Customer Tunnels (WireGuard)¶

                           PUBLIC INTERNET
                                 │
                                 │
        ┌────────────────────────┼────────────────────────┐
        │                                                 │
        │  CLOUD VPS (89.116.31.109)                      │
        │                                                 │
        │  ┌──────────────────┐    ┌──────────────────┐   │
        │  │  wg0 (existing)  │    │  wg1 (NEW)       │   │
        │  │  UDP 51820       │    │  UDP 51821       │   │
        │  │  10.10.10.0/24   │    │  10.20.0.0/16    │   │
        │  │                  │    │                  │   │
        │  │  • NUC           │    │  • V7            │   │
        │  │  • Staging       │    │  • Future cust N │   │
        │  └────────┬─────────┘    └────────┬─────────┘   │
        │           │                       │             │
        │           └──── iptables DROP ────┘             │
        │                  (no cross-traffic)              │
        │                                                 │
        │  Cloud services (Asterisk, AstraPBX, etc.)      │
        └─────────────────────────────────────────────────┘

✅ Cloud's wg1 tunnel IP (e.g. 10.20.7.1) — for SIP signaling/RTP only
✅ Cloud Asterisk on 5060/UDP, 5080/UDP, 10000-20000/UDP (RTP)

❌ NUC (10.10.10.2)             — different interface + iptables DROP
❌ Staging (10.10.10.3)         — different interface + iptables DROP
❌ Other customer tunnels       — wg1-to-wg1 iptables DROP
❌ SSH (22)                     — INPUT policy on wg1
❌ AstraPBX API (8000)          — INPUT policy on wg1
❌ Editor (3001)                — INPUT policy on wg1
❌ MariaDB / Postgres / Redis   — bind to localhost only + INPUT policy
❌ Any other org's PJSIP endpoints — PJSIP `match` is per-org /30

10.20.7.0/30:
  10.20.7.0  → network address (unused)
  10.20.7.1  → cloud-side tunnel IP
  10.20.7.2  → customer-side tunnel IP
  10.20.7.3  → broadcast (unused)

// api/database/migrations/YYYYMMDDhhmmss-create-customer-tunnels.js
'use strict';

module.exports = {
  up: async (queryInterface, Sequelize) => {
    await queryInterface.createTable('customer_tunnels', {
      id: {
        type: Sequelize.UUID,
        defaultValue: Sequelize.UUIDV4,
        primaryKey: true,
      },
      org_id: {
        type: Sequelize.UUID,
        allowNull: false,
        references: { model: 'organizations', key: 'id' },
        onDelete: 'CASCADE',
      },
      name: {
        type: Sequelize.STRING(64),
        allowNull: false,
      },
      tunnel_subnet: {
        type: Sequelize.STRING(18),       // CIDR (e.g. "10.20.7.0/30")
        allowNull: false,
        unique: true,
      },
      cloud_tunnel_ip: {
        type: Sequelize.STRING(15),
        allowNull: false,
      },
      customer_tunnel_ip: {
        type: Sequelize.STRING(15),
        allowNull: false,
      },
      customer_pubkey: {
        type: Sequelize.STRING(64),       // base64-encoded 32-byte WG pubkey
        allowNull: false,
      },
      preshared_key: {
        type: Sequelize.STRING(64),
        allowNull: false,
      },
      persistent_keepalive: {
        type: Sequelize.INTEGER,
        defaultValue: 25,
      },
      listen_port: {
        type: Sequelize.INTEGER,
        defaultValue: 51821,
      },
      interface_name: {
        type: Sequelize.STRING(16),
        defaultValue: 'wg1',
      },
      status: {
        type: Sequelize.ENUM('active', 'disabled', 'revoked'),
        defaultValue: 'active',
        allowNull: false,
      },
      notes: {
        type: Sequelize.TEXT,
      },
      created_at: { type: Sequelize.DATE, defaultValue: Sequelize.NOW },
      updated_at: { type: Sequelize.DATE, defaultValue: Sequelize.NOW },
      created_by_user_id: {
        type: Sequelize.UUID,
        references: { model: 'org_users', key: 'id' },
        onDelete: 'SET NULL',
      },
    });

    await queryInterface.addIndex('customer_tunnels', ['org_id']);
    await queryInterface.addIndex('customer_tunnels', ['status']);
    await queryInterface.addIndex('customer_tunnels', ['org_id', 'name'], { unique: true });
  },

  down: async (queryInterface) => {
    await queryInterface.dropTable('customer_tunnels');
  },
};

const POOL_CIDR = '10.20.0.0/16';
const PREFIX_LENGTH = 30;

async function allocateNextAvailable() {
  // Get all in-use subnets ordered ascending
  const used = await CustomerTunnel.findAll({
    where: { status: ['active', 'disabled'] },  // revoked subnets reserved for 30d
    attributes: ['tunnel_subnet'],
    order: [['tunnel_subnet', 'ASC']],
  });

