Ship wireguard-tools in the core layer for the overlay of decision 0020 #15

New issue

Closed

opened 2026-09-30 02:49:33 -03:00 by marcos-mendez · 0 comments

marcos-mendez commented

2026-09-30 02:49:33 -03:00

(Migrated from github.com)

The WireGuard overlay of handbook decision 0020 (step 2 of its order) is converged by keel spec apply --system from network.overlay.wireguard (Keel-Linux/keel, feat/wireguard-overlay). It needs wg and wg-quick on the appliance, and the core layer does not ship them: plan/main includes turnkey/base from common, whose plans have no wireguard-tools.

Every appliance can be a node of a replicated set, and 0020's first decision is that a standalone appliance has every feature one in Keel Cloud has, so the package belongs in core rather than in a stack layer. Debian 13 carries wireguard-tools 1.0.20210914-3 (measured in 0020); it is small (wg, wg-quick and the wg-quick@ unit) and pulls no daemon. The kernel module is in Debian's kernel; in an unprivileged container the host loads it, which keel reports and refuses with modprobe wireguard on the host (decision 0018).

Until the layer has it, keel refuses the overlay with "install wireguard-tools", and the keel package only Suggests: wireguard-tools.

What to do here:

add wireguard-tools to the core plan;
make sure no key is generated at build time: the key pair is made by keel on the machine at its first converge, never in an image (this repository's #8); /etc/wireguard should ship empty or absent;
leave wg-quick@* disabled in the image: keel enables it when an overlay change is confirmed.

The WireGuard overlay of handbook decision 0020 (step 2 of its order) is converged by `keel spec apply --system` from `network.overlay.wireguard` (Keel-Linux/keel, feat/wireguard-overlay). It needs `wg` and `wg-quick` on the appliance, and the core layer does not ship them: `plan/main` includes `turnkey/base` from common, whose plans have no `wireguard-tools`. Every appliance can be a node of a replicated set, and 0020's first decision is that a standalone appliance has every feature one in Keel Cloud has, so the package belongs in core rather than in a stack layer. Debian 13 carries `wireguard-tools` 1.0.20210914-3 (measured in 0020); it is small (`wg`, `wg-quick` and the `wg-quick@` unit) and pulls no daemon. The kernel module is in Debian's kernel; in an unprivileged container the host loads it, which keel reports and refuses with `modprobe wireguard` on the host (decision 0018). Until the layer has it, keel refuses the overlay with "install wireguard-tools", and the keel package only `Suggests: wireguard-tools`. What to do here: - add `wireguard-tools` to the core plan; - make sure no key is generated at build time: the key pair is made by keel on the machine at its first converge, never in an image (this repository's #8); `/etc/wireguard` should ship empty or absent; - leave `wg-quick@*` disabled in the image: keel enables it when an overlay change is confirmed.