# Plan: WG Auto Up + PrivateKey Node Registration

## TL;DR
> Fix WireGuard interface goes down after `update.sh` (container restart) and allow registering nodes using PrivateKey (from MikroTik export) instead of requiring PublicKey manually.

**Deliverables**:
- Auto `wg up` Local Primary Node on server startup (main.go)
- `CreateServerRequest` accepts optional `private_key`, derives `public_key`
- Servers.vue "Register New Node" form accepts PrivateKey input
- Servers.vue edit PublicKey field fix (if needed)

**Estimated Effort**: Quick
**Parallel Execution**: NO (sequential backend→frontend)
**Critical Path**: main.go auto-up → servers.go Create → Servers.vue form

---

## Context

User reported:
1. After running `update.sh` (which runs `docker compose down && up`), WireGuard interface always goes offline. No code auto-initializes WG on startup — only `wgmanager.New()` is called, never `wgMgr.Up()`.
2. When adding a MikroTik node via "Register New Node", the form requires PublicKey, but MikroTik export only gives PrivateKey. Need to accept PrivateKey and derive PublicKey.

---

## Work Objectives

### Core Objectives
- WireGuard interface auto-starts after container restart
- Node registration can accept PrivateKey (derive PublicKey from it)

### Must Have
- Auto `wg up` for Local Primary Node after firewall recovery in main.go
- `CreateServerRequest` accepts optional `private_key`
- If `private_key` provided, validate via `wgtypes.ParseKey`, derive `public_key`
- Servers.vue shows PrivateKey input option when registering

### Must NOT Have
- Do NOT change the `Local Primary Node` auto-provisioning on first boot (already correct)
- Do NOT store PrivateKey as plaintext (already handled — WgServer.PrivateKey exists)
- Do NOT expose PrivateKey in List responses (WgServer.PrivateKey has `json:"-"`)
- Do NOT change the `/devices/:id/regenerate-keys` or device key handling

---

## TODOs

- [ ] 1. **main.go: auto `wg up` on startup**

  **What to do**:
  - Add `"encoding/hex"` to imports
  - After firewall recovery section (after `fw.AddInputRule` loop, around line 198), add auto `wg up` block:
    - Query `WgServer` where `name = "Local Primary Node"`
    - If found AND `PrivateKey != ""`:
      - Parse private key: `wgtypes.ParseKey(localPrimary.PrivateKey)`
      - Convert to hex: `hex.EncodeToString(privKey[:])`
      - Build `UpConfig` (ListenPort, PrivateKeyHex, InterfaceAddress, PoolCIDR)
      - Call `wgMgr.Up(cfg)`
      - On success: `peerSyncer.SyncLocalPeers()`
  - Match exact pattern from `WgHandler.Up()` in `wg.go:53-78`

  **Must NOT do**:
  - Don't break first-boot auto-provisioning (serverCount == 0 block)
  - Don't move/restructure existing startup code
  - Don't add new config flags

  **QA Scenarios**:
  ```
  Scenario: WG auto-starts after container start
    Tool: Playwright (using dashboard /wg/status page)
    Preconditions: Server freshly started (docker compose up)
    Steps:
      1. Login as admin
      2. Navigate to any page
      3. Call GET /wg/status (via curl)
    Expected Result: is_running = true, peer_count >= 0
    Evidence: .sisyphus/evidence/task1-wg-status.json
  ```

- [ ] 2. **servers.go: accept PrivateKey in Create**

  **What to do**:
  - Add `PrivateKey *string json:"private_key"` to `CreateServerRequest`
  - Make `PublicKey` NOT required (remove `binding:"required"` or make it optional)
  - In `Create()` handler, after parsing request:
    - If `req.PrivateKey != nil`:
      - Validate: `k, err := wgtypes.ParseKey(*req.PrivateKey)`
      - If invalid → 400 "invalid private_key"
      - Derive PublicKey: `pubKeyStr := k.PublicKey().String()`
      - Store both: `server.PrivateKey = *req.PrivateKey`, `server.PublicKey = pubKeyStr`
    - Else if `req.PublicKey != ""`:
      - Use as-is (existing logic)
    - Else: 400 "either public_key or private_key is required"

