app.py

from flask import Flask, render_template, request, redirect, url_for, send_file, flash, jsonify
import os
import json
import ipaddress
import base64
from datetime import datetime
from pathlib import Path
from io import BytesIO
import subprocess
import time

from cryptography.hazmat.primitives.asymmetric import x25519
from cryptography.hazmat.primitives import serialization

app = Flask(__name__)
app.config['SECRET_KEY'] = 'change-this-secret'
# API key for REST API - override with env var WG_API_KEY
API_KEY = os.environ.get('WG_API_KEY', 'change-this-api-key')

BASE_DIR = Path(__file__).resolve().parent
DATA_FILE = BASE_DIR / 'data.json'
CONFIG_DIR = BASE_DIR / 'configs'
CONFIG_DIR.mkdir(exist_ok=True)

# defaults
PRIVATE_NETWORK_BASE = ipaddress.ip_network('10.200.200.0/24')

# Utility functions

def load_data():
    if not DATA_FILE.exists():
        DATA_FILE.write_text(json.dumps({'tunnels': []}, indent=2))
    with DATA_FILE.open('r') as f:
        return json.load(f)


def save_data(data):
    with DATA_FILE.open('w') as f:
        json.dump(data, f, indent=2)


def gen_keypair():
    priv = x25519.X25519PrivateKey.generate()
    priv_raw = priv.private_bytes(
        encoding=serialization.Encoding.Raw,
        format=serialization.PrivateFormat.Raw,
        encryption_algorithm=serialization.NoEncryption(),
    )
    pub_raw = priv.public_key().public_bytes(
        encoding=serialization.Encoding.Raw,
        format=serialization.PublicFormat.Raw,
    )
    priv_b64 = base64.b64encode(priv_raw).decode()
    pub_b64 = base64.b64encode(pub_raw).decode()
    return priv_b64, pub_b64


def get_system_ipv4_addresses():
    """Return IPv4 addresses configured on this host (e.g., from `ip addr`)."""
    ips = set()
    try:
        out = subprocess.check_output(["ip", "-4", "addr", "show"], text=True, stderr=subprocess.DEVNULL)
        for line in out.splitlines():
            line = line.strip()
            if line.startswith('inet '):
                parts = line.split()
                addr = parts[1]
                ip_str = addr.split('/')[0]
                ips.add(ip_str)
    except Exception:
        # If `ip` is not available or parsing fails, return empty set
        pass
    return ips


def allocate_next_30(used_networks, used_ips=None):
    # Scan /24 for next free /30 and skip any subnet whose host IPs are already used
    if used_ips is None:
        used_ips = set()
    for subnet in PRIVATE_NETWORK_BASE.subnets(new_prefix=30):
        if str(subnet) in used_networks:
            continue
        # derive host addresses in this /30: network+1 (server), network+2 (peer)
        try:
            server_ip = str(ipaddress.ip_address(int(subnet.network_address) + 1))
            peer_ip = str(ipaddress.ip_address(int(subnet.network_address) + 2))
        except Exception:
            continue
        # skip if any of the host IPs already exist on the system or in use
        if server_ip in used_ips or peer_ip in used_ips:
            continue
        return subnet
    raise RuntimeError('No available /30 subnets left in {}'.format(PRIVATE_NETWORK_BASE))


def get_system_listening_ports():
    """Return a set of listening ports for existing WireGuard interfaces by calling `wg`.
    If `wg` is not available or fails, return an empty set.
    """
    ports = set()
    try:
        out = subprocess.check_output(["wg"], text=True, stderr=subprocess.DEVNULL)
        for line in out.splitlines():
            line = line.strip()
            if line.startswith('listening port:'):
                try:
                    ports.add(int(line.split(':', 1)[1].strip()))
                except Exception:
                    pass
    except Exception:
        # wg not available or returned unexpected output
        pass
    return ports


def get_next_listen_port(used_ports, start=51820):
    """Choose the next available listen port starting at `start`, considering both
    stored tunnel ports and system WireGuard listening ports.
    """
    system_ports = get_system_listening_ports()
    all_used = set(p for p in (used_ports or set()) if p is not None) | system_ports
    port = start
    while port in all_used:
        port += 1
    return port


def all_ips_as_cidr(network_str):
    n = ipaddress.ip_network(network_str)
    return [str(ip) + '/32' for ip in n.hosts()] if n.prefixlen < 32 else [str(n.network_address) + '/32']


