cluster: fix wg1.conf generator

Signed-off-by: Nagy Károly Gábriel <k@jpi.io>

cmd/jpictl/list.go

@@ -108,7 +108,7 @@ func (*inventory) renderRingOneZone(out *tools.LazyBuffer, r *cluster.Region, z
 	z.ForEachMachine(func(m *cluster.Machine) bool {
 		addr := m.RingOneAddress()
 		cidr := netip.PrefixFrom(addr, 32)
-		_ = out.Printf("%s\t\t%s\n", cidr, m.Name)
+		_ = out.Printf("%s\t\t%s-%v\n", cidr, m.Name, 1)
 		return false
 	})
 	return nil

pkg/cluster/errors.go

@@ -25,5 +25,5 @@ var (
 // ErrInvalidRing returns an error indicating the [rings.RingID]
 // can't be used for the intended purpose
 func ErrInvalidRing(ringID rings.RingID) error {
-	return core.QuietWrap(fs.ErrInvalid, "invalid ring %v", ringID-1)
+	return core.QuietWrap(fs.ErrInvalid, "invalid ring %v", ringID)
 }

pkg/cluster/rings.go

@@ -6,6 +6,7 @@ import (
 	"net/netip"
 	"strconv"
 
+	"darvaza.org/core"
 	"git.jpi.io/amery/jpictl/pkg/rings"
 	"git.jpi.io/amery/jpictl/pkg/wireguard"
 )
@@ -27,6 +28,8 @@ func AsWireguardInterfaceID(ring rings.RingID) (WireguardInterfaceID, error) {
 	switch ring {
 	case rings.RingZeroID:
 		return 0, nil
+	case rings.RingOneID:
+		return 1, nil
 	default:
 		return 0, ErrInvalidRing(ring)
 	}
@@ -146,9 +149,17 @@ var (
 		Decode: rings.DecodeRingZeroAddress,
 		Encode: rings.RingZeroAddress,
 	}
+	// RingOne is a wg1 address encoder/decoder
+	RingOne = RingAddressEncoder{
+		ID:     rings.RingOneID,
+		Port:   RingOnePort,
+		Decode: rings.DecodeRingOneAddress,
+		Encode: rings.RingOneAddress,
+	}
 	// Rings provides indexed access to the ring address encoders
 	Rings = []RingAddressEncoder{
 		RingZero,
+		RingOne,
 	}
 )
 
@@ -191,17 +202,72 @@ func (r *Ring) AddPeer(p *Machine) bool {
 		},
 	}
 
-	r.setRingZeroAllowedIPs(rp)
+	switch {
+	case r.ID == rings.RingZeroID:
+		r.setRingZeroAllowedIPs(rp)
+	case p.IsGateway():
+		r.setRingOneGatewayAllowedIPs(rp)
+	default:
+		r.setRingOneNodeAllowedIPs(rp)
+	}
+
 	r.Peers = append(r.Peers, rp)
 	return true
 }
 
-func (*Ring) setRingZeroAllowedIPs(rp *RingPeer) {
-	// ring0 peer
+func (r *Ring) setRingZeroAllowedIPs(rp *RingPeer) {
+	regionID, zoneID, _, _ := r.Decode(rp.Address)
+
+	// everyone on ring0 is a gateway to ring1
+	subnet, _ := rings.RingOnePrefix(regionID, zoneID)
+	rp.AllowSubnet(subnet)
+
+	// peer
+	rp.AllowCIDR(rp.Address, 32)
+}
+
+// revive:disable:cognitive-complexity
+func (r *Ring) setRingOneGatewayAllowedIPs(rp *RingPeer) {
+	// revive:enable:cognitive-complexity
+	regionID, zoneID, _, _ := r.Decode(rp.Address)
+
+	// peer
 	rp.AllowCIDR(rp.Address, 32)
 
-	// everyone on ring0 has a leg on ring1
-	rp.AllowCIDR(rp.Node.RingOneAddress(), 32)
+	// ring1 gateways connect to all other ring1 networks
+	m, ok := r.ZoneIterator.(RegionIterator)
+	if !ok {
+		panic("Cannot iterate Region from Zone")
+	}
+	m.ForEachRegion(func(r2 *Region) bool {
+		if r2.IsPrimary() {
+			r.ForEachZone(func(z *Zone) bool {
+				if !z.Is(regionID, zoneID) {
+					subnet := z.RingOnePrefix()
+					rp.AllowSubnet(subnet)
+				}
+				return false
+			})
+		}
+		return false
+	})
+
+	// ring1 gateways also connect to all ring0 addresses
+	r.ForEachZone(func(z *Zone) bool {
+		z.ForEachMachine(func(p *Machine) bool {
+			if p.IsGateway() {
+				addr, _ := p.RingZeroAddress()
+				rp.AllowCIDR(addr, 32)
+			}
+			return false
+		})
+		return false
+	})
+}
+
+func (*Ring) setRingOneNodeAllowedIPs(rp *RingPeer) {
+	// only to the peer itself
+	rp.AllowCIDR(rp.Address, 32)
 }
 
 // ForEachMachine calls a function for each Machine in the ring
@@ -262,7 +328,9 @@ func (rp *RingPeer) AllowCIDR(addr netip.Addr, bits int) {
 
 // AllowSubnet allows an IP range via this peer
 func (rp *RingPeer) AllowSubnet(subnet netip.Prefix) {
-	rp.PeerConfig.AllowedIPs = append(rp.PeerConfig.AllowedIPs, subnet)
+	if !core.SliceContains(rp.PeerConfig.AllowedIPs, subnet) {
+		rp.PeerConfig.AllowedIPs = append(rp.PeerConfig.AllowedIPs, subnet)
+	}
 }
 
 // NewRing composes a new Ring for Wireguard setup

pkg/cluster/wireguard.go

@@ -82,6 +82,13 @@ func (m *Cluster) WriteWireguardConfig(ring rings.RingID) error {
 	switch ring {
 	case rings.RingZeroID:
 		return writeWireguardConfig(m, m, ring)
+	case rings.RingOneID:
+		var err error
+		m.ForEachZone(func(z *Zone) bool {
+			err = writeWireguardConfig(m, z, ring)
+			return err != nil
+		})
+		return err
 	default:
 		return ErrInvalidRing(ring)
 	}
@@ -93,6 +100,8 @@ func (z *Zone) WriteWireguardConfig(ring rings.RingID) error {
 	switch ring {
 	case rings.RingZeroID:
 		return writeWireguardConfig(z.zones, z.zones, ring)
+	case rings.RingOneID:
+		return writeWireguardConfig(z.zones, z, ring)
 	default:
 		return ErrInvalidRing(ring)
 	}
@@ -156,6 +165,13 @@ func (m *Cluster) SyncWireguardConfig(ring rings.RingID) error {
 	switch ring {
 	case rings.RingZeroID:
 		return syncWireguardConfig(m, m, ring)
+	case rings.RingOneID:
+		var err error
+		m.ForEachZone(func(z *Zone) bool {
+			err = syncWireguardConfig(m, z, ring)
+			return err != nil
+		})
+		return err
 	default:
 		return ErrInvalidRing(ring)
 	}
@@ -167,6 +183,8 @@ func (z *Zone) SyncWireguardConfig(ring rings.RingID) error {
 	switch ring {
 	case rings.RingZeroID:
 		return syncWireguardConfig(z.zones, z.zones, ring)
+	case rings.RingOneID:
+		return syncWireguardConfig(z.zones, z, ring)
 	default:
 		return ErrInvalidRing(ring)
 	}