Documentation
¶
Overview ¶
Package boot brings the node to the state described by the database — the single orchestration used at service start (`serve`) and on demand from the CLI (`wg-guard reconcile`). Sequence per docs/architecture/networking.md: verify tooling, enable IPv4 forwarding, reconcile tunnels and peers, apply the namespaced firewall table, restore speed limits (tc), and handle firewall-manager coexistence. Failures on essential steps (tooling, forwarding, reconcile, firewall, or a required scoped manager repair) abort bring-up; shaping and advisory coexistence findings do not.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Deps ¶
type Deps struct {
DB *database.DB
Ring *secrets.KeyRing
Settings *settings.Registry
Backend tunnel.Backend
Run subprocess.Runner
Audit *audit.Service
Shaper *shaper.Manager // nil = skip shaping (tests, minimal runs)
}
Deps wires the collaborators boot needs (owned by the caller so tests can substitute fakes).
type Result ¶
type Result struct {
ToolsVersion string
ToolsVersionMatchesPin bool
ForwardingChanged bool // net.ipv4.ip_forward was off and is now on
Reconcile *reconcile.Report
ManagedIfaces int
ShapedGroups int // (user, interface) pairs with speed limits
UfwRoutes []string // interfaces the ufw route rule was added for
Forwarding firewall.ForwardingStatus
Findings []firewall.Finding
}
Result reports what bring-up observed and changed. It carries no secret material and is safe to print or serialize.
type RuntimeReconciler ¶
type RuntimeReconciler struct {
Deps Deps
}
RuntimeReconciler is the canonical post-mutation reconciler. Unlike a bare reconcile.Engine it also refreshes forwarding, NAT, firewall-manager coexistence and shaping, so an interface created after process start is immediately usable as a routed tunnel.
func (*RuntimeReconciler) NetworkPolicyHealthy ¶
func (r *RuntimeReconciler) NetworkPolicyHealthy(ctx context.Context) (bool, error)
NetworkPolicyHealthy is a bounded read-only check for host firewall changes after startup (notably Docker rebuilding DOCKER-USER). The caller uses the canonical Run path to repair a missing owned path.
Source Files