Protect the manager's WireGuard tunnel; stale WireGuard peer alert (v0.33.0)
#205: when the manager reaches a device through WireGuard (the managed
address is on a WireGuard interface, or the route back to the manager goes
out through one), the changes that would certainly cut it off are refused
outright: deleting or disabling that interface; deleting, disabling or
moving the peer whose allowed addresses cover the manager, or dropping the
manager from them; and adding or editing another peer on the tunnel so it
claims the manager's address (WireGuard routes by allowed address). Any
other change to the tunnel or its peers runs with auto-revert required;
peer deletes had no protection before. Where the manager's address can't be
seen (no connection tracking), every peer on the tunnel is guarded, not
refused. The WireGuard page marks the tunnel and peer and doesn't offer to
delete or disable them; peer deletes now report failures; Change Guard
refusals show their reason in forms too.
#208: a "WireGuard peer stale" alert rule (off by default, threshold in
minutes, default 15) fires once per peer when its last handshake is older
than the threshold. The slow poll records peers' handshakes; the check runs
every 5 minutes and skips peers that never connected, disabled peers and
peers on a disabled interface. Also a webhook event.
Tested on a CRS309 with two WireGuard interfaces peered over 127.0.0.1:
guarded create/edit/delete with no false refusals, peer polling, and one
stale alert for the peer whose other side was switched off.
Docs: change-guard.md (The manager's WireGuard tunnel), alerting.md.
Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com
Container images (published once CI passes):
ghcr.io/2gt-media-group-llc/mikrotik-manager-backend:0.33.0-betaghcr.io/2gt-media-group-llc/mikrotik-manager-nginx:0.33.0-beta
Documentation: https://2gt-media-group-llc.github.io/mikrotik-manager/