nopdotcom/wireguard-coreos

WireGuard builds for CoreOS

WireGuard builds for CoreOS

Automatically built WireGuard torcx packages for latest CoreOS releases.

Built by Travis CI to the releases page of this GitHub repository.

Getting Started

Via Container Linux Config and Ignition (preferred)

You can use the example Container Linux Config, then convert it onto a ignition.json file and provide it to your CoreOS instances.

Manually

• Download the torcx package for your CoreOS release from the releases page to your torcx folder.

source /etc/os-release
wget https://github.com/miguelangel-nubla/WireGuard-CoreOS/releases/download/latest-all/WireGuard.CoreOS_${VERSION_ID}.torcx.tgz \
-O /var/lib/torcx/store/${VERSION_ID}/WireGuard:CoreOS_${VERSION_ID}.torcx.tgz

• Add a new torcx profile.

jq '.value.images += [{ "name": "WireGuard", "reference": "'CoreOS_${VERSION_ID}'" }]' /usr/share/torcx/profiles/vendor.json > /etc/torcx/profiles/wg.json

• echo wg > /etc/torcx/next-profile
• Reboot. WireGuard should be available in /run/torcx/bin/wg. Installation is done.
• After each reboot and before using wireguard you should load the required kernel modules:

source /run/metadata/torcx
/sbin/modprobe ip6_udp_tunnel
/sbin/modprobe udp_tunnel
/sbin/insmod ${TORCX_UNPACKDIR}/WireGuard/lib/modules/$(uname -r)/extra/wireguard.ko

• Load you config with /run/torcx/bin/wg-quick

How to handle CoreOS updates

The /etc/wireguard-setup script at the example Container Linux Config will try to fetch the torcx package for the new CoreOS version.

If it fails or there are no packages available for the new version, it will fallback to try building WireGuard directly on the target machine.

Build yourself

For Ubuntu, git clone this repo, then

cd WireGuard-CoreOS
sudo apt-get update
sudo apt-get install -y curl gpg2 bzip2 systemd-container dirmngr
bash run.sh

Packages will be at output/

Notes

At the time of writing, building the latest WireGuard sources result in a Segmentation fault on most of the CoreOS developer container releases.
The Travis CI job will keep trying daily until the upstream code is fixed.

The tag latest-all on the releases page will always have the latest WireGuard release compatible with each respective CoreOS release.

Based on

• coreos/bugs#2225 (comment)
• https://github.com/nopdotcom/coreos-build-wireguard