VPN: a WireGuard tunnel (#8)

The device joins a WireGuard network over whatever Wi-Fi it is on: one
peer, IPv4. A client's .conf is imported from the card (/vpn/wg0.conf) and
kept in the device's settings, private key included, never shown; Settings
offers to delete the file. A switch brings the tunnel up until the next
restart, "Start with Wi-Fi" every time; it waits for the clock, which a
handshake needs. VPN shows in the Status Bar.

The protocol is esphome/wireguard 0.4.8. It calls lwIP without lwIP's lock,
which this framework checks: every call into it is made with the lock held.

What goes through the tunnel is everything (AllowedIPs 0.0.0.0/0) or the
one subnet the device's tunnel address is in: lwIP routes by an
interface's subnet or by default, nothing finer. The import says how many
ranges it can't reach.

Checked against a test peer in both directions and against a real server,
with a configuration uploaded from a phone (docs/milestones/N1.md).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT

lib/services/src/settings.cpp

@@ -2,6 +2,7 @@
 
 #include "debug_auth.h"
 #include "ipv4.h"
+#include "wg_config.h"
 
 namespace roro {
 
@@ -45,6 +46,8 @@ const Definition kDefinitions[] = {
     {"debug_on", Kind::Bool, 0, nullptr, 0, 1},  // off: nothing listens until the owner says so (Q189)
     {"debug_token", Kind::String, 0, "", 0, 64},  // empty, or a valid token
     {"help_told", Kind::Bool, 0, nullptr, 0, 1},
+    {"vpn_config", Kind::String, 0, "", 0, 900},  // empty, or a .conf that parses
+    {"vpn_auto", Kind::Bool, 0, nullptr, 0, 1},
 };
 static_assert(sizeof(kDefinitions) / sizeof(kDefinitions[0]) == static_cast<size_t>(Setting::Count),
               "every Setting needs a definition");
@@ -103,6 +106,10 @@ bool Settings::validString(Setting s, const std::string& value) const {
     if (s == Setting::Ntp1) return net::validHost(value);
     if (s == Setting::Ntp2) return value.empty() || net::validHost(value);
     if (s == Setting::DebugToken) return value.empty() || debug::validToken(value);
+    if (s == Setting::VpnConfig) {
+        net::WgConfig config;
+        return value.empty() || net::parseWgConf(value, config).empty();
+    }
     return true;
 }
 

lib/services/src/settings.h

@@ -34,6 +34,8 @@ enum class Setting : uint8_t {
     DebugConsole,     // bool: the Debug Console listens on Wi-Fi (ADR 0010, Q189: off unless switched on)
     DebugToken,       // string: its token, tidied (debug_auth.h); empty until the console is first switched on
     HelpTold,         // bool: this device has been told about the help key once (issue #69, Q201)
+    VpnConfig,        // string: the WireGuard tunnel as a .conf (wg_config.h), private key included: never shown (issue #8)
+    VpnAuto,          // bool: the tunnel starts whenever Wi-Fi is connected (Q247: off unless switched on)
     Count
 };