# ----------------------- API helper & auth -----------------------
from functools import wraps

def require_api_key(f):
    @wraps(f)
    def decorated(*args, **kwargs):
        provided = None
        # check header
        if 'X-API-Key' in request.headers:
            provided = request.headers.get('X-API-Key')
        # fallback to query param
        if not provided:
            provided = request.args.get('api_key')
        # fallback to json body
        if not provided and request.is_json:
            try:
                provided = request.get_json().get('api_key')
            except Exception:
                provided = None
        if provided != API_KEY:
            return jsonify({'error': 'unauthorized'}), 401
        return f(*args, **kwargs)
    return decorated


def serialize_tunnel_public(t):
    """Return dict with non-sensitive tunnel info for API responses."""
    return {
        'id': t['id'],
        'name': t['name'],
        'created': t['created'],
        'external_subnet': t['external_subnet'],
        'allocated_subnet': t['allocated_subnet'],
        'server_ip': t['server_ip'],
        'listen_port': t.get('listen_port'),
        'server_pub': t.get('server_pub'),
        'peer_pub': t.get('peer', {}).get('peer_pub'),
        'peer_ip': t.get('peer', {}).get('peer_ip'),
        'endpoint': t.get('peer', {}).get('endpoint'),
        'wg_started': t.get('wg_started', False),
        'wg_start_msg': (t.get('wg_start_msg') or '')[:200],
    }


def build_server_config(tunnel):
    # Build the server wg config according to your template and tunnel data
    server_priv = tunnel['server_priv']
    server_ip = tunnel['server_ip']
    listen_port = tunnel.get('listen_port', 51820)
    external_subnet = tunnel['external_subnet']
    snat_to = server_ip
    masq_dest = external_subnet
    peer = tunnel['peer']

    allowed_ips = [peer['peer_ip'] + '/32'] + all_ips_as_cidr(external_subnet)
    allowed_ips_str = ', '.join(allowed_ips)

    conf = f"""[Interface]
Address = {server_ip}/32
PrivateKey = {server_priv}
ListenPort = {listen_port}
# publickey = {tunnel.get('server_pub', '')}

# System Configuration
PreUp = sysctl -w net.ipv4.ip_forward=1
PreUp = sysctl -w net.ipv4.conf.all.rp_filter=0
PreUp = sysctl -w net.ipv4.conf.default.rp_filter=0
PreUp = sysctl -w net.ipv4.conf.all.proxy_arp=1
PreUp = sysctl -w net.ipv4.conf.eth0.proxy_arp=1

# Set rp_filter for wg0 after interface is created
PostUp = sysctl -w net.ipv4.conf.wg0.rp_filter=0

# Forwarding erlauben (minimal / funktional)
PostUp   = iptables -A FORWARD -i %i -j ACCEPT
PostUp   = iptables -A FORWARD -o %i -j ACCEPT
PostUp   = iptables -A FORWARD -i eth0 -o %i -j ACCEPT
PostUp   = iptables -A FORWARD -i %i -o eth0 -j ACCEPT
PostDown = iptables -D FORWARD -i %i -j ACCEPT
PostDown = iptables -D FORWARD -o %i -j ACCEPT
PostDown = iptables -D FORWARD -i eth0 -o %i -j ACCEPT
PostDown = iptables -D FORWARD -i %i -o eth0 -j ACCEPT

# SNAT für Ausgehenden Traffic auf eth0
PostUp   = iptables -t nat -A POSTROUTING -s 185.14.93.10/32 -o %i -j SNAT --to-source {snat_to}
PostDown = iptables -t nat -D POSTROUTING -s 185.14.93.10/32 -o %i -j SNAT --to-source {snat_to}

