WireGuard Peer Management: Add/List/Delete Peers via API

- Agent: wg_add_peer, wg_delete_peer, wg_list_peers Commands
- Keypair-Generierung auf der Firewall (wg genkey/pubkey)
- Automatische IP-Vergabe aus dem Tunnel-Subnetz
- WAN-IP Auto-Detection via Default-Route Interface
- Endpoint als Parameter uebergebbar (fuer DynDNS etc.)
- Config-Aenderungen direkt in config.xml (Go-basiert, kein PHP)
- configctl wireguard configure fuer Live-Reload
- Client-Config in Response (ready for import)
- Server-Name default: ALWAYSON_VPN
- Backend: 3 neue API-Endpoints (POST/GET/DELETE)
- README mit vollstaendiger Dokumentation

backend/api/tunnel_proxy.go

@@ -26,6 +26,11 @@ func (h *Handler) setupTunnelRoutes(mux *http.ServeMux, hub *ws.Hub) {
 	mux.HandleFunc("PUT /api/v1/agents/{id}/proxy/{tunnel_id}/", h.httpProxy(hub))
 	mux.HandleFunc("DELETE /api/v1/agents/{id}/proxy/{tunnel_id}/", h.httpProxy(hub))
 	
+	// WireGuard-Endpoints
+	mux.HandleFunc("POST /api/v1/agents/{id}/wireguard/peers", h.wgAddPeer(hub))
+	mux.HandleFunc("GET /api/v1/agents/{id}/wireguard/peers", h.wgListPeers(hub))
+	mux.HandleFunc("DELETE /api/v1/agents/{id}/wireguard/peers/{uuid}", h.wgDeletePeer(hub))
+
 	// Backup-Endpoints
 	mux.HandleFunc("POST /api/v1/agents/{id}/backup", h.triggerBackup(hub))
 	mux.HandleFunc("GET /api/v1/agents/{id}/backups", h.listBackups())

backend/api/wireguard.go

@@ -0,0 +1,100 @@
+package api
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"time"
+
+	"github.com/cynfo/rmm-backend/ws"
+)
+
+// POST /api/v1/agents/{id}/wireguard/peers — Neuen WG-Peer anlegen
+func (h *Handler) wgAddPeer(hub *ws.Hub) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		agentID := r.PathValue("id")
+
+		var req struct {
+			Name       string `json:"name"`
+			AllowedIPs string `json:"allowed_ips"`
+			DNS        string `json:"dns"`
+			ServerName string `json:"server_name"`
+		}
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil || req.Name == "" {
+			writeError(w, http.StatusBadRequest, "Parameter 'name' erforderlich")
+			return
+		}
+
+		params := map[string]interface{}{
+			"name": req.Name,
+		}
+		if req.AllowedIPs != "" {
+			params["allowed_ips"] = req.AllowedIPs
+		}
+		if req.DNS != "" {
+			params["dns"] = req.DNS
+		}
+		if req.ServerName != "" {
+			params["server_name"] = req.ServerName
+		}
+
+		h.sendCommandAndWait(hub, agentID, "wg_add_peer", params, 30, w)
+	}
+}
+
+// DELETE /api/v1/agents/{id}/wireguard/peers/{uuid} — Peer loeschen
+func (h *Handler) wgDeletePeer(hub *ws.Hub) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		agentID := r.PathValue("id")
+		peerUUID := r.PathValue("uuid")
+
+		params := map[string]interface{}{
+			"peer_uuid": peerUUID,
+		}
+
+		h.sendCommandAndWait(hub, agentID, "wg_delete_peer", params, 30, w)
+	}
+}
+
+// GET /api/v1/agents/{id}/wireguard/peers — Alle Peers auflisten
+func (h *Handler) wgListPeers(hub *ws.Hub) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		agentID := r.PathValue("id")
+
+		if !hub.IsAgentConnected(agentID) {
+			writeError(w, http.StatusServiceUnavailable, "Agent nicht verbunden")
+			return
+		}
+
+		serverName := r.URL.Query().Get("server_name")
+		params := map[string]interface{}{}
+		if serverName != "" {
+			params["server_name"] = serverName
+		}
+
+		cmdID := generateID()
+		cmd := map[string]interface{}{
+			"type":    "command",
+			"id":      cmdID,
+			"command": "wg_list_peers",
+			"params":  params,
+		}
+
+		responseCh := hub.RegisterResponseWaiter(cmdID)
+		defer hub.UnregisterResponseWaiter(cmdID)
+
+		cmdJSON, _ := json.Marshal(cmd)
+		if err := hub.SendToAgent(agentID, cmdJSON); err != nil {
+			log.Printf("WG list peers senden fehlgeschlagen: %v", err)
+			writeError(w, http.StatusInternalServerError, "Command senden fehlgeschlagen")
+			return
+		}
+
+		select {
+		case resp := <-responseCh:
+			writeJSON(w, http.StatusOK, resp)
+		case <-time.After(30 * time.Second):
+			writeError(w, http.StatusGatewayTimeout, "Timeout")
+		}
+	}
+}