  // Walk 10.20.0.0/30, 10.20.0.4/30, ... 10.20.0.252/30, 10.20.1.0/30, ...
  // First-fit: return the first /30 in pool not present in `used`
  // Skip 10.20.0.0/30 (reserved, network boundary)

  for (let octet3 = 0; octet3 < 256; octet3++) {
    for (let octet4 = 4; octet4 < 256; octet4 += 4) {  // /30 = 4 IPs aligned
      const candidate = `10.20.${octet3}.${octet4}/30`;
      if (!used.find((u) => u.tunnel_subnet === candidate)) {
        return {
          subnet: candidate,
          cloud_ip: `10.20.${octet3}.${octet4 + 1}`,
          customer_ip: `10.20.${octet3}.${octet4 + 2}`,
        };
      }
    }
  }
  throw new Error('Subnet pool exhausted (10.20.0.0/16 fully allocated)');
}

async function generateWg1Config() {
  const serverPrivateKey = await readServerPrivateKey();  // /etc/wireguard/wg1.private (root-only)
  const tunnels = await CustomerTunnel.findAll({
    where: { status: 'active' },
    order: [['created_at', 'ASC']],
  });

  let conf = `# AUTO-GENERATED by AstraPBX wireguardGenerator. DO NOT EDIT BY HAND.
# Source of truth: customer_tunnels table in pbx_api_db.
# Generated: ${new Date().toISOString()}

[Interface]
Address = 10.20.0.1/16
ListenPort = 51821
PrivateKey = ${serverPrivateKey}
PostUp = /usr/local/sbin/customer-tunnels-iptables.sh up
PostDown = /usr/local/sbin/customer-tunnels-iptables.sh down

`;

  for (const t of tunnels) {
    conf += `# org=${t.org_id} name=${t.name} created=${t.created_at.toISOString()}
[Peer]
PublicKey = ${t.customer_pubkey}
PresharedKey = ${t.preshared_key}
AllowedIPs = ${t.customer_tunnel_ip}/32
PersistentKeepalive = ${t.persistent_keepalive}

`;
  }

  return conf;
}

async function applyWg1() {
  const conf = await generateWg1Config();

  // 1. Atomic write to staging file
  const tmp = '/etc/wireguard/wg1.conf.new';
  await fs.writeFile(tmp, conf, { mode: 0o600 });

  // 2. Backup current
  const backup = `/etc/wireguard/wg1.conf.bak-${Date.now()}`;
  await fs.copyFile('/etc/wireguard/wg1.conf', backup).catch(() => {});

  // 3. Move into place atomically
  await fs.rename(tmp, '/etc/wireguard/wg1.conf');

  // 4. Hot-reload (no tunnel restart for unchanged peers)
  await exec('wg syncconf wg1 <(wg-quick strip wg1)', { shell: '/bin/bash' });

  // 5. Verify wg show succeeds
  const { stdout } = await exec('wg show wg1');
  return { applied: true, peer_count: tunnels.length, wg_status: stdout };
}

# 1. Generate server WG keys (once per VPS)
umask 077
wg genkey > /etc/wireguard/wg1.private
wg pubkey < /etc/wireguard/wg1.private > /etc/wireguard/wg1.public
chmod 600 /etc/wireguard/wg1.private
chmod 644 /etc/wireguard/wg1.public

# 2. Write iptables helper script
cat > /usr/local/sbin/customer-tunnels-iptables.sh <<'EOF'
#!/bin/bash
# Applies iptables rules when wg1 comes up; removes them when wg1 goes down.
# Called from PostUp/PostDown in /etc/wireguard/wg1.conf.

set -e

case "$1" in
  up)
    # Block customer→internal infra
    iptables -A FORWARD -i wg1 -o wg0 -j DROP
    iptables -A FORWARD -i wg0 -o wg1 -j DROP
    # Block customer→customer
    iptables -A FORWARD -i wg1 -o wg1 -j DROP
    # Allow only SIP+RTP into the cloud
    iptables -A INPUT -i wg1 -p udp --dport 5060 -j ACCEPT
    iptables -A INPUT -i wg1 -p udp --dport 5080 -j ACCEPT
    iptables -A INPUT -i wg1 -p udp --dport 10000:20000 -j ACCEPT
    # Drop everything else from wg1
    iptables -A INPUT -i wg1 -j DROP
    ;;
  down)
    iptables -D FORWARD -i wg1 -o wg0 -j DROP || true
    iptables -D FORWARD -i wg0 -o wg1 -j DROP || true
    iptables -D FORWARD -i wg1 -o wg1 -j DROP || true
    iptables -D INPUT -i wg1 -p udp --dport 5060 -j ACCEPT || true
    iptables -D INPUT -i wg1 -p udp --dport 5080 -j ACCEPT || true
    iptables -D INPUT -i wg1 -p udp --dport 10000:20000 -j ACCEPT || true
    iptables -D INPUT -i wg1 -j DROP || true
    ;;
esac
EOF
chmod 755 /usr/local/sbin/customer-tunnels-iptables.sh

