WireGuard

kanri talks to WireGuard through wg/wg-quick directly — not a reimplementation, the real tools. Reading status (wg show) and bringing an interface up/down (wg-quick up/down) both need root, since wg-quick creates network interfaces and can touch routing tables. kanri never has standing root itself; it shells out through sudo -n (non-interactive — fails fast and cleanly if it isn’t authorized, rather than hanging on a password prompt) for each call.

That means you configure the sudo access, scoped as narrowly as you want it. kanri ships no default grant.

Read-only status

# /etc/sudoers.d/kanri-wireguard
your_username ALL=(root) NOPASSWD: /path/to/wg show all dump

Resolve the real path first — command -v wg often returns a symlink (e.g. /run/current-system/sw/bin/wg on NixOS), and some sudo configurations match the literal command string rather than resolving symlinks themselves:

readlink -f "$(command -v wg)"

Use that path in the sudoers rule.

Up/down control

Same idea, one rule per interface name you actually want kanri to control — resist the temptation to wildcard this:

your_username ALL=(root) NOPASSWD: /path/to/wg-quick up wg0
your_username ALL=(root) NOPASSWD: /path/to/wg-quick down wg0

A wildcard (wg-quick up *) technically works, but it means anything that can run as your user can bring up or tear down any WireGuard config on the box, not just ones you meant to expose to kanri. Scoping per-interface costs one extra line per tunnel and closes that off entirely.

`wg show`’s own private-key exposure

wg show all dump includes each interface’s private key in cleartext in its output. If this machine has other, less-trusted local accounts, scope the sudo rule to trusted users only — don’t hand out blanket wg access to every account on a shared box.

NixOS example

security.sudo.extraRules = [
  {
    users = [ "your_username" ];
    commands = [
      { command = "${pkgs.wireguard-tools}/bin/wg show all dump"; options = [ "NOPASSWD" ]; }
      { command = "${pkgs.wireguard-tools}/bin/wg-quick up wg0"; options = [ "NOPASSWD" ]; }
      { command = "${pkgs.wireguard-tools}/bin/wg-quick down wg0"; options = [ "NOPASSWD" ]; }
    ];
  }
];

${pkgs.wireguard-tools}/bin/wg is already the real, fully-resolved store path — no readlink -f dance needed on NixOS specifically.

Nothing configured?

kanri’s WireGuard sub-view (and net wg-up/net wg-down) still work without any of this — wg show just reports no interfaces, and sudo -n wg-quick up ... fails with a clear “a password is required” style error instead of hanging.

Keyboard shortcuts