33800 Docs

← Retour

VPN Profiles System - Implementation

Date: 27-01-2026 Status: TERMINE

Resume

Implementation d'un systeme de profils VPN WireGuard reusables pour les instances SSH dans Connectors Hub.

Fonctionnalites implementees

1. Profils VPN (nouvelle entite)

2. Association VPN <-> Instance SSH

3. Connexion VPN automatique

4. Multi-tenant et isolation

Schema SQL

Table connectors.vpn_profiles

CREATE TABLE connectors.vpn_profiles (
  id                      UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  user_id                 UUID NOT NULL,
  name                    VARCHAR(100) NOT NULL,
  description             TEXT,
  -- Interface config
  private_key_encrypted   TEXT NOT NULL,      -- AES-256 encrypted
  public_key              TEXT NOT NULL,      -- Derived from private key
  address                 TEXT NOT NULL,      -- e.g., "10.9.0.9/32"
  address_ipv6            TEXT,               -- e.g., "fd42:42:42::9/128"
  -- Peer config
  endpoint                TEXT NOT NULL,      -- e.g., "92.154.124.233:11220"
  peer_public_key         TEXT NOT NULL,
  preshared_key_encrypted TEXT,               -- AES-256 encrypted (optional)
  allowed_ips             TEXT NOT NULL,      -- e.g., "192.168.10.0/24, 10.9.0.0/24"
  dns                     TEXT,               -- e.g., "192.168.10.250" (ignored in Docker)
  persistent_keepalive    INTEGER DEFAULT 25,
  -- Timestamps
  created_at              TIMESTAMPTZ DEFAULT now(),
  updated_at              TIMESTAMPTZ DEFAULT now(),

  CONSTRAINT vpn_profiles_user_id_name_key UNIQUE (user_id, name)
);

CREATE INDEX idx_vpn_profiles_user_id ON connectors.vpn_profiles(user_id);

-- RLS Policy
ALTER TABLE connectors.vpn_profiles ENABLE ROW LEVEL SECURITY;
CREATE POLICY vpn_profiles_user_policy ON connectors.vpn_profiles
  USING (user_id = auth.uid());

Modification user_connectors.token_metadata

Le champ JSONB token_metadata pour les instances SSH contient maintenant :

{
  "host": "91.134.83.185",
  "port": 22,
  "username": "root",
  "auth_method": "password",
  "password_encrypted": "iv:encrypted_data",
  "private_key_encrypted": "iv:encrypted_data",
  "vpn_profile_id": "feb5990f-3c8d-4979-817a-0f3c3ec94e30"  // NEW
}

API Endpoints

VPN Profiles

Method Endpoint Description
GET /api/vpn/profiles Liste les profils de l'utilisateur
GET /api/vpn/profiles/:id Details d'un profil
POST /api/vpn/profiles Creer un profil
POST /api/vpn/profiles/import Importer depuis .conf
PUT /api/vpn/profiles/:id Modifier un profil
DELETE /api/vpn/profiles/:id Supprimer un profil

Sidecar (interne)

Method Endpoint Description
POST /tunnel/connect Creer et demarrer un tunnel
POST /tunnel/disconnect Arreter un tunnel
GET /tunnel/status/:name Status d'un tunnel
GET /tunnel/list Liste des tunnels actifs
POST /keys/derive Deriver cle publique
POST /keys/generate Generer paire de cles

Fichiers modifies/crees

Backend (connectors-api)

Frontend (connectors-front)

Sidecar (wireguard-sidecar)

Limitations connues

  1. DNS desactive : Les DNS configures dans le profil VPN sont ignores car resolvconf ne fonctionne pas dans Docker. Utiliser des IPs directement.

  2. allowed_ips 0.0.0.0/0 : Router tout le trafic via VPN necessite des capabilities Docker supplementaires (--sysctl). Utiliser des plages specifiques.

  3. Pas de deconnexion auto : Les tunnels restent actifs. Un cleanup periodique pourrait etre ajoute.

Tests effectues