refactor: simplify Dappnode WireGuard and refresh CA trust

.dockerignore

@@ -1,7 +1,6 @@
 .git
-.gitignore
 .github
-.gitattributes
-READMETEMPLATE.md
-README.md
-api
+api
+node_modules
+**/node_modules
+**/dist

.github/CONTRIBUTING.md

@@ -1,123 +1,14 @@
-# Contributing to wireguard
+# Contributing
 
-## Gotchas
+Keep the Dappmanager API, terminal commands, Compose service names and persisted
+WireGuard identities compatible. Runtime TypeScript uses Node built-ins and the
+native QR tool; new production dependencies need a concrete justification.
 
-* While contributing make sure to make all your changes before creating a Pull Request, as our pipeline builds each commit after the PR is open.
-* Read, and fill the Pull Request template
-  * If this is a fix for a typo (in code, documentation, or the README) please file an issue and let us sort it out. We do not need a PR
-  * If the PR is addressing an existing issue include, closes #\<issue number>, in the body of the PR commit message
-* If you want to discuss changes, you can also bring it up in [#dev-talk](https://discordapp.com/channels/354974912613449730/757585807061155840) in our [Discord server](https://linuxserver.io/discord)
+Follow the [README validation procedure](../README.md#validation) before opening
+a PR. Add a regression test for networking, state migration or credential changes.
+Use the PR template and report the tested baseline and any untested deployment
+paths. The integration test supports a disposable native host through DOCKER_HOST;
+it must never replace installed services or use their live config volume.
 
-## Common files
-
-| File | Use case |
-| :----: | --- |
-| `Dockerfile` | Dockerfile used to build amd64 images |
-| `Dockerfile.aarch64` | Dockerfile used to build 64bit ARM architectures |
-| `Dockerfile.armhf` | Dockerfile used to build 32bit ARM architectures |
-| `Jenkinsfile` | This file is a product of our builder and should not be edited directly. This is used to build the image |
-| `jenkins-vars.yml` | This file is used to generate the `Jenkinsfile` mentioned above, it only affects the build-process |
-| `package_versions.txt` | This file is generated as a part of the build-process and should not be edited directly. It lists all the installed packages and their versions |
-| `README.md` | This file is a product of our builder and should not be edited directly. This displays the readme for the repository and image registries |
-| `readme-vars.yml` | This file is used to generate the `README.md` |
-
-## Readme
-
-If you would like to change our readme, please __**do not**__ directly edit the readme, as it is auto-generated on each commit.
-Instead edit the [readme-vars.yml](https://github.com/linuxserver/docker-wireguard/edit/master/readme-vars.yml).
-
-These variables are used in a template for our [Jenkins Builder](https://github.com/linuxserver/docker-jenkins-builder) as part of an ansible play.
-Most of these variables are also carried over to [docs.linuxserver.io](https://docs.linuxserver.io/images/docker-wireguard)
-
-### Fixing typos or clarify the text in the readme
-
-There are variables for multiple parts of the readme, the most common ones are:
-
-| Variable | Description |
-| :----: | --- |
-| `project_blurb` | This is the short excerpt shown above the project logo. |
-| `app_setup_block` | This is the text that shows up under "Application Setup" if enabled |
-
-### Parameters
-
-The compose and run examples are also generated from these variables.
-
-We have a [reference file](https://github.com/linuxserver/docker-jenkins-builder/blob/master/vars/_container-vars-blank) in our Jenkins Builder.
-
-These are prefixed with `param_` for required parameters, or `opt_param` for optional parameters, except for `cap_add`.
-Remember to enable param, if currently disabled. This differs between parameters, and can be seen in the reference file.
-
-Devices, environment variables, ports and volumes expects its variables in a certain way.
-
-### Devices
-
-```yml
-param_devices:
-  - { device_path: "/dev/dri", device_host_path: "/dev/dri", desc: "For hardware transcoding" }
-opt_param_devices:
-  - { device_path: "/dev/dri", device_host_path: "/dev/dri", desc: "For hardware transcoding" }
-```
-
-### Environment variables
-
-```yml
-param_env_vars:
-  - { env_var: "TZ", env_value: "Europe/London", desc: "Specify a timezone to use EG Europe/London." }
-opt_param_env_vars:
-  - { env_var: "VERSION", env_value: "latest", desc: "Supported values are LATEST, PLEXPASS or a specific version number." }
-```
-
-### Ports
-
-```yml
-param_ports:
-  - { external_port: "80", internal_port: "80", port_desc: "Application WebUI" }
-opt_param_ports:
-  - { external_port: "80", internal_port: "80", port_desc: "Application WebUI" }
-```
-
-### Volumes
-
-```yml
-param_volumes:
-  - { vol_path: "/config", vol_host_path: "</path/to/appdata/config>", desc: "Configuration files." }
-opt_param_volumes:
-  - { vol_path: "/config", vol_host_path: "</path/to/appdata/config>", desc: "Configuration files." }
-```
-
-### Testing template changes
-
-After you make any changes to the templates, you can use our [Jenkins Builder](https://github.com/linuxserver/docker-jenkins-builder) to have the files updated from the modified templates. Please use the command found under `Running Locally` [on this page](https://github.com/linuxserver/docker-jenkins-builder/blob/master/README.md) to generate them prior to submitting a PR.
-
-## Dockerfiles
-
-We use multiple Dockerfiles in our repos, this is because sometimes some CPU architectures needs different packages to work.
-If you are proposing additional packages to be added, ensure that you added the packages to all the Dockerfiles in alphabetical order.
-
-### Testing your changes
-
-```bash
-git clone https://github.com/linuxserver/docker-wireguard.git
-cd docker-wireguard
-docker build \
-  --no-cache \
-  --pull \
-  -t linuxserver/wireguard:latest .
-```
-
-The ARM variants can be built on x86_64 hardware and vice versa using `lscr.io/linuxserver/qemu-static`
-
-```bash
-docker run --rm --privileged lscr.io/linuxserver/qemu-static --reset
-```
-
-Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64`.
-
-## Update the changelog
-
-If you are modifying the Dockerfiles or any of the startup scripts in [root](https://github.com/linuxserver/docker-wireguard/tree/master/root), add an entry to the changelog
-
-```yml
-changelogs:
-  - { date: "DD.MM.YY:", desc: "Added some love to templates" }
-```
+README.md is maintained directly. There is no LinuxServer/Jenkins documentation
+generation, architecture-specific VPN Dockerfile or generated package inventory.

