feat(vpn): WireGuard-Server — Kunden waehlen sich per UDP 443 ein, ein Verteiler fuer alle
Einstellungen → VPN → WireGuard → Server: Einwahl anlegen (Name, Kundennetz, LAN-IP der FritzBox); ARIA erzeugt beide Schluesselpaare + PSK, ⬇ liefert die Datei fuer die Gegenseite (FritzBox-Netzwerk-Kopplung oder Standard-WireGuard). Jede Einwahl = eigener VPN-Satellit-Container mit fester IP im Netz aria-vpn (10.213.213.0/24, ausserhalb von Dockers Pools). Neuer Verteiler (satellite/vpn_relay.py, aria-vpn-relay, Host-Netz, VPN_RELAY_PORT 51820): ordnet jedes Paket per WireGuard-mac1 bzw. Sitzungsnummer dem richtigen Container zu, ohne zu entschluesseln; Fremdes wird still verworfen. Anleitung NPM-Stream / ohne Nginx / ufw im ℹ des Server-Reiters und im satellite/README. Lokal Ende-zu-Ende getestet: zwei Kunden mit demselben Netz 192.168.178.0/24 gleichzeitig ueber einen Port, jeder erreicht nur sein eigenes LAN; kein Weg Kunde → ARIA, Kunde 1 → Einwahl 2, Container → Internet; fremder Schluessel und Muell am Verteiler ohne Antwort. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5.5
+128
-3
@@ -14,6 +14,11 @@
|
||||
// /data/vpn/<id>/tunnel/events.jsonl verbunden/getrennt/… (Log, rotiert hier)
|
||||
// /data/vpn/<id>/data/ Satelliten-Daten (Zugangsdaten, Namen, …)
|
||||
//
|
||||
// Server-Verbindungen (Kunde waehlt sich ein, z.B. FritzBox): ARIA erzeugt
|
||||
// beide Schluesselpaare + PSK, der Container lauscht auf 51820 mit fester IP
|
||||
// im Netz aria-vpn; der Verteiler (satellite/vpn_relay.py, UDP-Port fuer
|
||||
// alle) ordnet die Pakete per mac1 zu und liest dafuer /data/vpn/relay.json.
|
||||
//
|
||||
// An = Container mit restart unless-stopped (nach Neustart wieder da).
|
||||
// Aus = Container weg, Dateien bleiben — Kundennetze nur bei Bedarf.
|
||||
|
||||
@@ -27,6 +32,15 @@ const IMAGE = process.env.VPN_IMAGE || "aria-vpn-satellite:latest";
|
||||
const NETWORK = "aria-vpn";
|
||||
const SELF = process.env.DIAG_CONTAINER || "aria-diagnostic";
|
||||
const PREFIX = "aria-vpn-";
|
||||
// Netz der VPN-Container: dynamische IPs (Clients) aus der unteren Haelfte,
|
||||
// Server-Verbindungen bekommen feste IPs aus der oberen (.128 + n), damit der
|
||||
// Verteiler sie auch nach einem Neustart findet.
|
||||
// Bewusst ausserhalb von Dockers eigenen Pools (172.17–31.x, 192.168.x),
|
||||
// sonst kollidiert es mit automatisch angelegten Compose-Netzen.
|
||||
const SUBNET = process.env.VPN_SUBNET || "10.213.213.0/24";
|
||||
const SUBNET_BASE = SUBNET.split("/")[0].split(".").slice(0, 3).join(".");
|
||||
const SERVER_PORT = 51820; // WireGuard im Server-Container
|
||||
const TUNNEL_NET = (n) => `10.222.${n}`; // je Server-Verbindung ein /24
|
||||
|
||||
function docker(method, apiPath, body) {
|
||||
return new Promise((resolve, reject) => {
|
||||
@@ -121,6 +135,7 @@ async function ensureNetwork() {
|
||||
const c = await docker("POST", "/networks/create", {
|
||||
Name: NETWORK, Driver: "bridge",
|
||||
Options: { "com.docker.network.bridge.enable_icc": "false" },
|
||||
IPAM: { Config: [{ Subnet: SUBNET, IPRange: `${SUBNET_BASE}.0/25`, Gateway: `${SUBNET_BASE}.1` }] },
|
||||
Labels: { "aria.vpn": "1" },
|
||||
});
|
||||
if (c.status >= 300) throw new Error(`Netz ${NETWORK} anlegen: ${JSON.stringify(c.json).slice(0, 200)}`);
|
||||
@@ -158,6 +173,8 @@ async function startContainer(conn, rvs) {
|
||||
NetworkMode: NETWORK,
|
||||
LogConfig: { Type: "json-file", Config: { "max-size": "5m", "max-file": "2" } },
|
||||
},
|
||||
...(conn.kind === "server" ? { NetworkingConfig: { EndpointsConfig: {
|
||||
[NETWORK]: { IPAMConfig: { IPv4Address: serverIp(conn) } } } } } : {}),
|
||||
});
|
||||
