@push.rocks/smartvpn 1.4.1 → 1.6.0

package/ts/smartvpn.classes.wgconfig.ts

@@ -0,0 +1,123 @@
+import type { IWgPeerConfig } from './smartvpn.interfaces.js';
+
+// ============================================================================
+// WireGuard .conf file generator
+// ============================================================================
+
+export interface IWgClientConfOptions {
+  /** Client private key (base64) */
+  privateKey: string;
+  /** Client TUN address with prefix (e.g. 10.8.0.2/24) */
+  address: string;
+  /** DNS servers */
+  dns?: string[];
+  /** TUN MTU */
+  mtu?: number;
+  /** Server peer config */
+  peer: {
+    publicKey: string;
+    presharedKey?: string;
+    endpoint: string;
+    allowedIps: string[];
+    persistentKeepalive?: number;
+  };
+}
+
+export interface IWgServerConfOptions {
+  /** Server private key (base64) */
+  privateKey: string;
+  /** Server TUN address with prefix (e.g. 10.8.0.1/24) */
+  address: string;
+  /** UDP listen port */
+  listenPort: number;
+  /** DNS servers */
+  dns?: string[];
+  /** TUN MTU */
+  mtu?: number;
+  /** Enable NAT — adds PostUp/PostDown iptables rules */
+  enableNat?: boolean;
+  /** Network interface for NAT (e.g. eth0). Auto-detected if omitted. */
+  natInterface?: string;
+  /** Configured peers */
+  peers: IWgPeerConfig[];
+}
+
+/**
+ * Generates standard WireGuard .conf files compatible with wg-quick,
+ * WireGuard iOS/Android apps, and other standard WireGuard clients.
+ */
+export class WgConfigGenerator {
+  /**
+   * Generate a client .conf file content.
+   */
+  public static generateClientConfig(opts: IWgClientConfOptions): string {
+    const lines: string[] = [];
+
+    lines.push('[Interface]');
+    lines.push(`PrivateKey = ${opts.privateKey}`);
+    lines.push(`Address = ${opts.address}`);
+    if (opts.dns && opts.dns.length > 0) {
+      lines.push(`DNS = ${opts.dns.join(', ')}`);
+    }
+    if (opts.mtu) {
+      lines.push(`MTU = ${opts.mtu}`);
+    }
+
+    lines.push('');
+    lines.push('[Peer]');
+    lines.push(`PublicKey = ${opts.peer.publicKey}`);
+    if (opts.peer.presharedKey) {
+      lines.push(`PresharedKey = ${opts.peer.presharedKey}`);
+    }
+    lines.push(`Endpoint = ${opts.peer.endpoint}`);
+    lines.push(`AllowedIPs = ${opts.peer.allowedIps.join(', ')}`);
+    if (opts.peer.persistentKeepalive) {
+      lines.push(`PersistentKeepalive = ${opts.peer.persistentKeepalive}`);
+    }
+
+    lines.push('');
+    return lines.join('\n');
+  }
+
+  /**
+   * Generate a server .conf file content.
+   */
+  public static generateServerConfig(opts: IWgServerConfOptions): string {
+    const lines: string[] = [];
+
+    lines.push('[Interface]');
+    lines.push(`PrivateKey = ${opts.privateKey}`);
+    lines.push(`Address = ${opts.address}`);
+    lines.push(`ListenPort = ${opts.listenPort}`);
+    if (opts.dns && opts.dns.length > 0) {
+      lines.push(`DNS = ${opts.dns.join(', ')}`);
+    }
+    if (opts.mtu) {
+      lines.push(`MTU = ${opts.mtu}`);
+    }
+    if (opts.enableNat) {
+      const iface = opts.natInterface || 'eth0';
+      lines.push(`PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o ${iface} -j MASQUERADE`);
+      lines.push(`PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o ${iface} -j MASQUERADE`);
+    }
+
+    for (const peer of opts.peers) {
+      lines.push('');
+      lines.push('[Peer]');
+      lines.push(`PublicKey = ${peer.publicKey}`);
+      if (peer.presharedKey) {
+        lines.push(`PresharedKey = ${peer.presharedKey}`);
+      }
+      lines.push(`AllowedIPs = ${peer.allowedIps.join(', ')}`);
+      if (peer.endpoint) {
+        lines.push(`Endpoint = ${peer.endpoint}`);
+      }
+      if (peer.persistentKeepalive) {
+        lines.push(`PersistentKeepalive = ${peer.persistentKeepalive}`);
+      }
+    }
+
+    lines.push('');
+    return lines.join('\n');
+  }
+}

