provisioning-catalog/components/wireguard/cluster/wireguard-lib.sh

#!/bin/bash
# Methods library for wireguard — sourced by install-wireguard.sh
# SCRIPT_DIR and WG_NAMESPACE must be set by the caller before sourcing.

_kubectl() {
  if command -v kubectl >/dev/null 2>&1; then
    command kubectl "$@"
  elif command -v k0s >/dev/null 2>&1; then
    k0s kubectl "$@"
  else
    echo "ERROR: no kubectl or k0s binary found" >&2; exit 127
  fi
}

_require_env() {
  local var="$1"
  if [ -z "${!var:-}" ]; then
    echo "ERROR: required variable $var is not set" >&2; exit 1
  fi
}

_pod_name() {
  _kubectl get pod \
    --namespace "$WG_NAMESPACE" \
    --selector "app.kubernetes.io/name=wireguard" \
    -o jsonpath='{.items[0].metadata.name}' 2>/dev/null
}

_wait_for_pod() {
  local timeout="${1:-180}"
  _kubectl wait pod \
    --namespace "$WG_NAMESPACE" \
    --selector "app.kubernetes.io/name=wireguard" \
    --for=condition=Ready \
    --timeout="${timeout}s"
}

_plan_is_blank() {
  local path="$1"
  ! grep -q '[^[:space:]]' "$path"
}

_plan_apply() {
  local file="$1"
  local path="$SCRIPT_DIR/manifests/${file}.yaml"
  [ -f "$path" ] || { echo "  [skip] $file.yaml not in manifests/"; return 0; }
  if _plan_is_blank "$path"; then
    echo "  [skip] $file.yaml is empty (template inactive)"
    return 0
  fi
  _kubectl apply -f "$path"
}

_plan_apply_skip() {
  local file="$1"
  local path="$SCRIPT_DIR/manifests/${file}.yaml"
  [ -f "$path" ] || { echo "  [skip] $file.yaml not in manifests/"; return 0; }
  if _plan_is_blank "$path"; then
    echo "  [skip] $file.yaml is empty (template inactive)"
    return 0
  fi
  if _kubectl get -f "$path" >/dev/null 2>&1; then
    echo "  [skip] $file already exists in cluster"
    return 0
  fi
  _kubectl apply -f "$path"
}

_plan_rollout_restart() {
  local file="$1"
  local path="$SCRIPT_DIR/manifests/${file}.yaml"
  [ -f "$path" ] || { echo "  [skip] $file.yaml not in manifests/"; return 0; }
  if _plan_is_blank "$path"; then
    echo "  [skip] $file.yaml is empty (template inactive)"
    return 0
  fi
  _kubectl rollout restart -f "$path"
}

_plan_delete() {
  local file="$1"
  local path="$SCRIPT_DIR/manifests/${file}.yaml"
  [ -f "$path" ] || { echo "  [skip] $file.yaml not in manifests/"; return 0; }
  if _plan_is_blank "$path"; then
    echo "  [skip] $file.yaml is empty (template inactive)"
    return 0
  fi
  _kubectl delete -f "$path" --ignore-not-found
}

