candiddev / vault-plugin-secrets-wireguard Goto Github PK

Along with a Vault agent example, having this become a Nomad job would be another method to distribute configs.

This plugin currently generates configs that include all peers. When these peers don't have endpoints, and the peer that the config is being generated for doesn't have an endpoint, it doesn't make sense to have them as a peer. It doesn't hurt anything, it just registers a bunch of unreachable peers.

We should add a field to groups called "mesh" and default it to true. If false, change the templates to not render peers if they don't have a port specified and the peer being rendered doesn't either--it should only have peers with endpoints/ports.

Some folks may benefit from having a systemd-networkd config endpoint that will generate two fields: netdev file and a network file. Tricky part may be converting the AllowedIPs into networkd routes.