@marcusrbrown/infra 0.10.0 → 0.10.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcusrbrown/infra",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "Infrastructure management CLI — deploy automation, health checks, and MCP bridge",
   "keywords": [
     "infra",
@@ -18,6 +18,9 @@
   "license": "MIT",
   "author": "Marcus R. Brown <contact@marcusrbrown.com>",
   "type": "module",
+  "exports": {
+    "./vpn/peers": "./src/commands/vpn/peers.ts"
+  },
   "bin": {
     "infra": "src/cli.ts"
   },
@@ -31,7 +34,6 @@
   "dependencies": {
     "@clack/prompts": "^1.2.0",
     "@goke/mcp": "^0.0.10",
-    "@marcusrbrown/infra-shared": "workspace:*",
     "goke": "^6.3.2",
     "string-dedent": "^3.0.2",
     "zod": "^4.3.6"

package/src/commands/vpn/client.ts

@@ -3,15 +3,8 @@ import type {goke} from 'goke'
 import {mkdir, writeFile} from 'node:fs/promises'
 import {resolve} from 'node:path'
 
-import {
-  addPeer,
-  readPeers,
-  removePeer,
-  renderClientConfig,
-  writePeers,
-  type Peer,
-} from '@marcusrbrown/infra-shared/vpn/peers'
 import {z} from 'zod'
+import {addPeer, readPeers, removePeer, renderClientConfig, writePeers, type Peer} from './peers'
 
 declare const process: {
   env: Record<string, string | undefined>

package/src/commands/vpn/peers.test.ts

@@ -0,0 +1,367 @@
+/// <reference types="bun" />
+
+import {describe, expect, it} from 'bun:test'
+
+import {
+  addPeer,
+  nextTunnelIp,
+  parsePeersJson,
+  removePeer,
+  renderClientConfig,
+  renderServerConfig,
+  type Peer,
+  type PeersFile,
+} from './peers'
+
+// ── renderServerConfig ────────────────────────────────────────────────────────
+
+describe('renderServerConfig', () => {
+  const SERVER_PRIVATE_KEY = 'sErVeRpRiVaTeKeY1234567890abcdefghijklmnopqrstuvwxyz='
+
+  it('renders [Interface] block with Address 10.8.0.1/24, ListenPort 51820, and PrivateKey', () => {
+    const config = renderServerConfig(SERVER_PRIVATE_KEY, [])
+
+    expect(config).toContain('[Interface]')
+    expect(config).toContain('Address = 10.8.0.1/24')
+    expect(config).toContain('ListenPort = 51820')
+    expect(config).toContain(`PrivateKey = ${SERVER_PRIVATE_KEY}`)
+  })
+
+  it('renders PostUp and PostDown iptables MASQUERADE rules', () => {
+    const config = renderServerConfig(SERVER_PRIVATE_KEY, [])
+
+    expect(config).toContain('PostUp')
+    expect(config).toContain('PostDown')
+    expect(config).toContain('MASQUERADE')
+    expect(config).toContain('FORWARD')
+  })
+
+  it('renders 0 [Peer] blocks when peers list is empty', () => {
+    const config = renderServerConfig(SERVER_PRIVATE_KEY, [])
+
+    const peerMatches = config.match(/^\[Peer\]/gm)
+    expect(peerMatches).toBeNull()
+  })
+
+  it('renders exactly 1 [Peer] block for 1 peer with correct PublicKey and AllowedIPs', () => {
+    const peers: Peer[] = [{name: 'laptop', publicKey: 'pUbLiCkEy1==', tunnelIp: '10.8.0.2'}]
+    const config = renderServerConfig(SERVER_PRIVATE_KEY, peers)
+
+    const peerMatches = config.match(/^\[Peer\]/gm)
+    expect(peerMatches).toHaveLength(1)
+    expect(config).toContain('PublicKey = pUbLiCkEy1==')
+    expect(config).toContain('AllowedIPs = 10.8.0.2/32')
+  })
+
+  it('renders exactly 3 [Peer] blocks for 3 peers with correct PublicKey and AllowedIPs per peer', () => {
+    const peers: Peer[] = [
