[PATCH pve-network 1/3] sdn: add wireguard helper module

Stefan Hanreich
2026-02-19T14:56:18Z

From: Christoph Heiss <c.heiss@proxmox.com>

A new module that contains helper functions for dealing with WireGuard
config and key generation. They are later used in the API methods, as
well as the SDN commit_config.

Co-authored-by: Stefan Hanreich <s.hanreich@proxmox.com>
Signed-off-by: Christoph Heiss <c.heiss@proxmox.com>
---
src/PVE/Network/SDN/Makefile | 15 ++-
src/PVE/Network/SDN/WireGuard.pm | 163 +++++++++++++++++++++++++++++++
2 files changed, 177 insertions(+), 1 deletion(-)
create mode 100644 src/PVE/Network/SDN/WireGuard.pm

diff --git a/src/PVE/Network/SDN/Makefile b/src/PVE/Network/SDN/Makefile
index d1ffef9..90bfffa 100644
--- a/src/PVE/Network/SDN/Makefile
+++ b/src/PVE/Network/SDN/Makefile
@@ -1,4 +1,17 @@
-SOURCES=Vnets.pm VnetPlugin.pm Zones.pm Controllers.pm Subnets.pm SubnetPlugin.pm Ipams.pm Dns.pm Dhcp.pm Fabrics.pm Frr.pm
+SOURCES=\
+ Controllers.pm \
+ Dhcp.pm \
+ Dns.pm \
+ Fabrics.pm \
+ Frr.pm \
+ Ipams.pm \
+ RouteMap.pm \
+ SubnetPlugin.pm \
+ Subnets.pm \
+ VnetPlugin.pm \
+ Vnets.pm \
+ WireGuard.pm \
+ Zones.pm

PERL5DIR=${DESTDIR}/usr/share/perl5
diff --git a/src/PVE/Network/SDN/WireGuard.pm b/src/PVE/Network/SDN/WireGuard.pm
new file mode 100644
index 0000000..1db44db
--- /dev/null
+++ b/src/PVE/Network/SDN/WireGuard.pm
@@ -0,0 +1,163 @@
+package PVE::Network::SDN::WireGuard;
+
+use strict;
+use warnings;
+
+=head1 NAME
+
+C<PVE::Network::SDN::WireGuard> - Helper module for WireGuard
+
+=head1 DESCRIPTION
+
+This module contains helpers for handling and applying WireGuard configuration.
+
+=cut
+
+use File::Basename;
+
+use PVE::File;
+use PVE::INotify;
+use PVE::RESTEnvironment qw(log_warn);
+use PVE::Tools qw(file_get_contents file_set_contents run_command);
+
+use PVE::Network::SDN::Fabrics;
+
+my $local_wireguard_lock = "/var/lock/proxmox_wg.lock";
+my $wireguard_config_folder = "/etc/wireguard/proxmox";
+
+=head3 create_wireguard_keypair($interface_name)
+
+Creates a new WireGuard keypair on the current node. The keys are stored in the
+$wireguard_config_folder path as '${interface_name}.key' and
+'${interface_name}.key.pub' respectively.
+
+If the private key file already exists, then a warning is printed and the
+existing corresponding public key returned.
+
+=cut
+
+sub create_wireguard_keypair {
+ my ($interface_name) = @_;
+
+ my $code = sub {
+ mkdir("/etc/wireguard") if !-d '/etc/wireguard';
+ mkdir($wireguard_config_folder) if !-d $wireguard_config_folder;
+
+ my $private_key_file = "$wireguard_config_folder/${interface_name}.key";
+ my $public_key_file = "$wireguard_config_folder/${interface_name}.key.pub";
+
+ if (-e $private_key_file) {
+ warn
+ "trying to create keypair for interface $interface_name, but file already exists!\n";
+ return PVE::File::file_get_contents($public_key_file);
+ }
+
+ my $private_key = undef;
+ PVE::Tools::run_command(
+ ['wg', 'genkey'],
+ outfunc => sub {
+ $private_key = shift;
+ },
+ );
+
+ my $public_key = undef;
+ PVE::Tools::run_command(
+ ['wg', 'pubkey'],
+ input => $private_key,
+ outfunc => sub {
+ $public_key = shift;
+ },
+ );
+
+ PVE::File::file_set_contents($private_key_file, $private_key, 400);
+ PVE::File::file_set_contents($public_key_file, $public_key, 400);
+
+ return $public_key;
+ };
+
+ my $public_key = PVE::Tools::lock_file($local_wireguard_lock, 10, $code);
+ die $@ if $@;
+
+ return $public_key;
+}
+
+=head3 delete_wireguard_keypair($interface_name)
+
+Deletes the public / private key files for a given WireGuard interface with name
+$interface_name, if they exist in the filesystem. Otherwise a warning is printed
+and nothing deleted.
+
+=cut
+
+sub delete_wireguard_keypair {
+ my ($interface_name) = @_;
+
+ my $code = sub {
+ unlink "$wireguard_config_folder/${interface_name}.key"
+ if -e "$wireguard_config_folder/${interface_name}.key";
+
+ unlink "$wireguard_config_folder/${interface_name}.key.pub"
+ if -e "$wireguard_config_folder/${interface_name}.key.pub";
+ };
+
+ PVE::Tools::lock_file($local_wireguard_lock, 10, $code);
+ warn $@ if $@;
+}
+
+=head3 generate_wireguard_config($apply)
+
+Generates the WireGuard configuration files on the current node, based on the
+current running SDN configuration. If $apply is passed, then the WireGuard
+configuration will be applied via the syncconf command of wg(8).
+
+=cut
+
+sub generate_wireguard_config {
+ my ($apply) = @_;
+
+ my $fabric_config = PVE::Network::SDN::Fabrics::config(1);
+
+ my $nodename = PVE::INotify::nodename();
+ my $raw_config = $fabric_config->get_wireguard_raw_config($nodename);
+
+ if (!-e "/usr/bin/wg") {
+ warn
+ "In order to apply the generated WireGuard configuration the package 'wg-tools' needs to be installed.\n";
+ }
+
+ write_wireguard_config($raw_config, $apply);
+}
+
+=head3 write_wireguard_config($raw_config)
+
+Takes a raw_config of the following format:
+
+ interface_name => "<configuration>"
+
+and generates the respective configuration files in $wireguard_config_folder. If
+$apply is set, then the configuration will be synced via the syncconf command of
+wg(8). This requires the interfaces to exist on the node, otherwise the wg
+command will fail. A warning is emitted in that case.
+
+=cut
+
+sub write_wireguard_config {
+ my ($raw_config, $apply) = @_;
+
+ for my $interface (keys $raw_config->%*) {
+ PVE::File::file_set_contents(
+ "$wireguard_config_folder/$interface.conf",
+ $raw_config->{$interface},
+ 400,
+ );
+
+ if ($apply) {
+ eval {
+ PVE::Tools::run_command(
+ ['wg', 'syncconf', $interface, "/etc/wireguard/proxmox/$interface.conf"]);
+ };
+ warn $@ if $@;
+ }
+ }
+}
+
--
2.47.3