freifunkMUC/wg-access-server v1.2.0 on GitHub

Security

Replicas could assign the same VPN address to two devices. The fix for GHSA-j62x-qc44-h6pj in v1.1.0 only serialized device creation within one process. With several replicas sharing a Postgres database, two devices created at the same time could still get the same tunnel address, letting one client receive another client's traffic. Device creation is now serialized across all replicas with a database lock. Upgrade if you run more than one replica. Single-instance deployments were not affected.

Traffic statistics now add up. Received and transmitted bytes used to be overwritten by whichever replica wrote last and dropped back after every restart. They are now summed across replicas and restarts, so the values in the UI and in /metrics only grow. Existing values continue from where they are.
Postgres: the notification trigger is replaced on the first start so that it no longer fires on every metadata update. This happens automatically.
pgbouncer must run in session pooling mode. This was already required for LISTEN/NOTIFY; the new database lock needs it as well.
MySQL: parseTime=true is now always set, so connection strings without it work. The documented ?ssl-mode=disabled never worked with the Go driver - use ?tls=false.
A leftover WireGuard interface (for example after the process was killed with hostNetwork) now stops the server with an error that names the interface and how to remove it, instead of failed to create TUN device: invalid argument. The interface is never removed automatically, since the name may belong to the host.

Docker and Kubernetes secrets: WG_ADMIN_PASSWORD_FILE and WG_WIREGUARD_PRIVATE_KEY_FILE read the admin password and the WireGuard key from files, e.g. /run/secrets/.... Each is exclusive with its direct counterpart; setting both stops the server. See the Docker Compose docs for an example. (#282)

Traffic statistics are summed across replicas and restarts instead of overwritten, and a replica a client has left no longer overwrites the current endpoint and last handshake. (#208)
Replicas starting at the same time no longer fail with tuple concurrently updated (pg-events v0.5.0).
Devices whose owner name or email is too large for a Postgres notification are still created and still get their WireGuard peer.
The metadata sync no longer reads every device from the database each cycle and no longer broadcasts each update to all replicas.
The documented MySQL connection string works.

Web UI: MUI 9, React 19.3, mobx 7 (mobx-utils is no longer needed) and grpc-web 2. Screenshots of the UI before and after are pixel-identical apart from generated keys.
The web client generator is now published as @freifunkmuc/grpc-ts-web, since the upstream package has not been released since 2022.
github.com/docker/docker was removed; it was only used to read /etc/resolv.conf. systemd-resolved setups keep working.
pg-events v0.5.0 and wg-embed v0.11.0.

Full Changelog: v1.1.0...v1.2.0