  **Must NOT do**:
  - Don't change the `UpdateServerRequest` — that's T6 already done
  - Don't remove existing validation for `PublicKey` if `PrivateKey` not provided

  **QA Scenarios**:
  ```
  Scenario: Create node with private key
    Tool: Bash (curl)
    Preconditions: Admin JWT token exists
    Steps:
      1. POST /api/v1/servers with body: {"name":"test-node","private_key":"<valid_base64_privkey>","public_endpoint":"10.0.0.1:51820","listen_address":"0.0.0.0","listen_port":51820}
      2. Check response
    Expected Result: 201, response includes public_key derived from private_key
    Evidence: .sisyphus/evidence/task2-create-with-privkey.json

  Scenario: Node creation fails with invalid private key
    Tool: Bash (curl)
    Preconditions: Admin JWT token
    Steps:
      1. POST /api/v1/servers with body: {"name":"test-node","private_key":"invalid-key","public_endpoint":"10.0.0.1:51820","listen_address":"0.0.0.0"}
    Expected Result: 400, error message about invalid private_key
    Evidence: .sisyphus/evidence/task2-invalid-privkey.json
  ```

- [ ] 3. **Servers.vue: update Register New Node form**

  **What to do**:
  - Read the current Register form (line 8-30 of Servers.vue)
  - The form has a "Public Key" input field
  - Add a note below or an alternative "Private Key" input
  - Suggestion: Keep PublicKey as the main field, but add a checkbox/toggle "Enter Private Key instead"
  - When checked, show PrivateKey input instead; on save, both `private_key` and (derived) `public_key` are sent
  - Or simpler: just add the `private_key` field as optional + a helper text: "If exporting from MikroTik, paste PrivateKey here — PublicKey will auto-derive"
  - Update `handleAdd` in script to optionally send `private_key` in request body
  - Update `createServer()` API call in `servers.ts` to accept `private_key` parameter

  **QA Scenarios**:
  ```
  Scenario: Register node with private key via UI
    Tool: Playwright
    Preconditions: Logged in as admin, on Nodes page
    Steps:
      1. Click "+ Register Node"
      2. Fill name, private_key, public_endpoint, listen_address
      3. Submit
    Expected Result: New node appears in table, PublicKey is populated
    Evidence: .sisyphus/evidence/task3-form-private-key.png
  ```

- [ ] 4. **update.sh: add automatic /wg/up after restart**

  **What to do**:
  - After `docker compose up -d` and migration steps (around line ... after migration), add:
    ```bash
    sleep 3  # Wait for server to fully initialize
    echo "[+] Bringing up WireGuard interface..."
    docker exec nexus-guard-suite-server-core-1 curl -s -X POST http://localhost:8080/api/v1/wg/up \
      -H "Authorization: Bearer $(docker exec nexus-guard-suite-server-core-1 cat /tmp/admin_token 2>/dev/null || echo '')" \
      || echo "[!] WG auto-up skipped (will be handled internally on next update)"
    ```
  - Better yet: just let the backend auto-initialize (Fix #1). update.sh change is optional/minor.

  **QA Scenarios**:
  ```
  Scenario: update.sh leaves WG running
    Tool: Bash
    Preconditions: Remote server (172.20.8.191) with existing deployment
    Steps:
      1. Run ./update.sh
      2. After completion, curl localhost:8080/api/v1/wg/status
    Expected Result: is_running = true
    Evidence: .sisyphus/evidence/task4-update-sh-wg-status.json
  ```

---

## Final Verification

- [ ] F1: `go build -tags dev ./...` passes
- [ ] F2: `npm run build` passes
- [ ] F3: Server starts, `/wg/status` shows is_running=true
- [ ] F4: Can register a node using PrivateKey via API + UI

## Commit Strategy

- Commit #1: Backend — auto wg up on startup + accept PrivateKey in server create
- Commit #2: Frontend — PrivateKey input option in Register Node form