# -*- coding: utf-8 -*-
from setuptools import setup

package_dir = \
{'': 'src'}

packages = \
['wg_wizard']

package_data = \
{'': ['*']}

install_requires = \
['click>=8.1.3,<9.0.0',
 'pydantic>=1.9.2,<2.0.0',
 'qrcode>=7.3.1,<8.0.0',
 'ruamel.yaml>=0.17.21,<0.18.0']

entry_points = \
{'console_scripts': ['wg-wizard = wg_wizard.cli:main']}

setup_kwargs = {
    'name': 'wg-wizard',
    'version': '0.2.1',
    'description': 'Control all the WireGuard server and client configs in a centralized way.',
    'long_description': 'wg-wizard\n=========\n.. image:: https://github.com/ianlini/wg-wizard/actions/workflows/main.yml/badge.svg\n   :target: https://github.com/ianlini/wg-wizard/actions/workflows/main.yml\n.. image:: https://github.com/ianlini/wg-wizard/actions/workflows/release.yml/badge.svg\n   :target: https://github.com/ianlini/wg-wizard/actions/workflows/release.yml\n.. image:: https://img.shields.io/pypi/v/wg-wizard.svg\n   :target: https://pypi.org/project/wg-wizard/\n.. image:: https://img.shields.io/pypi/l/wg-wizard.svg\n   :target: https://github.com/ianlini/wg-wizard/blob/master/LICENSE\n.. image:: https://img.shields.io/github/stars/ianlini/wg-wizard.svg?style=social\n   :target: https://github.com/ianlini/wg-wizard\n\nwg-wizard can help you generate the configs for WireGuard interactively,\nand control all the server and client configs in a centralized way.\n\n.. contents::\n\nNetwork Architecture\n--------------------\n\nOur default network architecture is one\n`relay server <https://docs.sweeting.me/s/wireguard#Bounce-Server>`_\nwith multiple clients connecting to the VPN via the relay server.\n\nWe assume that most people need a network architecture like this.\nIf you want another architecture, you can still achieve some of them\nusing the advance configuration.\n\nWhy Do We Need wg-wizard\n------------------------\n\nTODO\n\nPrerequisite\n------------\n\n1. A server with Ubuntu, Debian or Raspberry Pi OS.\n   You can still use other Linux distributions,\n   but the following instructions might not be applicable.\n2. `Install Docker <https://docs.docker.com/engine/install/>`_ on your relay server.\n3. `Install Wireguard <https://www.wireguard.com/install/>`_ on your relay server.\n\nRun the Docker Container\n------------------------\n\nWe use Docker to disable the network to make the whole process secure.\n\n.. code-block:: sh\n\n   # go to the directory you want to put the configs\n   # assuming ~/wg-wizard here\n   export WG_WIZARD_CONFIG=\'~/wg-wizard\'\n   cd "${WG_WIZARD_CONFIG}"\n   docker run -it --rm --network=none --volume="$PWD":/workdir ianlini/wg-wizard\n\nInitialize the Configuration\n----------------------------\n\n.. code-block:: sh\n\n   # inside the Docker container\n   wg-wizard init\n\nFollow the instruction to create the config. Example output:\n\n.. code-block::\n\n   Interface name for WireGuard [wg0]:\n   Interface.ListenPort of the relay server [51820]:\n   Interface.Address of the relay server [192.168.10.1/24]:\n   The default endpoint in clients\' Peer.Endpoint configs (e.g., example.com:51280): example.com\n   If you want to allow the clients to access the internet via the relay server, you must provide the interface name you want to forward the internet traffic to. It\'s usually eth0 or wlan0. You can check it by executing `ip addr`. If you provide an interface name {interface}, the following rules will be added:\n   - iptables -A FORWARD -i %i -o {interface} -j ACCEPT\n   - iptables -A FORWARD -i {interface} -o %i -j ACCEPT\n   - iptables -t nat -A POSTROUTING -s {network} -o {interface} -j MASQUERADE\n   Interface name for connecting to the internet []: eth0\n   Do you want to allow the clients to connect with each other? If yes, a rule will be added: `iptables -A FORWARD -i %i -o %i -j ACCEPT` [Y/n]:\n   Do you want to allow the clients to connect to any IPs on the relay server? If no, only the IP of the WireGuard interface can be connected, that is, the following rules will be added:\n   - iptables -A INPUT -d {wg_server_interface_ip} -i %i -j ACCEPT\n   - iptables -A INPUT -i %i -j DROP\n   [y/N]:\n   [2022-10-12 18:41:34,190][INFO] wg_wizard.core: Writing config to /home/pi/pi-gateway/wireguard/wg0.yml\n   [2022-10-12 18:41:38,868][INFO] wg_wizard.core: Writing secret to /home/pi/pi-gateway/wireguard/wg0_secret.json\n\nNormally, you can use the default values for almost all of the options.\n\nIf you allow the internet access or allow the clients to connect with each other,\nyou also need to `enable IP forwarding <https://www.digitalocean.com/community/tutorials/how-to-set-up-wireguard-on-ubuntu-20-04#step-4-adjusting-the-wireguard-server-s-network-configuration>`_.