typeof feedDisplayInfoSchema>
 export type FeedMetadata = z.infer<typeof feedMetadataSchema>
 
+const feedDaemonArgs = $args({
+  /**
+   * The label of the feed in the wg-feed daemon config.
+   */
+  feedName: genericNameSchema.default("main"),
+
+  /**
+   * The label of the backend in the wg-feed daemon config.
+   */
+  backendName: genericNameSchema.default("default"),
+
+  /**
+   * The backend type used by the wg-feed daemon.
+   */
+  backendType: feedDaemonBackendTypeSchema.default("wg-quick"),
+
+  /**
+   * The sync mode used by the wg-feed daemon.
+   */
+  syncMode: feedDaemonSyncModeSchema.default("sse"),
+
+  /**
+   * The polling interval in seconds.
+   *
+   * If set to 0, wg-feed daemon uses the server-provided TTL.
+   */
+  pollingInterval: z.number().int().nonnegative().default(0),
+
+  /**
+   * The state file path used by the wg-feed daemon.
+   */
+  statePath: z.string().default("/var/lib/wg-feed/state.json"),
+})
+
 /**
  * Holds the shared configuration for WireGuard identities, peers, and nodes.
  */
@@ -403,7 +465,14 @@ const sharedFeedArgs = $args({
          */
         provided: z.literal("yes"),
 
-        ...pick(feedMetadataSchema.shape, ["id", "name", "enabled", "forced", "exclusive"]),
+        ...pick(feedMetadataSchema.shape, [
+          "id",
+          "name",
+          "enabled",
+          "forced",
+          "exclusive",
+          "warningMessage",
+        ]),
 
         // Highstate does not support nested objects in UI
         ...feedDisplayInfoSchema.shape,
@@ -733,10 +802,27 @@ export const nodeK8s = defineUnit({
      * By default, is false.
      */
     allowClusterPods: z.boolean().default(false),
+
+    /**
+     * Whether to drop all traffic from the interface using ip rule with priority 100.
+     *
+     * This is useful for preventing the traffic leaks before upstream node is attached via `downstreamInterface` input.
+     * They will add their own ip rule with <100 priority which allows traffic from the interface.
+     */
+    lockdownUpstream: z.boolean().default(false),
   },
 
   inputs: {
-    identity: identityEntity,
+    identity: {
+      entity: identityEntity,
+      required: false,
+    },
+
+    config: {
+      entity: configEntity,
+      required: false,
+    },
+
     k8sCluster: clusterEntity,
 
     workload: {
@@ -823,6 +909,11 @@ export const nodeFeedK8s = defineUnit({
      */
     listenPort: z.number().default(51820),
 
+    /**
+     * The NodePort to assign when the node is exposed.
+     */
+    nodePort: z.number().int().min(30000).max(32767).optional(),
+
     /**
      * The name of the WireGuard interface to export as `interface` output.
      *
@@ -831,6 +922,13 @@ export const nodeFeedK8s = defineUnit({
      */
     interfaceName: z.string().default("wg0"),
 
+    ...feedDaemonArgs,
+
+    /**
+     * The wg-feed tunnel IDs to force-enable in the daemon config.
+     */
+    enabledTunnels: z.string().array().default([]),
+
     /**
      * List of CIDR blocks that should be blocked from forwarding through this WireGuard node.
      *
@@ -841,6 +939,14 @@ export const nodeFeedK8s = defineUnit({
      */
     forwardRestrictedSubnets: z.string().array().default([]),
 
+    /**
+     * Whether to drop all traffic from the interface using ip rule with priority 100.
+     *
+     * This is useful for preventing the traffic leaks before upstream node is attached via `downstreamInterface` input.
+     * They will add their own ip rule with <100 priority which allows traffic from the interface.
+     */
+    lockdownUpstream: z.boolean().default(false),
+
     /**
      * The extra specification of the container which runs the wg-feed daemon.
      *
@@ -903,6 +1009,114 @@ export const nodeFeedK8s = defineUnit({
   },
 })
 