# SNAT für eingehenden Traffic von eth0
PostUp   = iptables -t nat -A POSTROUTING -d {masq_dest} -o %i -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -d {masq_dest} -o %i -j MASQUERADE

[Peer]
PublicKey = {peer['peer_pub']}
PersistentKeepalive = 25
AllowedIPs = {allowed_ips_str}
# privatekey = {peer.get('peer_priv','')}
"""
    return conf


def build_client_config(tunnel):
    # Build client config that the peer will import
    server_pub = tunnel['server_pub']
    peer = tunnel['peer']
    client_conf = f"""[Interface]
Address = {peer['peer_ip']}/32
PrivateKey = {peer['peer_priv']}
DNS = 1.1.1.1

[Peer]
PublicKey = {server_pub}
Endpoint = {peer.get('endpoint','')}
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
"""
    return client_conf


def run_wg_quick_up(conf_path):
    """Attempt to run `wg-quick up <conf_path>`. If it fails, try `wg-quick down` then `wg-quick up` once.
    Returns (success: bool, message: str).
    """
    conf_str = str(conf_path)
    try:
        r = subprocess.run(["wg-quick", "up", conf_str], capture_output=True, text=True)
    except FileNotFoundError:
        return False, 'wg-quick not found'
    if r.returncode == 0:
        return True, r.stdout.strip() or 'started'
    # try down then up
    try:
        subprocess.run(["wg-quick", "down", conf_str], capture_output=True, text=True)
    except FileNotFoundError:
        pass
    try:
        r2 = subprocess.run(["wg-quick", "up", conf_str], capture_output=True, text=True)
    except FileNotFoundError:
        return False, 'wg-quick not found'
    if r2.returncode == 0:
        return True, r2.stdout.strip() or 'started after down'
    # both failed
    msg = (r2.stderr or r2.stdout or '').strip()
    return False, msg or f'wg-quick failed with code {r2.returncode}'


@app.route('/')
def index():
    data = load_data()
    return render_template('index.html', tunnels=data['tunnels'])


@app.route('/create', methods=['POST'])
def create():
    name = request.form.get('name') or f'tunnel-{int(datetime.utcnow().timestamp())}'
    external_subnet = request.form.get('external_subnet')
    endpoint = request.form.get('endpoint', '')

    try:
        ipaddress.ip_network(external_subnet)
    except Exception:
        flash('Ungültiges Subnetz', 'error')
        return redirect(url_for('index'))

    data = load_data()
    used_networks = {t['allocated_subnet'] for t in data['tunnels']}
    # collect used IPs from existing tunnels and system interfaces to avoid collisions
    used_ips = {t.get('server_ip') for t in data['tunnels']} | {t.get('peer', {}).get('peer_ip') for t in data['tunnels']}
    used_ips = {ip for ip in used_ips if ip}
    system_ips = get_system_ipv4_addresses()
    used_ips |= system_ips

    subnet = allocate_next_30(used_networks, used_ips)

    # allocate listen port starting at 51820 and increment; consider running wg interfaces
    used_ports = {t.get('listen_port') for t in data['tunnels'] if t.get('listen_port') is not None}
    listen_port = get_next_listen_port(used_ports, start=51820)

    server_priv, server_pub = gen_keypair()
    peer_priv, peer_pub = gen_keypair()

    server_ip = str(ipaddress.ip_address(int(subnet.network_address) + 1))
    peer_ip = str(ipaddress.ip_address(int(subnet.network_address) + 2))

    tunnel = {
        'id': len(data['tunnels']) + 1,
        'name': name,
        'created': datetime.utcnow().isoformat(),
        'external_subnet': external_subnet,
        'allocated_subnet': str(subnet),
        'server_priv': server_priv,
        'server_pub': server_pub,
        'server_ip': server_ip,
        'listen_port': listen_port,
        'peer': {
            'peer_priv': peer_priv,
            'peer_pub': peer_pub,
            'peer_ip': peer_ip,
            'endpoint': endpoint,
        }
    }

