Ordering wireguard interface init and daemon start

Vincent Lee <[email protected]>
Newsgroups gmane.linux.debian.user
Message-ID <[email protected]>
Hi debian-users,

My NAS is a Debian system, and it serves a couple webapps via a
wireguard bastion host that serves as the public IP and reverse proxy.

The interface to the public internet is enp1s0, and the wireguard
interface is wg0.

I'm struggling with how to configure things properly so that 1) the
wireguard interface is only brought up when the backing internet
connection enp1s0 is up and 2) the webapps are only started when the
wireguard interface is brought up.

---

Here are some pertinent configs:

/etc/network/interfaces
# The primary network interface
allow-hotplug enp1s0
iface enp1s0 inet dhcp

auto wg0
iface wg0 inet static
        address 10.0.0.2
        netmask 255.255.255.0
        pre-up ip link add $IFACE type wireguard
        pre-up wg setconf $IFACE /etc/wireguard/$IFACE.conf
        post-down ip link del $IFACE

I also have the `ifupdown-wait-online.service` systemd service enabled
in its default configuration. From what I understand, this will block
network-online.target until wait-online.sh exits successfully.

In the webapp systemd service files, I have Requires= and After=
requirements on network-online.target, so the webapp should not be
started until ifupdown-wait-online succeeds. The webapp binds to the
10.0.0.2 wireguard IP.

---

Here are the symptons of what happens:

1) wg fails to come up

On boot, the wg interface fails to come up. I have to manually do
`ifdown -f wg0` then `ifup wg0` to manually kick it.

2) Webapp fails to start

Even though the webapp has a dependency on network-online.target, it
starts anyways and fails to bind to the 10.0.0.2 IP because the wg0
interface didn't come up.

---

Questions:

I guess I'm not sure which piece of things I'm missing. Reading the
wait-online.sh script, what it does is loop over all `auto` interfaces
and wait til ifquery(8) says they're configured. My wg0 interface is
marked `auto`, so I'd expect the script to find it and loop until it's
configured.

Happy to provide more information if needed.

Thanks in advance,
Vincent
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.