+      {name: 'laptop', publicKey: 'pubkey-laptop==', tunnelIp: '10.8.0.2'},
+      {name: 'phone', publicKey: 'pubkey-phone==', tunnelIp: '10.8.0.3'},
+      {name: 'tablet', publicKey: 'pubkey-tablet==', tunnelIp: '10.8.0.4'},
+    ]
+    const config = renderServerConfig(SERVER_PRIVATE_KEY, peers)
+
+    const peerMatches = config.match(/^\[Peer\]/gm)
+    expect(peerMatches).toHaveLength(3)
+    expect(config).toContain('PublicKey = pubkey-laptop==')
+    expect(config).toContain('AllowedIPs = 10.8.0.2/32')
+    expect(config).toContain('PublicKey = pubkey-phone==')
+    expect(config).toContain('AllowedIPs = 10.8.0.3/32')
+    expect(config).toContain('PublicKey = pubkey-tablet==')
+    expect(config).toContain('AllowedIPs = 10.8.0.4/32')
+  })
+
+  it('uses default WAN interface eth0 in PostUp/PostDown when no opts provided', () => {
+    const config = renderServerConfig(SERVER_PRIVATE_KEY, [])
+
+    expect(config).toContain('eth0')
+  })
+
+  it('uses custom WAN interface when wanInterface opt is provided', () => {
+    const config = renderServerConfig(SERVER_PRIVATE_KEY, [], {wanInterface: 'ens5'})
+
+    expect(config).toContain('ens5')
+    expect(config).not.toContain('eth0')
+  })
+
+  it('rendering is deterministic — same inputs produce identical output', () => {
+    const peers: Peer[] = [{name: 'laptop', publicKey: 'pubkey-laptop==', tunnelIp: '10.8.0.2'}]
+    const first = renderServerConfig(SERVER_PRIVATE_KEY, peers)
+    const second = renderServerConfig(SERVER_PRIVATE_KEY, peers)
+
+    expect(first).toBe(second)
+  })
+
+  it('a removed peer does not appear in rendered config', () => {
+    const peers: Peer[] = [{name: 'laptop', publicKey: 'pubkey-laptop==', tunnelIp: '10.8.0.2'}]
+    const {peers: updatedPeers} = removePeer(peers, 'laptop')
+    const config = renderServerConfig(SERVER_PRIVATE_KEY, updatedPeers)
+
+    expect(config).not.toContain('pubkey-laptop==')
+    expect(config).not.toContain('10.8.0.2')
+    const peerMatches = config.match(/^\[Peer\]/gm)
+    expect(peerMatches).toBeNull()
+  })
+})
+
+// ── renderClientConfig ────────────────────────────────────────────────────────
+
+describe('renderClientConfig', () => {
+  const CLIENT_PRIVATE_KEY = 'cLiEnTpRiVaTeKeY1234567890abcdefghijklmnopqrstuvwxyz='
+  const SERVER_PUBLIC_KEY = 'sErVeRpUbLiCkEy1234567890abcdefghijklmnopqrstuvwxyz='
+  const ENDPOINT = '1.2.3.4'
+  const TUNNEL_IP = '10.8.0.2'
+
+  it('renders [Interface] block with PrivateKey and Address tunnelIp/32', () => {
+    const config = renderClientConfig({
+      clientPrivateKey: CLIENT_PRIVATE_KEY,
+      serverPublicKey: SERVER_PUBLIC_KEY,
+      endpoint: ENDPOINT,
+      tunnelIp: TUNNEL_IP,
+    })
+
+    expect(config).toContain('[Interface]')
+    expect(config).toContain(`PrivateKey = ${CLIENT_PRIVATE_KEY}`)
+    expect(config).toContain(`Address = ${TUNNEL_IP}/32`)
+  })
+
+  it('renders [Peer] block with server PublicKey and Endpoint host:51820', () => {
+    const config = renderClientConfig({
+      clientPrivateKey: CLIENT_PRIVATE_KEY,
+      serverPublicKey: SERVER_PUBLIC_KEY,
+      endpoint: ENDPOINT,
+      tunnelIp: TUNNEL_IP,
+    })
+
+    expect(config).toContain('[Peer]')
+    expect(config).toContain(`PublicKey = ${SERVER_PUBLIC_KEY}`)
+    expect(config).toContain(`Endpoint = ${ENDPOINT}:51820`)
+  })
+