# ── Component methods ─────────────────────────────────────────────────────────

_method_bootstrap-keypair() {
  if _kubectl get secret wireguard-keys -n "$WG_NAMESPACE" >/dev/null 2>&1; then
    echo "  [skip] wireguard-keys secret already exists"
    return 0
  fi
  # Load credentials — WG_PRIVATE_KEY/WG_PUBLIC_KEY may be pre-provisioned in SOPS.
  [ -f "${SCRIPT_DIR}/_credentials.env" ] && set -a && source "${SCRIPT_DIR}/_credentials.env" && set +a
  local priv pub
  if [ -n "${WG_PRIVATE_KEY:-}" ]; then
    priv="$WG_PRIVATE_KEY"
    pub="${WG_PUBLIC_KEY:-$(echo "$priv" | wg pubkey)}"
    echo "  [ok] WireGuard keypair loaded from credentials"
  else
    if ! command -v wg >/dev/null 2>&1; then
      echo "ERROR: wireguard-tools not installed and no WG_PRIVATE_KEY in credentials" >&2
      echo "  Either: apt-get install -y wireguard-tools" >&2
      echo "  Or: add WG_PRIVATE_KEY/WG_PUBLIC_KEY to the SOPS secret" >&2
      exit 1
    fi
    priv=$(wg genkey)
    pub=$(echo "$priv" | wg pubkey)
    echo "  [ok] WireGuard keypair generated"
    echo "  ⚠  Store the private key in SOPS for disaster recovery:"
    echo "     WG_PRIVATE_KEY: $priv"
    echo "     WG_PUBLIC_KEY:  $pub"
  fi
  _kubectl create secret generic wireguard-keys \
    --namespace "$WG_NAMESPACE" \
    --from-literal=WG_PRIVATE_KEY="$priv" \
    --from-literal=WG_PUBLIC_KEY="$pub"
  echo "  Server public key: $pub"
}

_method_create-credentials() {
  [ -f "${SCRIPT_DIR}/_credentials.env" ] && set -a && source "${SCRIPT_DIR}/_credentials.env" && set +a
  _require_env PASSWORD_HASH
  _kubectl create secret generic wireguard-credentials \
    --namespace "$WG_NAMESPACE" \
    --from-literal=PASSWORD_HASH="$PASSWORD_HASH" \
    --dry-run=client -o yaml | _kubectl apply -f -
  echo "  [ok] wireguard-credentials secret applied (PASSWORD_HASH)"
}

_method_protect-volume() {
  local pvc="${PLAN_PARAM_PVC:-wireguard-data}"
  echo "  waiting for PVC '$pvc' to bind..."
  _kubectl wait pvc "$pvc" \
    --namespace "$WG_NAMESPACE" \
    --for=jsonpath='{.status.phase}'=Bound \
    --timeout=120s
  local pv_name
  pv_name=$(_kubectl get pvc "$pvc" \
    --namespace "$WG_NAMESPACE" \
    -o jsonpath='{.spec.volumeName}')
  if [ -z "$pv_name" ]; then
    echo "  [warn] could not resolve PV name for PVC '$pvc' — skipping volume protection"
    return 0
  fi
  echo "  enabling Hetzner delete-protection on volume '$pv_name'..."
  if command -v hcloud >/dev/null 2>&1; then
    hcloud volume enable-protection "$pv_name" delete 2>/dev/null \
      && echo "  [ok] volume '$pv_name' protected against deletion" \
      || echo "  [warn] hcloud protect failed — enable manually: hcloud volume enable-protection $pv_name delete"
  else
    echo "  [warn] hcloud CLI not found — enable manually: hcloud volume enable-protection $pv_name delete"
  fi
}

_method_wait-ready() {
  _wait_for_pod 180
}

_method_health() {
  local pod
  pod=$(_pod_name 2>/dev/null || true)
  if [ -z "$pod" ]; then
    echo "UNHEALTHY: no wireguard pod found in namespace $WG_NAMESPACE" >&2
    exit 1
  fi
  if _kubectl exec --namespace "$WG_NAMESPACE" "$pod" -- wg show wg0 >/dev/null 2>&1; then
    echo "HEALTHY: WireGuard interface wg0 is up"
  else
    echo "UNHEALTHY: wg0 interface not responding" >&2
    exit 1
  fi
}

_method_pubkey() {
  local pub
  pub=$(_kubectl get secret wireguard-keys \
    --namespace "$WG_NAMESPACE" \
    -o jsonpath='{.data.WG_PUBLIC_KEY}' 2>/dev/null | base64 -d)
  if [ -z "$pub" ]; then
    echo "ERROR: wireguard-keys secret not found or WG_PUBLIC_KEY missing" >&2
    exit 1
  fi
  echo "$pub"
}