fix: spec validation refuses this node's own key as a peer #71

Merged

marcos-mendez merged 1 commit from fix/overlay-peer-not-this-node into main

2026-10-03 09:30:44 -03:00

marcos-mendez commented

2026-10-03 09:26:45 -03:00

(Migrated from github.com)

On keel-web-2 (2026-10-03) the operator entered the node's own public key, shown at the top of confconsole's overlay screen, as a peer, and keel spec validate accepted it.

validate_overlay now refuses a peer whose public_key is this node's own. The node's key is the public key of the private key file (private_key.file, else /etc/wireguard/<interface>.key), read with wgkeys.public exactly as keel network wireguard key reads it. Because that reads a secret file, the check runs only when secret files are checked (--no-secret-files skips it, as it skips the key file's mode check). No key file yet means apply will make a fresh key, which no peer can hold, so nothing is read; a file wg cannot read (or no wg where the spec is validated) leaves the check to the converging run.

confconsole's overlay screen refuses the same thing before it stages the description (it validates with --no-secret-files), in Keel-Linux/confconsole's companion PR.

keel 0.15.4. Tests: tests/test_spec_overlay.py::TestNotItsOwnPeer, one of them with the real wg (wireguard-tools is installed in CI).

On keel-web-2 (2026-10-03) the operator entered the node's own public key, shown at the top of confconsole's overlay screen, as a peer, and `keel spec validate` accepted it. `validate_overlay` now refuses a peer whose `public_key` is this node's own. The node's key is the public key of the private key file (`private_key.file`, else `/etc/wireguard/<interface>.key`), read with `wgkeys.public` exactly as `keel network wireguard key` reads it. Because that reads a secret file, the check runs only when secret files are checked (`--no-secret-files` skips it, as it skips the key file's mode check). No key file yet means apply will make a fresh key, which no peer can hold, so nothing is read; a file wg cannot read (or no wg where the spec is validated) leaves the check to the converging run. confconsole's overlay screen refuses the same thing before it stages the description (it validates with `--no-secret-files`), in Keel-Linux/confconsole's companion PR. keel 0.15.4. Tests: `tests/test_spec_overlay.py::TestNotItsOwnPeer`, one of them with the real wg (wireguard-tools is installed in CI).