From 8a795d7869d06b1ff5d63a2cc529dd2e435f7fe1 Mon Sep 17 00:00:00 2001 From: valentin vilar Date: Tue, 4 Aug 2026 15:51:46 -0300 Subject: [PATCH] fix(terraform2.0/gateway): restart the service so it applies the written config The package postinst starts defguard-gateway with the gateway.toml shipped in the .deb, before setup.sh writes the module's configuration. The final `systemctl start` is a no-op on an already-active unit, so the service keeps running with the packaged defaults for the life of the instance -- most importantly `masquerade = false` even when `nat = true`, which on AWS makes the ENI's source/destination check silently drop all forwarded VPN traffic. Also expose core_disconnect_grace_period, which the module did not write, so the fail-closed purge window can be raised above a normal Core restart (see DefGuard/gateway#361). Co-Authored-By: Claude Opus 5 (1M context) --- terraform2.0/modules/gateway/main.tf | 9 +++++---- terraform2.0/modules/gateway/setup.sh | 11 +++++++++-- terraform2.0/modules/gateway/variables.tf | 6 ++++++ 3 files changed, 20 insertions(+), 6 deletions(-) diff --git a/terraform2.0/modules/gateway/main.tf b/terraform2.0/modules/gateway/main.tf index 51aae80..1a2cf7b 100644 --- a/terraform2.0/modules/gateway/main.tf +++ b/terraform2.0/modules/gateway/main.tf @@ -4,10 +4,11 @@ resource "aws_instance" "defguard_gateway" { key_name = var.key_name user_data = templatefile("${path.module}/setup.sh", { - grpc_port = var.grpc_port - nat = var.nat - package_version = var.package_version - log_level = var.log_level + grpc_port = var.grpc_port + nat = var.nat + package_version = var.package_version + log_level = var.log_level + core_disconnect_grace_period = var.core_disconnect_grace_period }) user_data_replace_on_change = true diff --git a/terraform2.0/modules/gateway/setup.sh b/terraform2.0/modules/gateway/setup.sh index 9b28de0..829b6ab 100644 --- a/terraform2.0/modules/gateway/setup.sh +++ b/terraform2.0/modules/gateway/setup.sh @@ -53,6 +53,9 @@ userspace = false cert_dir = "/etc/defguard/certs" # Enable automatic masquerading of traffic by the firewall masquerade = ${nat} +# Seconds to wait after losing the Core connection before tearing down the WireGuard +# interface and purging the adoption certificates +core_disconnect_grace_period = ${core_disconnect_grace_period} log_level = "${log_level}" # Optional: HTTP port exposing gateway health status (200 connected, 503 not connected) @@ -75,8 +78,12 @@ systemctl daemon-reload log "Enabling defguard-gateway service..." systemctl enable defguard-gateway -log "Starting defguard-gateway service..." -systemctl start defguard-gateway +# The package postinst already started the service, using the gateway.toml shipped with +# the .deb -- long before this script wrote the configuration above. `systemctl start` on +# an already-active unit is a no-op, so the service would keep running with the packaged +# defaults (notably `masquerade = false`) for the life of the instance. Restart instead. +log "Restarting defguard-gateway service to apply the configuration written above..." +systemctl restart defguard-gateway log "Setup completed." ) 2>&1 | tee -a "$LOG_FILE" diff --git a/terraform2.0/modules/gateway/variables.tf b/terraform2.0/modules/gateway/variables.tf index 3333ff8..5855bea 100644 --- a/terraform2.0/modules/gateway/variables.tf +++ b/terraform2.0/modules/gateway/variables.tf @@ -43,3 +43,9 @@ variable "log_level" { type = string default = "info" } + +variable "core_disconnect_grace_period" { + description = "Seconds the Gateway waits after losing the Core connection before tearing down the WireGuard interface and purging its adoption certificates. The binary defaults to 30, which is short enough that an ordinary Core restart triggers it." + type = number + default = 300 +}