    # write server config file to parent directory and attempt to start it with wg-quick
    conf = build_server_config(tunnel)
    conf_path = BASE_DIR.parent / f"{tunnel['name']}.conf"
    conf_path.write_text(conf)

    success, msg = run_wg_quick_up(conf_path)
    tunnel['wg_started'] = success
    tunnel['wg_start_msg'] = msg

    data['tunnels'].append(tunnel)
    save_data(data)

    if success:
        flash(f"Tunnel erstellt und wg-quick up gestartet (port {listen_port})", 'success')
    else:
        flash(f"Tunnel erstellt, wg-quick up fehlgeschlagen: {msg}", 'error')
    return redirect(url_for('index'))


@app.route('/tunnel/<int:tunnel_id>')
def show_tunnel(tunnel_id):
    data = load_data()
    t = next((x for x in data['tunnels'] if x['id'] == tunnel_id), None)
    if not t:
        flash('Tunnel nicht gefunden', 'error')
        return redirect(url_for('index'))
    return render_template('tunnel.html', t=t)


@app.route('/tunnel/<int:tunnel_id>/start', methods=['POST'])
def web_start_tunnel(tunnel_id):
    data = load_data()
    t = next((x for x in data['tunnels'] if x['id'] == tunnel_id), None)
    if not t:
        flash('Tunnel nicht gefunden', 'error')
        return redirect(url_for('index'))
    conf_path = BASE_DIR.parent / f"{t['name']}.conf"
    if not conf_path.exists():
        flash('Config nicht gefunden', 'error')
        return redirect(url_for('show_tunnel', tunnel_id=tunnel_id))
    success, msg = run_wg_quick_up(conf_path)
    t['wg_started'] = success
    t['wg_start_msg'] = msg
    save_data(data)
    if success:
        flash('Tunnel gestartet', 'success')
    else:
        flash(f'Fehler beim Starten: {msg}', 'error')
    return redirect(url_for('show_tunnel', tunnel_id=tunnel_id))


@app.route('/tunnel/<int:tunnel_id>/stop', methods=['POST'])
def web_stop_tunnel(tunnel_id):
    data = load_data()
    t = next((x for x in data['tunnels'] if x['id'] == tunnel_id), None)
    if not t:
        flash('Tunnel nicht gefunden', 'error')
        return redirect(url_for('index'))
    conf_path = BASE_DIR.parent / f"{t['name']}.conf"
    if not conf_path.exists():
        flash('Config nicht gefunden', 'error')
        return redirect(url_for('show_tunnel', tunnel_id=tunnel_id))
    success, msg = run_wg_quick_down(conf_path)
    t['wg_started'] = not success
    t['wg_start_msg'] = msg
    save_data(data)
    if success:
        flash('Tunnel gestoppt', 'success')
    else:
        flash(f'Fehler beim Stoppen: {msg}', 'error')
    return redirect(url_for('show_tunnel', tunnel_id=tunnel_id))


@app.route('/tunnel/<int:tunnel_id>/edit', methods=['POST'])
def web_edit_tunnel(tunnel_id):
    data = load_data()
    idx = next((i for i, x in enumerate(data['tunnels']) if x['id'] == tunnel_id), None)
    if idx is None:
        flash('Tunnel nicht gefunden', 'error')
        return redirect(url_for('index'))
    t = data['tunnels'][idx]
    name = request.form.get('name')
    endpoint = request.form.get('endpoint')
    external_subnet = request.form.get('external_subnet')
    restart = request.form.get('restart') == 'on'

    if external_subnet:
        try:
            ipaddress.ip_network(external_subnet)
        except Exception:
            flash('Ungültiges Subnetz', 'error')
            return redirect(url_for('show_tunnel', tunnel_id=tunnel_id))
        t['external_subnet'] = external_subnet
    if name and name != t['name']:
        old_path = BASE_DIR.parent / f"{t['name']}.conf"
        new_path = BASE_DIR.parent / f"{name}.conf"
        try:
            if old_path.exists():
                old_path.rename(new_path)
        except Exception as e:
            flash(f'Fehler beim Umbenennen: {e}', 'error')
            return redirect(url_for('show_tunnel', tunnel_id=tunnel_id))
        t['name'] = name
    if endpoint is not None:
        t['peer']['endpoint'] = endpoint

