Hello, I’m trying to create an app and add a WireGuard peer (all via the API).
The problem is that the WireGuard peer doesn’t end up in the same network as the app.
- Running
dig +short _apps.internal fdaa:0:33::3on the fly instance, I can see the app"tpproxy-lb0jv6". - Running
dig +short _apps.internal fdaa:0:33::3on the WireGuard peer returns nothing.
Debugging
- Using
flyctlto create both the app and the WireGuard peer works fine. - Using the API to create the app and
flyctlto create the WireGuard peer works fine. - Using the API to create both the app and the WireGuard peer doesn’t work.
I assume that my WireGuard config is in the problem.
Here are the step to recreate the issue:
Set some environment variables:
FLY_REGION="lhr"
WG_PEER_NAME="jason-tp"
FLY_API_TOKEN="YOUR-FLY-API-TOKEN"
FLY_ORG_ID="YOUR-FLY-ORG-ID"
APP_NAME="tpproxy-qezw1f"
Create the fly.toml file:
app = "tpproxy-qezw1f"
kill_signal = "SIGINT"
kill_timeout = 5
# Remove this section to build from the local Dockerfile
[build]
image = "sspreitzer/shellinabox:latest"
[experimental]
private_network=true
[[services]]
internal_port = 4200
protocol = "tcp"
[services.concurrency]
hard_limit = 25
soft_limit = 20
[[services.ports]]
port = "443"
[[services.tcp_checks]]
grace_period = "1s"
interval = "15s"
port = "4200"
restart_limit = 6
timeout = "2s"
Create a new app:
curl 'https://api.fly.io/graphql' \
-H 'Content-Type: application/json' \
-H "Authorization: Bearer ${FLY_API_TOKEN}" \
--data '{
"query": "mutation($input: CreateAppInput!){ createApp(input: $input) { app { id name organization { id slug } network runtime regions { name code } } } }",
"variables": {
"input": {
"name": "'"${APP_NAME}"'",
"runtime": "FIRECRACKER",
"organizationId": "'"${FLY_ORG_ID}"'",
"preferredRegion": "'"${FLY_REGION}"'"
}
}
}'; echo
Generate your private & public keys for WireGuard:
wg genkey > wg-test.priv && \
wg pubkey < wg-test.priv > wg-test.pub && \
cat wg-test.pub
Set your WireGuard public key (that you just created):
WG_PEER_PUBLIC_KEY="<put contents of wg-test.pub here>"
Add a WireGuard peer:
curl 'https://api.fly.io/graphql' \
-H 'Content-Type: application/json' \
-H "Authorization: Bearer ${FLY_API_TOKEN}" \
--data '{
"query": "mutation($input: AddWireGuardPeerInput!){ addWireGuardPeer(input: $input){ clientMutationId endpointip peerip pubkey } }",
"variables": {
"input": {
"organizationId": "'"${FLY_ORG_ID}"'",
"region": "'"${FLY_REGION}"'",
"name": "'"${WG_PEER_NAME}"'",
"pubkey": "'"${WG_PEER_PUBLIC_KEY}"'"
}
}
}'; echo
Create the WireGuard config file as wg0.conf:
[Interface]
PrivateKey = <put contents of wg-test.priv here>
Address = <put peerip from addWireguardPeer response here>/120
DNS = fdaa:0:33::3 # DNS From https://fly.io/docs/reference/privatenetwork/
[Peer]
PublicKey = <put pubkey from addWireGuardPeer response here>
AllowedIPs = fdaa:0:28a6::/48 # I think this is always hardcoded
Endpoint = <put endpointip from addWireGuardPeer response here>:51820
PersistentKeepalive = 15
Create the wg0 WireGuard interface:
sudo cp wg0.conf /etc/wireguard && \
wg-quick up wg0
Deploy the app:
fly deploy \
--env SIAB_USER=jason \
--env SIAB_PASSWORD=mysecretpassword \
--env SIAB_SUDO=true
Please let me know if you see anything wrong with my WireGuard config that would result in the peer not being able to see the fly instance. Thanks 
