909 karma · joined July 20, 2010
rudasn+hn@gmail.com; twitter.com/rudasn; github.com/rudasn
I don't thing there's a framework or library that does that.
Time spent learning django is time well spent in my book.
I just want to avoid all that custom client stuff.
I don't have a solution, but I was experimenting on having a unique network url that would show different content depending if you're hitting it via the wireguard connection or not. Pretty basic stuff, just firewall rules and nginx proxying. Add the (hub) endpoint to client's AllowedIPs and route traffic on the hub depending on the networ interface and port the traffic is coming from.
So the client would connect to the wg network and open up the network page (eg. home.rudasn.wirehub.org).
If the connection is established, they would see a welcome message or whatever (if they need to update their config maybe a link to get their new one).
If the connection is not via the wg tunnel, they would see a message to first connect to the wireguard vpn. And if it's their first time, directions on how to install the official client and get their config from their admin (via wirehub.org or whatnot).
It's nice to have that automated via a custom client, but I don't think it's such a huge issue - if you would only update configs for client devices sporadically and have the server peers polling for updates every x seconds.
The downside of custom client apps is another security layer to consider, which nobody has the time for.
Yeah it would be nice to have a negated allowed ips list, or adding an ! to signify "not this one". Wonder how difficult that would be to implement.
It's one of the reasons I'm working on wirehub[0], as a way to distribute configs to both end users (share a link) and machines (have a script to periodically pull from wirehub).
Not the perfect solution, but one that does not require additional clients/agents/software to be installed.
Genuinely asking, never tried myself but seems plausible.
I was surprised when they shut that down too.
That explains everything you need to know to get started.
And google MDN.
It would be nice to include the generated sql queries along with the code samples though. I've been on a similar path recently and being able to see the queries was really helpful (even the ones that failed!).
> I didn't have time to write a short letter, so I wrote a long one instead. Mark Twain [0]
[0] https://www.goodreads.com/quotes/21422-i-didn-t-have-time-to...
You define networks, add devices, label them, and create access rules based on those labels so that working with addressess and allowed ips is more user friendly.
Then you can create invites so that sharing the configs with the right people or machines also becomes much easier.
But give me 40x for any assets or endpoints that track me instead of blocking the whole page. How much more difficult would that be technically?
Actually, no. I want a single db to be the destination, receiving data from multiple tenant dbs.
The tenant dbs do not have 'tenant' columns, but the destination would have one to differentiate between them.
The use is being able to run reports against all tenant dbs with tools like metabase, or just plain sql, without having to access each tenant db individually.
It's more involved that what I'm describing as db constraints and foreign keys / pk uniqueness would need to be worked around, but from first glance this tool seems like a good start towards that direction.
What do you think?
If my setup is db-per-tenant can I push/pull all data into a single database that would have an additional 'tenant_id' column?
For sake of simplicity, let's assume all tenant dbs have the same schemas.
> We recognize you are attempting to access this website from a country belonging to the European Economic Area (EEA) including the EU which enforces the General Data Protection Regulation (GDPR) and therefore access cannot be granted at this time. For any issues, contact news@wkow.com or call 608-274-1234.
Nice.
What does craft your own mentors mean? I'm not sure your target audience (educators, parents?) are having that problem. "Oh, if I could just craft my own mentors these kids would learn so much more" - doesn't make any sense.
The stock/ai/filler photos aren't helpful either. I'm thinking "what's that" instead of "oh, it does that too, nice!".
Maybe you need to be more clear, explit and upfront about what this product does in the language your target audience is actually currently using.
Having the video embedded on the page, as opposed to having to click a button, would also probably work best. Easier for interested users, and less clutter for prospects leaving just one call to action, "Try now".
How do you manage peers and configs?
So one area to focus on is making it super easy for patients to obtain their data in electronic form, and parsing that data into a common/shared schema (like hl7 or fhir) to make it workable.
Once the data is there, you can focus on "social" features like inviting others to view all or some of your data and be able to leave comments/make annotations. Less focus on who the other user is, more on how effortless would be for them to navigate through the data, take notes, generate a report.
Then you dont need to worry about issues related to marketplaces, like bringing the providers onboard first, as patients will be pulling them in as needed via simple invite links.
Patients could also make their data public for experts to navigate, compare, or examine. This is where the magic occurs, if you manage to figure out the User Experience doctors need to make full use of all the data and tools you give them.
Legends indeed.
I use it to bootstrap new servers (security, dependencies, etc) and deploy apps on them both on prem and vps. I have playbooks and roles for everything I ever needed.
I don't really like it but it's a tool that you can bend to your needs and move along.
If routing was possible with just the public key, after wg has verified the packets, I would assume it'd be easier to maintain (and more flexible).
For example, I could run a "public" wg peer where peers could just join me without me messing with cidrs and whatnot. I wouldn't care what their vpn ip is, as I may not be their only peer and they could be using any number of internal addressess.
Other than having an interface per peer of course.
What an amazing project, well done!
I'm learning as I'm going and my goal is to come up with a way to build secure/beyondcorp/zerotrust-style networks using only existing tools and established tech, unless absolutely necessary.
Tools I'm using include wireguard, iptables, nftables, nginx, ping, traceroute, and nmap.
Which articles, books, authors, or repos must I read and which concepts must I understand?
Trying to find real knowledge about this stuff online is a nightmare!
Yeah, many ways to do it, one is running your own DNS server and have wireguard connections use that DNS server.
I want to avoid having DNS issues, so I'm thinking more like this:
1. DNS CNAME *.internal.example.com 123.23.45.67
2. On 123.23.45.67, run wg.
3. On 123.23.45.67 , run nginx. nginx must be in the same network to do geo blocking on Wireguard peer addressess.
4. Create one nginx server config per service to map domain names to upstream servers. Use variables for upstream servers, allow nginx to start even if upstreams unreachable. Add internal locations for custom errors (Forbidden, Unreachable, etc).
5. When connecting to 123.23.45.67 via Wireguard (ie, Peer Endpoint = 123.23.45.67), ensure 123.23.45.67 is in the range defined by Peer AllowedIPs.