maksar-macbook/brov-macbook
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Network core: home WireGuard as a client network (off = direct at home, on = via home tunnel when away); drop Saga's overlapping 10.0.0.0/24 tunnel subnet

Browse Source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
maksarsanjeev
2026-10-08 01:31:14 +03:00
parent 0d5c68f83b
commit a7a0195d34
4 changed files with 39 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/netcore/gen.py
+15 -7
View File
@@ -19,9 +19,14 @@ KEYS = os.path.join(HERE, "keys")
CORE = HERE
HOME_NET = "192.168.10.0/24"
CLIENTS = { # name: (conf file, routed subnets)
"saga": ("saga.conf", ["192.168.8.0/24", "10.0.0.0/24"]),
"planet9": ("planet9.conf", ["192.168.68.0/24", "172.3.3.0/24"]),
CLIENTS = { # name: (conf file, routed subnets, what "off" means)
# Client networks: off = REJECT (unreachable). Only the LANs are routed — their
# tunnel subnets overlap (Saga and home both use 10.0.0.x).
"saga": ("saga.conf", ["192.168.8.0/24"], "REJECT"),
"planet9": ("planet9.conf", ["192.168.68.0/24", "172.3.3.0/24"], "REJECT"),
# Home: off = DIRECT (you're at home, the LAN is right there); on = through the
# home WireGuard when away. Optional: only if src/home.conf exists.
"home": ("home.conf", ["192.168.10.0/24"], "DIRECT"),
}
AI_DOMAINS = ["anthropic.com", "claude.ai", "claude.com", "openai.com", "chatgpt.com",
"oaistatic.com", "oaiusercontent.com", "github.com", "githubusercontent.com"]
@@ -140,13 +145,15 @@ def main():
prov = os.path.join(KEYS, "amnezia.yaml")
with open(os.open(prov, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600), "w") as f:
f.write(y({"proxies": awg}) + "\n")
proxies = [wg(n, f) for n, (f, _) in CLIENTS.items()]
clients = {n: c for n, c in CLIENTS.items() if os.path.exists(os.path.join(SRC, c[0]))}
proxies = [wg(n, f) for n, (f, _, _) in clients.items()]
sub = open(os.path.join(SRC, "vless.sub")).read().strip()
rules = [f"IP-CIDR,{HOME_NET},DIRECT,no-resolve", "IP-CIDR,127.0.0.0/8,DIRECT,no-resolve",
rules = ([] if "home" in clients else [f"IP-CIDR,{HOME_NET},DIRECT,no-resolve"]) + [
"IP-CIDR,127.0.0.0/8,DIRECT,no-resolve",
# Home's own public IP (RustDesk, Gitea): never via a foreign exit.
"IP-CIDR,79.111.14.0/32,DIRECT,no-resolve", "DOMAIN-SUFFIX,sanjeev.ru,DIRECT"]
for name, (_, nets) in CLIENTS.items():
for name, (_, nets, _) in clients.items():
# Through a switch group: BroV turns client networks on/off without a reload.
rules += [f"IP-CIDR,{n},{name}-sw,no-resolve" for n in nets]
rules += [f"DOMAIN-SUFFIX,{d},ai-out" for d in AI_DOMAINS]
@@ -188,7 +195,8 @@ def main():
"url": "https://www.gstatic.com/generate_204", "interval": 120, "tolerance": 100, "lazy": False},
] + [
# Client networks: off (REJECT) until switched on in BroV.
{"name": f"{n}-sw", "type": "select", "proxies": ["REJECT", n]} for n in CLIENTS
# Client networks: first option = "off" (REJECT, or DIRECT for home).
{"name": f"{n}-sw", "type": "select", "proxies": [off, n]} for n, (_, _, off) in clients.items()
],
"rules": rules,
}