    # regenerate config
    conf = build_server_config(t)
    conf_path = BASE_DIR.parent / f"{t['name']}.conf"
    conf_path.write_text(conf)

    if restart:
        success, msg = run_wg_quick_up(conf_path)
        t['wg_started'] = success
        t['wg_start_msg'] = msg
        if success:
            flash('Tunnel neu gestartet', 'success')
        else:
            flash(f'Neustart fehlgeschlagen: {msg}', 'error')
    save_data(data)
    flash('Tunnel aktualisiert', 'success')
    return redirect(url_for('show_tunnel', tunnel_id=tunnel_id))


@app.route('/tunnel/<int:tunnel_id>/delete', methods=['DELETE'])
def web_delete_tunnel(tunnel_id):
    data = load_data()
    idx = next((i for i, x in enumerate(data['tunnels']) if x['id'] == tunnel_id), None)
    if idx is None:
        flash('Tunnel nicht gefunden', 'error')
        return redirect(url_for('index'))
    t = data['tunnels'][idx]
    conf_path = BASE_DIR.parent / f"{t['name']}.conf"
    try:
        run_wg_quick_down(conf_path)
    except Exception:
        pass
    try:
        if conf_path.exists():
            conf_path.unlink()
    except Exception as e:
        flash(f'Fehler beim Löschen der Config: {e}', 'error')
        return redirect(url_for('show_tunnel', tunnel_id=tunnel_id))
    data['tunnels'].pop(idx)
    save_data(data)
    flash('Tunnel gelöscht', 'success')
    return redirect(url_for('index'))

# ----------------------- API endpoints (require API key) -----------------------
@app.route('/api/tunnels', methods=['GET'])
@require_api_key
def api_list_tunnels():
    data = load_data()
    return jsonify([serialize_tunnel_public(t) for t in data['tunnels']])


@app.route('/api/tunnels/<int:tunnel_id>', methods=['GET'])
@require_api_key
def api_get_tunnel(tunnel_id):
    data = load_data()
    t = next((x for x in data['tunnels'] if x['id'] == tunnel_id), None)
    if not t:
        return jsonify({'error': 'not found'}), 404
    return jsonify(serialize_tunnel_public(t))


@app.route('/api/tunnels', methods=['POST'])
@require_api_key
def api_create_tunnel():
    if not request.is_json:
        return jsonify({'error': 'invalid payload, expected application/json'}), 400
    payload = request.get_json()
    name = payload.get('name') or f"tunnel-{int(datetime.utcnow().timestamp())}"
    external_subnet = payload.get('external_subnet')
    endpoint = payload.get('endpoint', '')
    if not external_subnet:
        return jsonify({'error': 'external_subnet required'}), 400
    try:
        ipaddress.ip_network(external_subnet)
    except Exception:
        return jsonify({'error': 'invalid external_subnet'}), 400

    data = load_data()
    used_networks = {t['allocated_subnet'] for t in data['tunnels']}
    used_ips = {t.get('server_ip') for t in data['tunnels']} | {t.get('peer', {}).get('peer_ip') for t in data['tunnels']}
    used_ips = {ip for ip in used_ips if ip}
    system_ips = get_system_ipv4_addresses()
    used_ips |= system_ips
    subnet = allocate_next_30(used_networks, used_ips)

    used_ports = {t.get('listen_port') for t in data['tunnels'] if t.get('listen_port') is not None}
    listen_port = get_next_listen_port(used_ports, start=51820)

    server_priv, server_pub = gen_keypair()
    peer_priv, peer_pub = gen_keypair()
    server_ip = str(ipaddress.ip_address(int(subnet.network_address) + 1))
    peer_ip = str(ipaddress.ip_address(int(subnet.network_address) + 2))