+  it('defaults AllowedIPs to 0.0.0.0/0 for full-tunnel when not specified', () => {
+    const config = renderClientConfig({
+      clientPrivateKey: CLIENT_PRIVATE_KEY,
+      serverPublicKey: SERVER_PUBLIC_KEY,
+      endpoint: ENDPOINT,
+      tunnelIp: TUNNEL_IP,
+    })
+
+    expect(config).toContain('AllowedIPs = 0.0.0.0/0')
+  })
+
+  it('uses provided allowedIps for split-tunnel configuration', () => {
+    const config = renderClientConfig({
+      clientPrivateKey: CLIENT_PRIVATE_KEY,
+      serverPublicKey: SERVER_PUBLIC_KEY,
+      endpoint: ENDPOINT,
+      tunnelIp: TUNNEL_IP,
+      allowedIps: '10.0.0.0/8,192.168.0.0/16',
+    })
+
+    expect(config).toContain('AllowedIPs = 10.0.0.0/8,192.168.0.0/16')
+    expect(config).not.toContain('0.0.0.0/0')
+  })
+
+  it('rendering is deterministic — same inputs produce identical output', () => {
+    const opts = {
+      clientPrivateKey: CLIENT_PRIVATE_KEY,
+      serverPublicKey: SERVER_PUBLIC_KEY,
+      endpoint: ENDPOINT,
+      tunnelIp: TUNNEL_IP,
+    }
+    const first = renderClientConfig(opts)
+    const second = renderClientConfig(opts)
+
+    expect(first).toBe(second)
+  })
+
+  it('includes DNS line when dns option is provided', () => {
+    const config = renderClientConfig({
+      clientPrivateKey: CLIENT_PRIVATE_KEY,
+      serverPublicKey: SERVER_PUBLIC_KEY,
+      endpoint: ENDPOINT,
+      tunnelIp: TUNNEL_IP,
+      dns: '1.1.1.1',
+    })
+
+    expect(config).toContain('DNS = 1.1.1.1')
+  })
+
+  it('omits DNS line when dns option is not provided', () => {
+    const config = renderClientConfig({
+      clientPrivateKey: CLIENT_PRIVATE_KEY,
+      serverPublicKey: SERVER_PUBLIC_KEY,
+      endpoint: ENDPOINT,
+      tunnelIp: TUNNEL_IP,
+    })
+
+    expect(config).not.toContain('DNS')
+  })
+
+  it('omits DNS line when dns option is explicitly undefined', () => {
+    const config = renderClientConfig({
+      clientPrivateKey: CLIENT_PRIVATE_KEY,
+      serverPublicKey: SERVER_PUBLIC_KEY,
+      endpoint: ENDPOINT,
+      tunnelIp: TUNNEL_IP,
+      dns: undefined,
+    })
+
+    expect(config).not.toContain('DNS')
+  })
+})
+
+// ── nextTunnelIp ──────────────────────────────────────────────────────────────
+
+describe('nextTunnelIp', () => {
+  it('returns 10.8.0.2 when peers list is empty (skips .1 reserved for server)', () => {
+    expect(nextTunnelIp([])).toBe('10.8.0.2')
+  })
+
+  it('returns 10.8.0.3 when .2 is already allocated', () => {
+    const peers: Peer[] = [{name: 'laptop', publicKey: 'pk1==', tunnelIp: '10.8.0.2'}]
+    expect(nextTunnelIp(peers)).toBe('10.8.0.3')
+  })
+
+  it('allocates sequentially for multiple peers', () => {
+    const peers: Peer[] = [
+      {name: 'laptop', publicKey: 'pk1==', tunnelIp: '10.8.0.2'},
+      {name: 'phone', publicKey: 'pk2==', tunnelIp: '10.8.0.3'},
+    ]
+    expect(nextTunnelIp(peers)).toBe('10.8.0.4')
+  })
+
+  it('reuses freed slot after remove — lowest free N >= 2', () => {
+    const peers: Peer[] = [
+      {name: 'laptop', publicKey: 'pk1==', tunnelIp: '10.8.0.2'},
+      {name: 'phone', publicKey: 'pk2==', tunnelIp: '10.8.0.3'},
+      {name: 'tablet', publicKey: 'pk3==', tunnelIp: '10.8.0.4'},
+    ]
+    // Remove the middle peer (.3), next should reuse .3 (lowest free >= 2)
+    const {peers: afterRemove} = removePeer(peers, 'phone')
+    expect(nextTunnelIp(afterRemove)).toBe('10.8.0.3')
