Support changing the WireGuard listen port via uc machine update - #430
Open
dasunsrule32 wants to merge 4 commits into
Open
Support changing the WireGuard listen port via uc machine update#430dasunsrule32 wants to merge 4 commits into
uc machine update#430dasunsrule32 wants to merge 4 commits into
Conversation
Add --wg-port to `uc machine update` so an admin can change a running machine's WireGuard listen port without re-adding it to the cluster. - Add optional wireguard_port field to UpdateMachineRequest (regenerated pb) - Add --wg-port (validated 1-65535) and -y/--yes flags to the update command - Apply the port in applyMachineUpdate and auto-adjust advertised endpoints that used the old port; explicit --wg-endpoint values take precedence - Reconfigure the firewall and WireGuard interface live via a new clusterController.ReconfigureNetwork, avoiding a daemon restart - Warn when no advertised endpoint uses the new port - Regenerate CLI reference docs
certmagic is referenced by the caddystorage API, so `go mod tidy` (Go 1.26.1) moves it from an indirect to a direct dependency. Pre-existing on main and unrelated to the feature, but required for the go-tests CI gate.
Changing the listen port rebound the WireGuard socket before the new endpoint reached the cluster store, so peers kept dialing the old port and the machine partitioned itself (and the RPC response hung). Reorder UpdateMachine's port-change path: sync the new endpoint to the store first, wait for gossip to propagate, then rebind the socket. Run it in a goroutine so the RPC returns immediately, and only on a port change (other updates are unaffected). Bump the delay to 2s.
Advertise the new endpoint to the cluster store first, let gossip propagate, then rebind the WireGuard socket asynchronously so the RPC returns before the socket moves. Avoids partitioning the machine and the CLI hang. Guard against concurrent port changes on the same machine.
dasunsrule32
changed the title
uc machine update
dasunsrule32
marked this pull request as ready for review
September 11, 2026 20:42
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
--wg-portflag touc machine updateso an operator can change a running machine's WireGuard listen port without removing and re-adding it to the cluster. The change is applied live, with no daemon restart required.Motivation
Previously the WireGuard listen port could only be set at
machine init/addtime (via the earlier--wg-portwork in #366). There was no way to change it afterward short of re-provisioning the machine.What's included
--wg-port <port>onuc machine update, with validation (1–65535).-y/--yesto skip the confirmation prompt (withUNCLOUD_AUTO_CONFIRMenv binding), consistent withinit/add/rm.--wg-portalone: advertised endpoints using the old port are auto-adjusted to the new port.--wg-port+--wg-endpoint: explicit endpoints win; bare IPs default to the new port.--wg-endpointalone: unchanged existing behavior.--wg-portchange while one is already in progress on the same machine, avoiding overlapping reconfigurations.wireguard_porttoUpdateMachineRequest(regenerated protobuf) and refreshes the CLI reference docs.Examples
Testing
Validated on a live 7-machine cluster:
Up.--wg-port + --wg-endpointoverride works.