# 3. Initial empty wg1.conf (no peers yet — AstraPBX will populate via wireguardGenerator)
cat > /etc/wireguard/wg1.conf <<EOF
[Interface]
Address = 10.20.0.1/16
ListenPort = 51821
PrivateKey = $(cat /etc/wireguard/wg1.private)
PostUp = /usr/local/sbin/customer-tunnels-iptables.sh up
PostDown = /usr/local/sbin/customer-tunnels-iptables.sh down
EOF
chmod 600 /etc/wireguard/wg1.conf

# 4. Open UDP 51821 in ufw
ufw allow 51821/udp comment 'WireGuard customer tunnels'

# 5. Enable and start the service
systemctl enable --now wg-quick@wg1

# 6. Verify
wg show wg1
ip link show wg1
iptables -L FORWARD -v | grep wg1

Org Settings
├── Organization (existing)
├── Asterisk Configuration (existing)
├── Session (existing)
└── Network Tunnels (NEW)
     ├── List of active tunnels for this org
     │   └── For each: name, subnet, last handshake, status, [⋮ actions]
     ├── [+ Add Tunnel] button → modal:
     │     - Name (default "astradial-<orgshortname>")
     │     - Customer pubkey (textarea — paste from GDMS)
     │     - Notes (optional)
     │     [Submit]
     └── [View customer config] action → modal:
           - Renders the [Peer] block for the customer to paste in GDMS
           - "Copy to clipboard" button
           - Pre-shared key shown with reveal/hide toggle

ssh root@89.116.31.109 'ip -4 route show dev wg1'
# Expect:
#   10.20.0.0/16 proto kernel scope link src 10.20.0.1   ← wg-quick manages this
#   192.168.0.0/24 scope link                            ← V7 LAN, syncCustomerLanRoutes manages this

# Any tunnel mutation triggers route-sync; simplest is a no-op PATCH:
curl -X PATCH https://devpbx.astradial.com/api/v1/customer-tunnels/<V7-ID> \
  -H "Authorization: Bearer <token>" -H "Content-Type: application/json" \
  -d '{"notes":"trigger route resync"}'
# Or manually:
ssh root@89.116.31.109 'ip route add 192.168.0.0/24 dev wg1'

ssh root@89.116.31.109 'mariadb -uroot pbx_api_db -e "UPDATE customer_tunnels SET status=\"active\" WHERE name=\"V7_Tirupathur\";"'
ssh root@89.116.31.109 'cd /opt/astrapbx && node -e "const { applyWg1Config } = require(\"./src/services/network/wireguardApplier\"); applyWg1Config({ models: require(\"./src/models\") }).then(r => { console.log(JSON.stringify(r, null, 2)); process.exit(0); }).catch(e => { console.error(e.message); process.exit(1); });"'

SHOW TABLES LIKE 'customer_tunnels';     -- expects 1 row
SHOW TABLES LIKE 'tunnel_metrics';       -- expects 1 row
SELECT COUNT(*) FROM customer_tunnels;   -- expects 0
SELECT COUNT(*) FROM tunnel_metrics;     -- expects 0
SELECT name FROM SequelizeMeta
  WHERE name LIKE '2026051212%' OR name LIKE '2026051220%';  -- expects 2 rows

1. Ops opens editor.astradial.com → V7 org → Settings → Network Tunnels
2. Click [+ Add Tunnel]
3. Name: "astradial-cloud" (default)
4. Paste V7's WireGuard public key (from GDMS — generated when V7 IT created the WG entry on GWN7002)
5. Submit
   → System allocates 10.20.7.0/30
   → System generates PSK
   → System writes peer block to wg1.conf and reloads
   → System updates V7's PJSIP endpoint match list to include 10.20.7.2/32 (via generator regen)
   → Returns success + customer-config modal
6. Click [View customer config], copy the [Peer] block
7. In GDMS → V7's network → Settings → VPN → WireGuard → Add (or Setup Wizard):
   - Interface: BSNL
   - Local IP: 10.20.7.2/30
   - Paste server config including Endpoint = 89.116.31.109:51821
   - Save & Apply
8. On cloud: `wg show wg1` should show V7's peer with a fresh handshake within ~10s
9. Verify V7's phones now register from 10.20.7.2 (visible in `pjsip show contacts`)

ssh root@89.116.31.109 'wg show wg1'

ssh root@89.116.31.109 'pm2 stop astrapbx workflow-engine pipecat-flow editor'
ssh root@89.116.31.109 'zcat /root/pre-customer-tunnels-2026-05-12T115633Z/pbx_api_db.sql.gz | mariadb -uroot pbx_api_db'
ssh root@89.116.31.109 'pm2 restart astrapbx workflow-engine pipecat-flow editor'