+  })
+
+  it('reuses lowest freed slot when first peer is removed', () => {
+    const peers: Peer[] = [
+      {name: 'laptop', publicKey: 'pk1==', tunnelIp: '10.8.0.2'},
+      {name: 'phone', publicKey: 'pk2==', tunnelIp: '10.8.0.3'},
+    ]
+    const {peers: afterRemove} = removePeer(peers, 'laptop')
+    expect(nextTunnelIp(afterRemove)).toBe('10.8.0.2')
+  })
+
+  it('throws an exhaustion error when all 253 client slots are allocated (.2 through .254)', () => {
+    // Fill all valid client octets: .2 through .254 (253 peers)
+    const peers: Peer[] = []
+    for (let i = 2; i <= 254; i++) {
+      peers.push({name: `peer${i}`, publicKey: `pk${i}==`, tunnelIp: `10.8.0.${i}`})
+    }
+    expect(() => nextTunnelIp(peers)).toThrow(/exhausted|max 253 peers/)
+  })
+})
+
+// ── addPeer ───────────────────────────────────────────────────────────────────
+
+describe('addPeer', () => {
+  it('adds a peer with the next available tunnel IP', () => {
+    const {peers, tunnelIp} = addPeer([], {name: 'laptop', publicKey: 'pk-laptop=='})
+
+    expect(peers).toHaveLength(1)
+    expect(peers[0]).toEqual({name: 'laptop', publicKey: 'pk-laptop==', tunnelIp: '10.8.0.2'})
+    expect(tunnelIp).toBe('10.8.0.2')
+  })
+
+  it('assigns sequential IPs for multiple adds', () => {
+    const {peers: peers1} = addPeer([], {name: 'laptop', publicKey: 'pk1=='})
+    const {peers: peers2, tunnelIp} = addPeer(peers1, {name: 'phone', publicKey: 'pk2=='})
+
+    expect(peers2).toHaveLength(2)
+    expect(tunnelIp).toBe('10.8.0.3')
+  })
+
+  it('throws when adding a peer with a duplicate name', () => {
+    const {peers} = addPeer([], {name: 'laptop', publicKey: 'pk1=='})
+
+    expect(() => addPeer(peers, {name: 'laptop', publicKey: 'pk2=='})).toThrow(/duplicate|already exists/i)
+  })
+
+  it('does not mutate the original peers array', () => {
+    const original: Peer[] = [{name: 'laptop', publicKey: 'pk1==', tunnelIp: '10.8.0.2'}]
+    const originalLength = original.length
+
+    addPeer(original, {name: 'phone', publicKey: 'pk2=='})
+
+    expect(original).toHaveLength(originalLength)
+  })
+})
+
+// ── removePeer ────────────────────────────────────────────────────────────────
+
+describe('removePeer', () => {
+  it('removes a peer by name and returns updated peers', () => {
+    const peers: Peer[] = [
+      {name: 'laptop', publicKey: 'pk1==', tunnelIp: '10.8.0.2'},
+      {name: 'phone', publicKey: 'pk2==', tunnelIp: '10.8.0.3'},
+    ]
+    const {peers: updated} = removePeer(peers, 'laptop')
+
+    expect(updated).toHaveLength(1)
+    expect(updated[0]?.name).toBe('phone')
+  })
+
+  it('throws a clear error when removing a non-existent peer', () => {
+    const peers: Peer[] = [{name: 'laptop', publicKey: 'pk1==', tunnelIp: '10.8.0.2'}]
+
+    expect(() => removePeer(peers, 'nonexistent')).toThrow(/not found|does not exist/i)
+  })
+
+  it('does not mutate the original peers array', () => {
+    const original: Peer[] = [
+      {name: 'laptop', publicKey: 'pk1==', tunnelIp: '10.8.0.2'},
+      {name: 'phone', publicKey: 'pk2==', tunnelIp: '10.8.0.3'},
+    ]
+    const originalLength = original.length
+
+    removePeer(original, 'laptop')
+
+    expect(original).toHaveLength(originalLength)
+  })
+})
+
+// ── Zod schema validation (readPeers-equivalent) ─────────────────────────────
+
