This looks nice, but a couple of things
> curl http://public.server.address:8080/register_device?key=e83253...
> The service will return a fully templated response
It looks like the "registration" involves the server generating a private key then sending to the client, rather than the client generating a private key and sending the public key to the server.
Not only that but your example is http! Probably worth replacing that part at least in case people think http is a reasonable option.
> To authenticate the user should browse to the servers vpn address, in the example, case 192.168.1.1:8080, where they will be prompted for their 2fa code.
So when the session times out, is there any way for the client to realise this? Or does their ssh session (or whatever) just stop working?
I've on and off looked for a wireguard client which can do something like the captive portal detection on wifi. Ideally it would be an extra line in the config file (like persistentkeepalive), which does a URL pull. Could be checked periodically (like with the keepalive). If it returns "OK", then fine, if it doesn't return then there's a network problem, but if it returns a "Location" header, the client would pop up a browser at that location, allowing for session reauthentication or whatever.
I haven't found one.
> curl http://public.server.address:8080/register_device?key=e83253...
> The service will return a fully templated response
It looks like the "registration" involves the server generating a private key then sending to the client, rather than the client generating a private key and sending the public key to the server.
Not only that but your example is http! Probably worth replacing that part at least in case people think http is a reasonable option.
> To authenticate the user should browse to the servers vpn address, in the example, case 192.168.1.1:8080, where they will be prompted for their 2fa code.
So when the session times out, is there any way for the client to realise this? Or does their ssh session (or whatever) just stop working?
I've on and off looked for a wireguard client which can do something like the captive portal detection on wifi. Ideally it would be an extra line in the config file (like persistentkeepalive), which does a URL pull. Could be checked periodically (like with the keepalive). If it returns "OK", then fine, if it doesn't return then there's a network problem, but if it returns a "Location" header, the client would pop up a browser at that location, allowing for session reauthentication or whatever.
I haven't found one.