+/**
+ * The wg-feed daemon deployed on a server using a systemd service.
+ */
+export const nodeFeed = defineUnit({
+  type: "wireguard.node.feed.v1",
+
+  args: {
+    /**
+     * The name of the wg-feed daemon systemd service.
+     *
+     * By default, the name is `wg-feed-${unitName}`.
+     */
+    serviceName: z.string().optional(),
+
+    /**
+     * The UDP port that will be exposed by the output peer.
+     */
+    listenPort: z.number().default(51820),
+
+    /**
+     * The name of the WireGuard interface to use for lockdown rules.
+     *
+     * Note: wg-feed may manage multiple tunnels.
+     */
+    interfaceName: z.string().default("wg0"),
+
+    /**
+     * The path where the wg-feed daemon binary should be installed.
+     */
+    daemonPath: z.string().default("/usr/local/bin/wg-feed-daemon"),
+
+    /**
+     * The path where the wg-feed daemon config should be written.
+     */
+    configPath: z.string().default("/etc/wg-feed/config.yaml"),
+
+    ...feedDaemonArgs,
+
+    /**
+     * The wg-feed tunnel IDs to force-enable in the daemon config.
+     */
+    enabledTunnels: z.string().array().default([]),
+
+    /**
+     * List of CIDR blocks that should be blocked from forwarding through this WireGuard node.
+     *
+     * This prevents other peers from reaching these destination CIDRs while still allowing
+     * the peers in those CIDRs to access the internet and other allowed endpoints.
+     */
+    forwardRestrictedSubnets: z.string().array().default([]),
+
+    /**
+     * Whether to drop all traffic from the interface using ip rule with priority 100.
+     *
+     * This is useful for preventing traffic leaks before another routing rule is installed.
+     */
+    lockdownUpstream: z.boolean().default(false),
+  },
+
+  secrets: {
+    /**
+     * The wg-feed setup URLs to configure on the daemon.
+     *
+     * This is useful for URLs that include secret fragments such as age keys.
+     */
+    endpoints: z.string().array().default([]),
+  },
+
+  inputs: {
+    server: {
+      entity: serverEntity,
+      required: true,
+    },
+
+    endpoints: {
+      entity: l7EndpointEntity,
+      multiple: true,
+      required: false,
+    },
+
+    peer: {
+      entity: peerEntity,
+      required: false,
+    },
+  },
+
+  outputs: {
+    peer: {
+      entity: peerEntity,
+      required: false,
+    },
+  },
+
+  meta: {
+    title: "WireGuard Feed Server Node",
+    description: "The wg-feed daemon deployed on a server.",
+    icon: "simple-icons:wireguard",
+    iconColor: "#88171a",
+    secondaryIcon: "mdi:server",
+    category: "VPN",
+  },
+
+  source: {
+    package: "@highstate/wireguard",
+    path: "node.feed",
+  },
+})
+
 /**
  * The WireGuard node deployed on a server using wg-quick systemd service.
  */
@@ -958,7 +1172,16 @@ export const node = defineUnit({
   },
 
   inputs: {
-    identity: identityEntity,
+    identity: {
+      entity: identityEntity,
+      required: false,
+    },
+
+    config: {
+      entity: configEntity,
+      required: false,
+    },
+
     server: {
       entity: serverEntity,
       required: true,
@@ -1034,6 +1257,43 @@ export const config = defineUnit({
   },
 })
 
+/**
+ * Parses an existing WireGuard configuration into config, identity, network, and peer entities.
+ */
+export const existingConfig = defineUnit({
+  type: "wireguard.existing-config.v1",
+
+  args: {
+    /**
+     * The existing wg-quick or awg-quick configuration content.
+     */
+    config: z.string().meta({ language: "ini" }),
+  },
+
+  outputs: {
+    config: configEntity,
+    identity: identityEntity,
+    network: networkEntity,
+    peers: {
+      entity: peerEntity,
+      multiple: true,
+    },
+  },
+
+  meta: {
+    title: "Existing WireGuard Config",
+    icon: "simple-icons:wireguard",
+    iconColor: "#88171a",
+    secondaryIcon: "mdi:file-import",
+    category: "VPN",
+  },
+
+  source: {
+    package: "@highstate/wireguard",
+    path: "existing-config",
+  },
+})
+
 /**
  * The WireGuard configuration bundle for the identity and peers.
  */
@@ -1055,6 +1315,10 @@ export const configBundle = defineUnit({
       multiple: true,
       required: false,
     },
+    network: {
+      entity: networkEntity,
+      required: false,
+    },
   },
 
   outputs: {
@@ -1113,6 +1377,11 @@ export const feed = defineUnit({
      * The display information of the feed.
      */
     displayInfo: feedDisplayInfoSchema,
+
+    /**
+     * The warning message to display for the feed.
+     */
+    warningMessage: z.string().optional(),
   },
 
   secrets: {

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2025 Exeteres
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.