+describe('parsePeersJson', () => {
+  it('throws on malformed JSON shape — wrong top-level type', () => {
+    expect(() => parsePeersJson([])).toThrow()
+  })
+
+  it('throws when peers array contains an entry missing publicKey', () => {
+    expect(() =>
+      parsePeersJson({
+        peers: [{name: 'laptop', tunnelIp: '10.8.0.2'}],
+      }),
+    ).toThrow()
+  })
+
+  it('throws when peers array contains an entry missing tunnelIp', () => {
+    expect(() =>
+      parsePeersJson({
+        peers: [{name: 'laptop', publicKey: 'pk=='}],
+      }),
+    ).toThrow()
+  })
+
+  it('accepts a valid peers file with empty peers array', () => {
+    const result: PeersFile = parsePeersJson({peers: []})
+    expect(result.peers).toHaveLength(0)
+  })
+
+  it('accepts a valid peers file with one peer', () => {
+    const result: PeersFile = parsePeersJson({
+      peers: [{name: 'laptop', publicKey: 'pk==', tunnelIp: '10.8.0.2'}],
+    })
+    expect(result.peers).toHaveLength(1)
+    expect(result.peers[0]?.name).toBe('laptop')
+  })
+})

package/src/commands/vpn/peers.ts

@@ -0,0 +1,193 @@
+import {readFile, writeFile} from 'node:fs/promises'
+
+import {z} from 'zod'
+
+// ── Schema ────────────────────────────────────────────────────────────────────
+
+const peerSchema = z.object({
+  name: z.string(),
+  publicKey: z.string(),
+  tunnelIp: z.string(),
+})
+
+const peersFileSchema = z.object({
+  peers: z.array(peerSchema),
+})
+
+export type Peer = z.infer<typeof peerSchema>
+export type PeersFile = z.infer<typeof peersFileSchema>
+
+// ── Validation ────────────────────────────────────────────────────────────────
+
+/**
+ * Parse and validate a raw value as a PeersFile.
+ * Throws a ZodError on invalid shape — fail-closed, no silent empty.
+ */
+export function parsePeersJson(raw: unknown): PeersFile {
+  return peersFileSchema.parse(raw)
+}
+
+// ── File I/O (thin layer — only these functions touch the filesystem) ─────────
+
+export async function readPeers(filePath: string): Promise<PeersFile> {
+  const content = await readFile(filePath, 'utf-8')
+  const raw: unknown = JSON.parse(content)
+  return parsePeersJson(raw)
+}
+
+export async function writePeers(filePath: string, peersFile: PeersFile): Promise<void> {
+  const content = `${JSON.stringify(peersFile, null, 2)}\n`
+  await writeFile(filePath, content, 'utf-8')
+}
+
+// ── IP allocation ─────────────────────────────────────────────────────────────
+
+const TUNNEL_SUBNET_PREFIX = '10.8.0.'
+const SERVER_OCTET = 1
+const FIRST_CLIENT_OCTET = 2
+
+/**
+ * Extract the last octet from a tunnel IP like '10.8.0.N'.
+ * Returns null if the IP doesn't match the expected subnet.
+ */
+function extractOctet(tunnelIp: string): number | null {
+  if (!tunnelIp.startsWith(TUNNEL_SUBNET_PREFIX)) {
+    return null
+  }
+  const octetStr = tunnelIp.slice(TUNNEL_SUBNET_PREFIX.length)
+  const octet = Number.parseInt(octetStr, 10)
+  return Number.isFinite(octet) && octet >= FIRST_CLIENT_OCTET ? octet : null
+}
+
+// Last valid client octet: .254 (.1 is server, .255 is broadcast)
+const LAST_CLIENT_OCTET = 254
+
+/**
+ * Compute the next available tunnel IP.
+ * Sequential 10.8.0.N/32 starting at .2 (.1 is reserved for the server).
+ * Reuses freed slots — returns the lowest free N >= 2.
+ * Throws when all 253 client slots (.2–.254) are exhausted.