    tunnel = {
        'id': len(data['tunnels']) + 1,
        'name': name,
        'created': datetime.utcnow().isoformat(),
        'external_subnet': external_subnet,
        'allocated_subnet': str(subnet),
        'server_priv': server_priv,
        'server_pub': server_pub,
        'server_ip': server_ip,
        'listen_port': listen_port,
        'peer': {
            'peer_priv': peer_priv,
            'peer_pub': peer_pub,
            'peer_ip': peer_ip,
            'endpoint': endpoint,
        }
    }

    conf = build_server_config(tunnel)
    conf_path = BASE_DIR.parent / f"{tunnel['name']}.conf"
    conf_path.write_text(conf)

    success, msg = run_wg_quick_up(conf_path)
    tunnel['wg_started'] = success
    tunnel['wg_start_msg'] = msg

    data['tunnels'].append(tunnel)
    save_data(data)

    response = serialize_tunnel_public(tunnel)
    response['wg_started'] = success
    response['wg_start_msg'] = msg
    return jsonify(response), 201


@app.route('/api/tunnels/<int:tunnel_id>/download/server', methods=['GET'])
@require_api_key
def api_download_server(tunnel_id):
    data = load_data()
    t = next((x for x in data['tunnels'] if x['id'] == tunnel_id), None)
    if not t:
        return jsonify({'error': 'not found'}), 404
    conf = build_server_config(t)
    return send_file(BytesIO(conf.encode()), as_attachment=True, download_name=f"{t['name']}-server.conf")


@app.route('/api/tunnels/<int:tunnel_id>/download/client', methods=['GET'])
@require_api_key
def api_download_client(tunnel_id):
    data = load_data()
    t = next((x for x in data['tunnels'] if x['id'] == tunnel_id), None)
    if not t:
        return jsonify({'error': 'not found'}), 404
    client = build_client_config(t)
    return send_file(BytesIO(client.encode()), as_attachment=True, download_name=f"{t['name']}-client.conf")


# ----------------------- Traffic stats endpoints -----------------------
@app.route('/api/tunnels/<int:tunnel_id>/stats', methods=['GET'])
@require_api_key
def api_get_tunnel_stats(tunnel_id):
    """Return current counters, short-term live Bps estimate and maintained cumulative counters."""
    sample_ms = int(request.args.get('sample_ms', 500))
    data = load_data()
    idx = next((i for i, x in enumerate(data['tunnels']) if x['id'] == tunnel_id), None)
    if idx is None:
        return jsonify({'error': 'not found'}), 404
    t = data['tunnels'][idx]
    iface = t['name']
    peer_pub = t.get('peer', {}).get('peer_pub')
    if not peer_pub:
        return jsonify({'error': 'no peer public key'}), 400

    cur = read_wg_peer_transfer(iface, peer_pub)
    if cur is None:
        return jsonify({'error': 'no wg data (interface down or wg missing)'}), 503
    rx, tx = cur
    live_rx_bps, live_tx_bps = measure_live_bps(iface, peer_pub, sample_ms)

    last = t.get('last_counters', {'rx': 0, 'tx': 0})
    delta_rx = max(0, rx - last.get('rx', 0))
    delta_tx = max(0, tx - last.get('tx', 0))
    t['cumulative_rx'] = t.get('cumulative_rx', 0) + delta_rx
    t['cumulative_tx'] = t.get('cumulative_tx', 0) + delta_tx
    t['last_counters'] = {'rx': rx, 'tx': tx}
    t['last_seen'] = datetime.utcnow().isoformat()
    save_data(data)

    return jsonify({
        'interface': iface,
        'peer_pub': peer_pub,
        'current_rx': rx,
        'current_tx': tx,
        'live_rx_bps': live_rx_bps,
        'live_tx_bps': live_tx_bps,
        'cumulative_rx': t['cumulative_rx'],
        'cumulative_tx': t['cumulative_tx'],
        'last_seen': t['last_seen']
    })