.github/workflows/main.yml

@@ -1,29 +1,52 @@
-name: "Main"
+name: Main
 on:
   pull_request:
   push:
     branches:
-      - "main"
-      - "master"
+      - main
+      - master
       - "v[0-9]+.[0-9]+.[0-9]+"
     paths-ignore:
-      - "README.md"
+      - README.md
+
+permissions:
+  contents: read
 
 jobs:
+  integration:
+    name: TypeScript, images and VPN regression
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: "24.22.1"
+      - run: npm install --global yarn@1.22.22
+      - run: yarn --cwd api install --frozen-lockfile --non-interactive
+      - run: yarn --cwd api format:check
+      - run: docker build -t wireguard-refactor:test .
+      - run: docker build -t wireguard-api-refactor:test api
+      - run: sudo modprobe wireguard
+      - run: node tests/integration.cjs
+        timeout-minutes: 15
+
   build-test:
+    name: SDK build
     runs-on: ubuntu-latest
-    name: Build test
     if: github.event_name != 'push'
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: npx @dappnode/dappnodesdk build --skip_save
 
   release:
     name: Release
     runs-on: ubuntu-latest
+    needs: integration
     if: github.event_name == 'push'
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Publish
         run: npx @dappnode/dappnodesdk publish patch --dappnode_team_preset
         env:

Dockerfile

@@ -1,47 +1,16 @@
 # syntax=docker/dockerfile:1
-
-FROM ghcr.io/linuxserver/baseimage-alpine:3.23
-
-# set version label
-ARG BUILD_DATE
-ARG VERSION
-ARG WIREGUARD_RELEASE
-ARG TARGETPLATFORM
-LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DATE}"
-LABEL maintainer="thespad"
-
-RUN \
-  if [ -z "${WIREGUARD_RELEASE+x}" ]; then \
-  WIREGUARD_RELEASE=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.23/main/x86_64/APKINDEX.tar.gz" | tar -xz -C /tmp \
-    && awk '/^P:wireguard-tools$/,/V:/' /tmp/APKINDEX | sed -n 2p | sed 's/^V://'); \
-  fi && \
-  echo "**** install dependencies ****" && \
-  apk add --no-cache \
-    bc \
-    coredns \
-    grep \
-    iproute2 \
-    iptables \
-    ip6tables \
-    iputils \
-    kmod \
-    libcap-utils \
-    libqrencode-tools \
-    net-tools \
-    nftables \
-    openresolv \
-    wireguard-tools==${WIREGUARD_RELEASE} && \
-  echo "wireguard" >> /etc/modules && \
-  sed -i 's|\[\[ $proto == -4 \]\] && cmd sysctl -q net\.ipv4\.conf\.all\.src_valid_mark=1|[[ $proto == -4 ]] \&\& [[ $(sysctl -n net.ipv4.conf.all.src_valid_mark) != 1 ]] \&\& cmd sysctl -q net.ipv4.conf.all.src_valid_mark=1|' /usr/bin/wg-quick && \
-  rm -rf /etc/wireguard && \
-  ln -s /config/wg_confs /etc/wireguard && \
-  printf "Linuxserver.io version: ${VERSION}\nBuild-date: ${BUILD_DATE}" > /build_version && \
-  echo "**** clean up ****" && \
-  rm -rf \
-    /tmp/*
-
-# add local files
-COPY /root /
-
-# ports and volumes
+FROM alpine:3.23@sha256:ff7f0c727dd796aa36787bfcd9a64bf35a6ce72a73451b3359fde849b6703d63
+RUN apk add --no-cache \
+    bash curl iproute2 iptables ip6tables libqrencode-tools tini \
+    'ca-certificates>=20261020-r0' 'ca-certificates-bundle>=20261020-r0' \
+    wireguard-tools && \
+    update-ca-certificates && \
+    mkdir -p /config /app && \
+    rm -rf /etc/wireguard && ln -s /config/wg_confs /etc/wireguard
+COPY wireguard /usr/local/lib/wireguard
+RUN chmod +x /usr/local/lib/wireguard/*.sh /usr/local/lib/wireguard/show-peer && \
+    ln -s /usr/local/lib/wireguard/show-peer /app/show-peer
+RUN --mount=type=bind,source=tests/configuration.sh,target=/tmp/configuration-test.sh bash /tmp/configuration-test.sh
 EXPOSE 51820/udp
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s CMD ["/usr/local/lib/wireguard/healthcheck.sh"]
+ENTRYPOINT ["/sbin/tini", "-g", "--", "/usr/local/lib/wireguard/start.sh"]