if (c.status >= 300) throw new Error(`Container anlegen: ${JSON.stringify(c.json).slice(0, 300)}`);
|
||||
const s = await docker("POST", `/containers/${PREFIX}${conn.id}/start`);
|
||||
@@ -185,6 +202,105 @@ async function containerLogs(id, lines = 60) {
|
||||
return out.join("");
|
||||
}
|
||||
|
||||
// ── Server-Verbindungen ─────────────────────────────────────────
|
||||
function wgKeypair() {
|
||||
const { publicKey, privateKey } = crypto.generateKeyPairSync("x25519");
|
||||
return {
|
||||
priv: privateKey.export({ format: "der", type: "pkcs8" }).slice(-32).toString("base64"),
|
||||
pub: publicKey.export({ format: "der", type: "spki" }).slice(-32).toString("base64"),
|
||||
};
|
||||
}
|
||||
const serverIp = (conn) => `${SUBNET_BASE}.${128 + conn.n}`;
|
||||
const keysFile = (id) => path.join(tunnelDir(id), "keys.json");
|
||||
|
||||
function parseLan(v) {
|
||||
const nets = String(v || "").split(/[\s,]+/).filter(Boolean);
|
||||
if (!nets.length) throw new Error("Kundennetz fehlt (z.B. 192.168.178.0/24).");
|
||||
for (const n of nets) {
|
||||
const m = n.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\/(\d{1,2})$/);
|
||||
if (!m || m.slice(1, 5).some((x) => +x > 255) || +m[5] < 8 || +m[5] > 32) {
|
||||
throw new Error(`Kundennetz „${n}" ist kein Netz wie 192.168.178.0/24.`);
|
||||
}
|
||||
}
|
||||
return nets;
|
||||
}
|
||||
|
||||
// Server-seitige wg.conf (im Container): lauscht, Gegenseite = Kunde
|
||||
function serverConf(conn, k) {
|
||||
const t = TUNNEL_NET(conn.n);
|
||||
return ["[Interface]", `PrivateKey = ${k.srvPriv}`, `ListenPort = ${SERVER_PORT}`, `Address = ${t}.1/24`, "",
|
||||
"[Peer]", `PublicKey = ${k.peerPub}`, `PresharedKey = ${k.psk}`,
|
||||
`AllowedIPs = ${[`${t}.2/32`, ...conn.lan].join(", ")}`, ""].join("\n");
|
||||
}
|
||||
|
||||
// Datei fuer die Gegenseite. FritzBox (Netzwerk-Kopplung): Address = eigene
|
||||
// LAN-Adresse der Box, AllowedIPs = unser Netz (kein 0.0.0.0/0 — lehnt die
|
||||
// Box ab). Standard: eigene Tunnel-Adresse, die Gegenseite muss ihr LAN dann
|
||||
// selbst routen/maskieren.
|
||||
function peerProfile(conn, k, type, rvs) {
|
||||
const t = TUNNEL_NET(conn.n);
|
||||
const lan0 = conn.lan[0];
|
||||
const prefix = lan0.split("/")[1];
|
||||
const addr = type === "fritz" ? `${conn.routerIp}/${prefix}` : `${t}.2/24`;
|
||||
return [`# ARIA VPN-Satellit „${conn.name}" — ${type === "fritz" ? "für FRITZ!Box (Netzwerk-Kopplung)" : "Standard-WireGuard"}`,
|
||||
"[Interface]", `PrivateKey = ${k.peerPriv}`, `Address = ${addr}`, "",
|
||||
"[Peer]", `PublicKey = ${k.srvPub}`, `PresharedKey = ${k.psk}`,
|
||||
`AllowedIPs = ${t}.0/24`, `Endpoint = ${rvs.host}:${rvs.publicPort || 443}`,
|
||||
"PersistentKeepalive = 25", ""].join("\n");
|
||||
}
|
||||
|
||||
function writeRelayMap() {
|
||||
const rows = [];
|
||||
for (const c of loadConns()) {
|
||||
if (c.kind !== "server" || !c.enabled) continue;
|
||||
const k = readJson(keysFile(c.id), null);
|
||||
if (k) rows.push({ id: c.id, ip: serverIp(c), port: SERVER_PORT, pub: k.srvPub });
|
||||
}
|
||||
writeJson(path.join(DIR, "relay.json"), rows, 0o644);
|
||||
}
|
||||
|
||||
async function saveServer(msg, rvs) {
|
||||
const name = String(msg.name || "").trim().slice(0, 60);
|
||||
if (!name) throw new Error("Name fehlt.");
|
||||
const lan = parseLan(msg.lan);
|
||||
const routerIp = String(msg.routerIp || "").trim() ||
|
||||
lan[0].split("/")[0].replace(/\.\d+$/, ".1");
|
||||
if (!/^\d{1,3}(\.\d{1,3}){3}$/.test(routerIp)) throw new Error("Router-IP ist keine IP-Adresse.");
|
||||
const conns = loadConns();
|
||||
let conn = msg.id ? conns.find((c) => c.id === msg.id) : null;
|
||||
if (!conn) {
|