@app.route('/api/tunnels/<int:tunnel_id>/stats/reset', methods=['POST'])
@require_api_key
def api_reset_tunnel_stats(tunnel_id):
    data = load_data()
    idx = next((i for i, x in enumerate(data['tunnels']) if x['id'] == tunnel_id), None)
    if idx is None:
        return jsonify({'error': 'not found'}), 404
    t = data['tunnels'][idx]
    iface = t['name']
    peer_pub = t.get('peer', {}).get('peer_pub')
    cur = read_wg_peer_transfer(iface, peer_pub) or {'rx': 0, 'tx': 0}
    rx = cur[0] if cur else 0
    tx = cur[1] if cur else 0
    t['cumulative_rx'] = 0
    t['cumulative_tx'] = 0
    t['last_counters'] = {'rx': rx, 'tx': tx}
    t['last_seen'] = datetime.utcnow().isoformat()
    save_data(data)
    return jsonify({'reset': True, 'last_counters': t['last_counters']})


def run_wg_quick_down(conf_path):
    """Run `wg-quick down <conf_path>` and return (success, message)"""
    try:
        r = subprocess.run(["wg-quick", "down", str(conf_path)], capture_output=True, text=True)
    except FileNotFoundError:
        return False, 'wg-quick not found'
    if r.returncode == 0:
        return True, r.stdout.strip() or 'stopped'
    return False, (r.stderr or r.stdout or '').strip()


def read_wg_peer_transfer(iface, peer_pub):
    """Return (rx_bytes, tx_bytes) for given peer public key on interface, or None on failure."""
    try:
        out = subprocess.check_output(["wg", "show", iface, "transfer"], text=True, stderr=subprocess.DEVNULL)
    except Exception:
        return None
    for line in out.splitlines():
        parts = line.strip().split()
        if not parts:
            continue
        # expected format: <public_key> <rx> <tx>
        if parts[0] == peer_pub:
            try:
                rx = int(parts[1])
                tx = int(parts[2])
                return rx, tx
            except Exception:
                return None
    return None


def measure_live_bps(iface, peer_pub, sample_ms=500):
    """Measure short-term throughput in bytes/sec by sampling `wg` counters."""
    s1 = read_wg_peer_transfer(iface, peer_pub)
    if s1 is None:
        return None, None
    time.sleep(max(0.05, sample_ms / 1000.0))
    s2 = read_wg_peer_transfer(iface, peer_pub)
    if s2 is None:
        return None, None
    elapsed = max(0.001, sample_ms / 1000.0)
    rx_bps = (s2[0] - s1[0]) / elapsed
    tx_bps = (s2[1] - s1[1]) / elapsed
    # clamp to >=0
    rx_bps = max(0.0, rx_bps)
    tx_bps = max(0.0, tx_bps)
    return rx_bps, tx_bps


# ----------------------- Extended API endpoints -----------------------
@app.route('/api/tunnels/<int:tunnel_id>/config', methods=['GET'])
@require_api_key
def api_get_config(tunnel_id):
    data = load_data()
    t = next((x for x in data['tunnels'] if x['id'] == tunnel_id), None)
    if not t:
        return jsonify({'error': 'not found'}), 404
    conf_path = BASE_DIR.parent / f"{t['name']}.conf"
    if not conf_path.exists():
        return jsonify({'error': 'config not found'}), 404
    return send_file(str(conf_path), as_attachment=False, download_name=f"{t['name']}.conf")


@app.route('/api/tunnels/<int:tunnel_id>/config', methods=['PUT'])
@require_api_key
def api_update_config(tunnel_id):
    if not request.is_json:
        return jsonify({'error': 'expected json payload with config or fields'}), 400
    payload = request.get_json()
    data = load_data()
    idx = next((i for i, x in enumerate(data['tunnels']) if x['id'] == tunnel_id), None)
    if idx is None:
        return jsonify({'error': 'not found'}), 404
    t = data['tunnels'][idx]

