halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions 1

fix(deploy): home's tunnel rules loaded by systemd, outside wg-quick's AppArmor profile (ADR 0039, D9)

Browse source 
Ubuntu 26.04 confines wg-quick in an AppArmor profile whose nft sub-profile
may read nothing in /etc/wireguard, so the tunnel failed to come up at home.
The unit's drop-in (wg-quick-halkyon.conf, before-docker.conf before) loads
the rules before the interface exists and deletes them after it is gone, so
the tunnel never runs without them. ramiel, on 24.04, keeps PostUp.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-11-08 20:45:46 +01:00
commit 3f6581d6e2
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 54 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

27
test/deploy/halkyon_li_forward_test.dart
View file

@ -222,9 +222,30 @@ void main() {
]);
});
test('comes up before Docker, which publishes on its address', () {
final dropIn = read('deploy/host/wg-quick-before-docker.conf');
expect(dropIn, contains('Before=docker.service'));
group("wg-quick's unit", () {
final dropIn = read('deploy/host/wg-quick-halkyon.conf');
test('comes up before Docker, which publishes on its address', () {
expect(dropIn, contains('Before=docker.service'));
});
test('loads the rules before the tunnel exists and deletes them after '
"it is gone, outside wg-quick's AppArmor profile, which lets nft "
'read nothing in /etc/wireguard (Ubuntu 26.04)', () {
expect(
dropIn,
contains(
'ExecStartPre=/usr/sbin/nft -f /etc/wireguard/wg-halkyon.nft',
),
);
expect(
dropIn,
contains(
'ExecStopPost=-/usr/sbin/nft delete table inet halkyon_tunnel',
),
);
expect(config, isNot(contains('nft')));
});
});
test('lets sshd take keys alone, for two users alone', () {