||||
const used = new Set(conns.filter((c) => c.kind === "server").map((c) => c.n));
|
||||
let n = 1;
|
||||
while (used.has(n)) n++;
|
||||
if (n > 126) throw new Error("Höchstens 126 Server-Verbindungen.");
|
||||
conn = { id: crypto.randomBytes(4).toString("hex"), kind: "server", n, enabled: false, createdAt: Date.now() };
|
||||
conns.push(conn);
|
||||
}
|
||||
const scanNets = String(msg.scanNets || "").split(/[\s,]+/).filter(Boolean).join(",") || lan.join(",");
|
||||
Object.assign(conn, { name, lan, routerIp, scanNets, updatedAt: Date.now() });
|
||||
fs.mkdirSync(tunnelDir(conn.id), { recursive: true });
|
||||
let k = readJson(keysFile(conn.id), null);
|
||||
if (!k) {
|
||||
const s = wgKeypair(); const p = wgKeypair();
|
||||
k = { srvPriv: s.priv, srvPub: s.pub, peerPriv: p.priv, peerPub: p.pub,
|
||||
psk: crypto.randomBytes(32).toString("base64") };
|
||||
writeJson(keysFile(conn.id), k);
|
||||
}
|
||||
fs.writeFileSync(path.join(tunnelDir(conn.id), "wg.conf"), serverConf(conn, k), { mode: 0o600 });
|
||||
saveConns(conns);
|
||||
if (conn.enabled) await startContainer(conn, rvs);
|
||||
writeRelayMap();
|
||||
return { id: conn.id };
|
||||
}
|
||||
|
||||
function profile(id, type, rvs) {
|
||||
const conn = loadConns().find((c) => c.id === id);
|
||||
if (!conn || conn.kind !== "server") throw new Error("Server-Verbindung unbekannt.");
|
||||
const k = readJson(keysFile(id), null);
|
||||
if (!k) throw new Error("Schlüssel fehlen.");
|
||||
return { name: conn.name, type, conf: peerProfile(conn, k, type, rvs) };
|
||||
}
|
||||
|
||||
// ── API (vom ws-Handler in server.js) ───────────────────────────
|
||||
async function list() {
|
||||
const conns = loadConns();
|
||||
@@ -197,6 +313,9 @@ async function list() {
|
||||
}
|
||||
|
||||
async function save(msg, rvs) {
|
||||
if ((msg.kind || "") === "server" || (msg.id && (loadConns().find((c) => c.id === msg.id) || {}).kind === "server")) {
|
||||
return saveServer(msg, rvs);
|
||||
}
|
||||
const name = String(msg.name || "").trim().slice(0, 60);
|
||||
const conf = String(msg.conf || "").replace(/\r\n/g, "\n").trim() + "\n";
|
||||
if (!name) throw new Error("Name fehlt.");
|
||||
@@ -224,8 +343,12 @@ async function toggle(id, enabled, rvs) {
|
||||
if (!conn) throw new Error("Verbindung unbekannt.");
|
||||
conn.enabled = !!enabled;
|
||||
saveConns(conns);
|
||||
if (conn.enabled) await startContainer(conn, rvs);
|
||||
else await removeContainer(id);
|
||||
try {
|
||||
if (conn.enabled) await startContainer(conn, rvs);
|
||||
else await removeContainer(id);
|
||||
} finally {
|
||||
writeRelayMap();
|
||||
}
|
||||
return { id, enabled: conn.enabled };
|
||||
}
|
||||
|
||||
@@ -235,12 +358,14 @@ async function remove(id) {
|
||||
await removeContainer(id);
|
||||
saveConns(conns.filter((c) => c.id !== id));
|
||||
fs.rmSync(path.join(DIR, id), { recursive: true, force: true });
|
||||
writeRelayMap();
|
||||
return { id };
|
||||
}
|
||||
|
||||
function getConf(id) {
|
||||
const conn = loadConns().find((c) => c.id === id);
|
||||
if (!conn) throw new Error("Verbindung unbekannt.");
|
||||
if (conn.kind === "server") return { ...conn }; // Schluessel bleiben auf ARIA
|
||||
return { ...conn, conf: fs.readFileSync(path.join(tunnelDir(id), "wg.conf"), "utf8") };
|
||||
}
|
||||
|
||||
@@ -279,4 +404,4 @@ function rotate() {
|
||||
}
|
||||
setInterval(rotate, 3600 * 1000).unref();
|
||||
|
||||
module.exports = { list, save, toggle, remove, getConf, info, setSettings, checkConf };
|
||||
module.exports = { list, save, toggle, remove, getConf, info, setSettings, checkConf, profile, writeRelayMap };
|
||||
|
||||
Reference in New Issue
Block a user