\n\nFor convenience, in the following instructions,\nwe assume that your WireGuard interface name is ``wg0``:\n\n.. code-block:: sh\n\n   export WG_INTERFACE=wg0\n\nAdd a Peer\n----------\n\n.. code-block:: sh\n\n   # inside the Docker container\n   wg-wizard add-peer\n\nFollow the instruction to create the peer config. Example output:\n\n.. code-block::\n\n   Interface name for WireGuard [wg0]:\n   Name of the client: phone1\n   Peer.PersistentKeepalive of the client [25]:\n   Interface.Address of the client [192.168.10.2/32]:\n   Peer.AllowedIPs of the client [0.0.0.0/0, ::/0]:\n   [2022-10-04 16:40:01,337][INFO] wg_wizard.core: Writing config to /workdir/wg0.yml\n   [2022-10-04 16:40:01,358][INFO] wg_wizard.core: Writing secret to /workdir/wg0_secret.json\n   [2022-10-04 16:40:01,362][INFO] wg_wizard.cli: Client\'s wg-quick config QR Code:\n   ...\n\nNormally, you can use the default values for almost all of the options.\nIn the end, there will be a QR Code generated.\nYou can now use your `WireGuard app <https://www.wireguard.com/install/>`_\non your phone to scan the QR Code to import the config.\nIf your client doesn\'t support QR Code, you can use another command to generate the text:\n\n.. code-block:: sh\n\n   wg-wizard export-client-config --interface "${WG_INTERFACE}" --name phone1 --no-qrcode\n\nSet Up the WireGuard Server\n---------------------------\n\nPreparing:\n\n.. code-block:: sh\n\n   # on your relay server (outside the Docker container)\n   cd "${WG_WIZARD_CONFIG}"\n   export WG_INTERFACE=wg0  # replace wg0 with your interface name\n   (umask 077; sudo mkdir /etc/wireguard/)\n\nExporting server config:\n\n.. code-block:: sh\n\n   docker run --rm --network=none --volume="$PWD":/workdir ianlini/wg-wizard \\\n       wg-wizard export-server-config -i "${WG_INTERFACE}" \\\n       | sudo cp --backup /dev/stdin "/etc/wireguard/${WG_INTERFACE}.conf"\n\nIf you haven\'t enabled the service:\n\n.. code-block:: sh\n\n   # start the WireGuard server\n   sudo systemctl enable "wg-quick@${WG_INTERFACE}.service"\n   sudo systemctl start "wg-quick@${WG_INTERFACE}.service"\n\nNow you can turn on the WireGuard tunnel on your client (phone1),\nand it should work.\n\nIf the service is already running, you can check the config diff first:\n\n.. code-block:: sh\n\n   sudo diff "/etc/wireguard/${WG_INTERFACE}.conf~" "/etc/wireguard/${WG_INTERFACE}.conf"\n\nAfter confirming the changes, there are 2 ways to apply them.\n\n1. If you are not changing the wg-quick specific interface configs\n   (e.g., Address, DNS, MTU, Table, PreUp, PostUp, PreDown,\n   PostDown and SaveConfig),\n   you can reload the config without stopping the server:\n\n   .. code-block:: sh\n\n      sudo systemctl reload "wg-quick@${WG_INTERFACE}.service"\n\n2. Otherwise, you should restart the server:\n\n   .. code-block:: sh\n\n      sudo systemctl restart "wg-quick@${WG_INTERFACE}.service"\n\n\nTroubleshooting\n---------------\n\nRead the service log:\n\n.. code-block:: sh\n\n   journalctl -u "wg-quick@${WG_INTERFACE}.service" -f -n 1000\n\nEnable the kernel log:\n\n.. code-block:: sh\n\n   sudo modprobe wireguard\n   echo module wireguard +p | sudo tee /sys/kernel/debug/dynamic_debug/control\n\nRead the kernel log:\n\n.. code-block:: sh\n\n   journalctl -k -f -n 1000 | grep wireguard\n\nDebug iptables:\n\n.. code-block:: sh\n\n   # trace the ICMP packets from a WireGuard client\n   sudo iptables -t raw -A PREROUTING -i "${WG_INTERFACE}" -p icmp -j TRACE\n   # trace the incoming ICMP packets from the internet to a WireGuard client\n   sudo iptables -t mangle -A FORWARD -d 192.168.10.0/24 -p icmp -j TRACE\n\n.. warning::\n   Debugging iptables requires much more knowledge,\n   or you might generate large logs,\n   or even break the network of the whole machine.\n   However, it is highly possible that the generated configs don\'t work out-of-the-box.\n   It is the hard part when developing this tool because people will have different existing rules.\n   If you have a bad luck, you might need to spend some time understanding\n   the relationship between iptables and WireGuard.\n\nBuild the Docker Image from Scratch\n-----------------------------------\n\nTODO\n\n.. code-block:: sh\n\n   git clone ...\n   cd ...\n   docker build . -t ianlini/wg-wizard\n\nReferences\n----------\n\n- `Some Unofficial WireGuard Documentation <https://docs.sweeting.me/s/wireguard>`_\n- `How To Set Up WireGuard on Ubuntu 20.04 <https://www.digitalocean.com/community/tutorials/how-to-set-up-wireguard-on-ubuntu-20-04>`_\n- `How To Set Up WireGuard Firewall Rules in Linux <https://www.cyberciti.biz/faq/how-to-set-up-wireguard-firewall-rules-in-linux/>`_\n',
    'author': 'Ian Lin',
    'author_email': 'you@example.com',
    'maintainer': 'None',
    'maintainer_email': 'None',
    'url': 'https://github.com/ianlini/wg-wizard',
    'package_dir': package_dir,
    'packages': packages,
    'package_data': package_data,
    'install_requires': install_requires,
    'entry_points': entry_points,
    'python_requires': '>=3.10,<4.0',
}


setup(**setup_kwargs)