package/ts/smartvpn.interfaces.ts

@@ -32,10 +32,24 @@ export interface IVpnClientConfig {
   mtu?: number;
   /** Keepalive interval in seconds (default: 30) */
   keepaliveIntervalSecs?: number;
-  /** Transport protocol: 'auto' (default, tries QUIC then WS), 'websocket', or 'quic' */
-  transport?: 'auto' | 'websocket' | 'quic';
+  /** Transport protocol: 'auto' (default, tries QUIC then WS), 'websocket', 'quic', or 'wireguard' */
+  transport?: 'auto' | 'websocket' | 'quic' | 'wireguard';
   /** For QUIC: SHA-256 hash of server certificate (base64) for cert pinning */
   serverCertHash?: string;
+  /** WireGuard: client private key (base64, X25519) */
+  wgPrivateKey?: string;
+  /** WireGuard: client TUN address (e.g. 10.8.0.2) */
+  wgAddress?: string;
+  /** WireGuard: client TUN address prefix length (default: 24) */
+  wgAddressPrefix?: number;
+  /** WireGuard: preshared key (base64, optional) */
+  wgPresharedKey?: string;
+  /** WireGuard: persistent keepalive interval in seconds */
+  wgPersistentKeepalive?: number;
+  /** WireGuard: server endpoint (host:port, e.g. vpn.example.com:51820) */
+  wgEndpoint?: string;
+  /** WireGuard: allowed IPs (CIDR strings, e.g. ['0.0.0.0/0']) */
+  wgAllowedIps?: string[];
 }
 
 export interface IVpnClientOptions {
@@ -72,12 +86,16 @@ export interface IVpnServerConfig {
   defaultRateLimitBytesPerSec?: number;
   /** Default burst size for new clients (bytes). Omit for unlimited. */
   defaultBurstBytes?: number;
-  /** Transport mode: 'both' (default, WS+QUIC), 'websocket', or 'quic' */
-  transportMode?: 'websocket' | 'quic' | 'both';
+  /** Transport mode: 'both' (default, WS+QUIC), 'websocket', 'quic', or 'wireguard' */
+  transportMode?: 'websocket' | 'quic' | 'both' | 'wireguard';
   /** QUIC listen address (host:port). Defaults to listenAddr. */
   quicListenAddr?: string;
   /** QUIC idle timeout in seconds (default: 30) */
   quicIdleTimeoutSecs?: number;
+  /** WireGuard: UDP listen port (default: 51820) */
+  wgListenPort?: number;
+  /** WireGuard: configured peers */
+  wgPeers?: IWgPeerConfig[];
 }
 
 export interface IVpnServerOptions {
@@ -187,6 +205,35 @@ export interface IVpnClientTelemetry {
   burstBytes?: number;
 }
 
+// ============================================================================
+// WireGuard-specific types
+// ============================================================================
+
+export interface IWgPeerConfig {
+  /** Peer's public key (base64, X25519) */
+  publicKey: string;
+  /** Optional preshared key (base64) */
+  presharedKey?: string;
+  /** Allowed IP ranges (CIDR strings) */
+  allowedIps: string[];
+  /** Peer endpoint (host:port) — optional for server peers, required for client */
+  endpoint?: string;
+  /** Persistent keepalive interval in seconds */
+  persistentKeepalive?: number;
+}
+
+export interface IWgPeerInfo {
+  publicKey: string;
+  allowedIps: string[];
+  endpoint?: string;
+  persistentKeepalive?: number;
+  bytesSent: number;
+  bytesReceived: number;
+  packetsSent: number;
+  packetsReceived: number;
+  lastHandshakeTime?: string;
+}
+
 // ============================================================================
 // IPC Command maps (used by smartrust RustBridge<TCommands>)
 // ============================================================================
@@ -211,6 +258,10 @@ export type TVpnServerCommands = {
   setClientRateLimit: { params: { clientId: string; rateBytesPerSec: number; burstBytes: number }; result: void };
   removeClientRateLimit: { params: { clientId: string }; result: void };
   getClientTelemetry: { params: { clientId: string }; result: IVpnClientTelemetry };
+  generateWgKeypair: { params: Record<string, never>; result: IVpnKeypair };
+  addWgPeer: { params: { peer: IWgPeerConfig }; result: void };
+  removeWgPeer: { params: { publicKey: string }; result: void };
+  listWgPeers: { params: Record<string, never>; result: { peers: IWgPeerInfo[] } };
 };
 
 // ============================================================================