tunnel

type Backend interface {
	// ListInterfaces returns the names of interfaces visible to the backend.
	ListInterfaces(ctx context.Context) ([]string, error)
	// CreateInterface brings up a new interface with the given spec (link
	// + config, no peers).
	CreateInterface(ctx context.Context, spec InterfaceSpec) error
	// RemoveInterface tears down and removes the interface.
	RemoveInterface(ctx context.Context, name string) error
	// ApplyInterfaceConfig fully replaces the interface configuration
	// (setconf semantics; active handshakes may reset).
	ApplyInterfaceConfig(ctx context.Context, name string, cfg InterfaceConfig) error
	// SyncPeers diff-applies the peer list without disturbing the interface
	// (syncconf semantics; active sessions survive).
	SyncPeers(ctx context.Context, name string, peers []PeerConfig) error
	// Dump returns the observed state (stats + handshakes + config snapshot).
	Dump(ctx context.Context, name string) (InterfaceState, error)
}

type InterfaceConfig struct {
	PrivateKey  string
	ListenPort  int
	Fwmark      string
	Obfuscation Obfuscation
	Peers       []PeerConfig
}

type InterfaceSpec struct {
	Name        string
	BackendMode string // kernel (default) or userspace
	PrivateKey  string // base64
	ListenPort  int
	Fwmark      string // "" = off
	MTU         int
	Address     string   // interface gateway CIDR, e.g. "10.8.0.1/24"
	Addresses   []string // all managed gateway CIDRs; Address is the primary
	Obfuscation Obfuscation
}

type InterfaceState struct {
	Name        string
	BackendMode string // observed mode when the real backend can identify it
	PublicKey   string
	ListenPort  int
	Obfuscation Obfuscation
	Peers       []PeerState
}

type KeyPair struct {
	Private string // base64, 32 bytes
	Public  string // base64, 32 bytes
}

type Obfuscation struct {
	Enabled            bool
	Jc                 int
	Jmin, Jmax         int
	S1, S2             int
	H1, H2, H3, H4     awgparam.U32Range
	I1, I2, I3, I4, I5 string // hex blobs, "" = unset (client-side only params)

	S3, S4                 int               // plain u16 when set
	HeaderProtectionKey    string            // base64 32-byte key, "" = disabled
	ContentPaddingAddition awgparam.U16Range // zero = disabled
	RekeyAfterTime         awgparam.U16Range // zero = upstream default
	RekeyTimeout           awgparam.U16Range
	RejectAfterTime        awgparam.U16Range
	KeepaliveTimeout       awgparam.U16Range
	MaxHandshakeAttempts   awgparam.U16Range
	RandomTrailers         bool // rendered as "on" (upstream panic history — default off)
	DisableCookies         bool // rendered as "on" (security implications — default off)
}

type PeerConfig struct {
	PublicKey           string // base64
	PresharedKey        string // base64, "" = none
	AllowedIPs          []string
	Endpoint            string            // host:port, "" = none (server side: usually unset)
	PersistentKeepalive awgparam.U16Range // zero = off
}

type PeerState struct {
	PublicKey           string
	PresharedKeySet     bool
	Endpoint            string
	AllowedIPs          []string
	LastHandshake       time.Time // zero = never
	RXBytes             uint64
	TXBytes             uint64
	PersistentKeepalive awgparam.U16Range
}