    # allow raw config replacement
    if 'config' in payload:
        conf_text = payload.get('config')
        conf_path = BASE_DIR.parent / f"{t['name']}.conf"
        conf_path.write_text(conf_text)
        # optionally restart
        if payload.get('restart'):
            success, msg = run_wg_quick_up(conf_path)
            t['wg_started'] = success
            t['wg_start_msg'] = msg
        save_data(data)
        return jsonify({'success': True}), 200

    # else, allow editing fields and regenerating config
    name = payload.get('name')
    endpoint = payload.get('endpoint')
    external_subnet = payload.get('external_subnet')
    rename_required = False

    if external_subnet:
        try:
            ipaddress.ip_network(external_subnet)
        except Exception:
            return jsonify({'error': 'invalid external_subnet'}), 400
        t['external_subnet'] = external_subnet
    if name and name != t['name']:
        old_path = BASE_DIR.parent / f"{t['name']}.conf"
        new_path = BASE_DIR.parent / f"{name}.conf"
        if old_path.exists():
            try:
                old_path.rename(new_path)
            except Exception as e:
                return jsonify({'error': f'rename failed: {e}'}), 500
        t['name'] = name
        rename_required = True
    if endpoint is not None:
        t['peer']['endpoint'] = endpoint

    # regenerate config
    conf = build_server_config(t)
    conf_path = BASE_DIR.parent / f"{t['name']}.conf"
    conf_path.write_text(conf)

    # if requested, restart
    if payload.get('restart'):
        success, msg = run_wg_quick_up(conf_path)
        t['wg_started'] = success
        t['wg_start_msg'] = msg
    save_data(data)
    return jsonify(serialize_tunnel_public(t)), 200


@app.route('/api/tunnels/<int:tunnel_id>/start', methods=['POST'])
@require_api_key
def api_start_tunnel(tunnel_id):
    data = load_data()
    idx = next((i for i, x in enumerate(data['tunnels']) if x['id'] == tunnel_id), None)
    if idx is None:
        return jsonify({'error': 'not found'}), 404
    t = data['tunnels'][idx]
    conf_path = BASE_DIR.parent / f"{t['name']}.conf"
    if not conf_path.exists():
        return jsonify({'error': 'config not found'}), 404
    success, msg = run_wg_quick_up(conf_path)
    t['wg_started'] = success
    t['wg_start_msg'] = msg
    save_data(data)
    return jsonify({'wg_started': success, 'msg': msg})


@app.route('/api/tunnels/<int:tunnel_id>/stop', methods=['POST'])
@require_api_key
def api_stop_tunnel(tunnel_id):
    data = load_data()
    idx = next((i for i, x in enumerate(data['tunnels']) if x['id'] == tunnel_id), None)
    if idx is None:
        return jsonify({'error': 'not found'}), 404
    t = data['tunnels'][idx]
    conf_path = BASE_DIR.parent / f"{t['name']}.conf"
    if not conf_path.exists():
        return jsonify({'error': 'config not found'}), 404
    success, msg = run_wg_quick_down(conf_path)
    t['wg_started'] = not success
    t['wg_start_msg'] = msg
    save_data(data)
    return jsonify({'stopped': success, 'msg': msg})


@app.route('/api/tunnels/<int:tunnel_id>', methods=['DELETE'])
@require_api_key
def api_delete_tunnel(tunnel_id):
    data = load_data()
    idx = next((i for i, x in enumerate(data['tunnels']) if x['id'] == tunnel_id), None)
    if idx is None:
        return jsonify({'error': 'not found'}), 404
    t = data['tunnels'][idx]
    conf_path = BASE_DIR.parent / f"{t['name']}.conf"
    # attempt to stop
    try:
        run_wg_quick_down(conf_path)
    except Exception:
        pass
    # remove config file
    try:
        if conf_path.exists():
            conf_path.unlink()
    except Exception as e:
        return jsonify({'error': f'failed to remove config: {e}'}), 500
    # remove tunnel from data
    data['tunnels'].pop(idx)
    save_data(data)
    return jsonify({'deleted': True}), 200


if __name__ == '__main__':
    app.run(host='0.0.0.0', port=8000, debug=True)