+ */
+export function nextTunnelIp(peers: Peer[]): string {
+  const allocated = new Set<number>()
+  for (const peer of peers) {
+    const octet = extractOctet(peer.tunnelIp)
+    if (octet !== null) {
+      allocated.add(octet)
+    }
+  }
+
+  let n = FIRST_CLIENT_OCTET
+  while (allocated.has(n) || n === SERVER_OCTET) {
+    n++
+  }
+
+  if (n > LAST_CLIENT_OCTET) {
+    throw new Error(`Tunnel subnet 10.8.0.0/24 exhausted (max 253 peers).`)
+  }
+
+  return `${TUNNEL_SUBNET_PREFIX}${n}`
+}
+
+// ── Peer mutations (pure — return new arrays, never mutate) ───────────────────
+
+/**
+ * Add a peer with the next available tunnel IP.
+ * Throws if a peer with the same name already exists.
+ */
+export function addPeer(
+  peers: Peer[],
+  {name, publicKey}: {name: string; publicKey: string},
+): {peers: Peer[]; tunnelIp: string} {
+  const duplicate = peers.find(p => p.name === name)
+  if (duplicate !== undefined) {
+    throw new Error(`Peer "${name}" already exists (duplicate name).`)
+  }
+
+  const tunnelIp = nextTunnelIp(peers)
+  const newPeer: Peer = {name, publicKey, tunnelIp}
+  return {peers: [...peers, newPeer], tunnelIp}
+}
+
+/**
+ * Remove a peer by name.
+ * Throws a clear error if the peer does not exist — no silent no-op.
+ */
+export function removePeer(peers: Peer[], name: string): {peers: Peer[]} {
+  const index = peers.findIndex(p => p.name === name)
+  if (index === -1) {
+    throw new Error(`Peer "${name}" not found. Cannot remove a peer that does not exist.`)
+  }
+
+  const updated = [...peers.slice(0, index), ...peers.slice(index + 1)]
+  return {peers: updated}
+}
+
+// ── Config rendering (pure — string in → string out, no IO) ──────────────────
+
+export interface ServerConfigOpts {
+  wanInterface?: string
+}
+
+/**
+ * Render a full wg0.conf server configuration.
+ *
+ * Pure function: takes keys and peers as inputs, returns a config string.
+ * The server private key is passed in (it lives on the box; this function
+ * is used server-side where the key is available locally).
+ */
+export function renderServerConfig(serverPrivateKey: string, peers: Peer[], opts?: ServerConfigOpts): string {
+  const wanInterface = opts?.wanInterface ?? 'eth0'
+
+  const lines: string[] = [
+    '[Interface]',
+    `Address = 10.8.0.1/24`,
+    `ListenPort = 51820`,
+    `PrivateKey = ${serverPrivateKey}`,
+    `PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ${wanInterface} -j MASQUERADE`,
+    `PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ${wanInterface} -j MASQUERADE`,
+  ]
+
+  for (const peer of peers) {
+    lines.push('')
+    lines.push('[Peer]')
+    lines.push(`PublicKey = ${peer.publicKey}`)
+    lines.push(`AllowedIPs = ${peer.tunnelIp}/32`)
+  }
+
+  return `${lines.join('\n')}\n`
+}
+
+export interface ClientConfigOpts {
+  clientPrivateKey: string
+  serverPublicKey: string
+  endpoint: string
+  tunnelIp: string
+  allowedIps?: string
+  dns?: string
+}
+
+/**
+ * Render a WireGuard client .conf file.
+ *
+ * Pure function: takes all config as inputs, returns a config string.
+ * allowedIps defaults to '0.0.0.0/0' (full tunnel).
+ * Pass specific CIDRs for split-tunnel.
+ */
+export function renderClientConfig(opts: ClientConfigOpts): string {
+  const {clientPrivateKey, serverPublicKey, endpoint, tunnelIp, allowedIps = '0.0.0.0/0', dns} = opts
+
+  const lines: string[] = ['[Interface]', `PrivateKey = ${clientPrivateKey}`, `Address = ${tunnelIp}/32`]
+
+  if (dns !== undefined) {
+    lines.push(`DNS = ${dns}`)
+  }
+
+  lines.push('')
+  lines.push('[Peer]')
+  lines.push(`PublicKey = ${serverPublicKey}`)
+  lines.push(`Endpoint = ${endpoint}:51820`)
+  lines.push(`AllowedIPs = ${allowedIps}`)
+
+  return `${lines.join('\n')}\n`
+}