{"record":{"id":"744042d2b663ebcd","repo":"ruvnet/ruflo","slug":"wgmeshservice-buildinterfaceconfig-local-identity","errorCode":null,"errorMessage":"WgMeshService.buildInterfaceConfig: local identity not set; call setLocalIdentity() first","messagePattern":"WgMeshService\\.buildInterfaceConfig: local identity not set; call setLocalIdentity\\(\\) first","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/plugin-agent-federation/src/domain/services/wg-mesh-service.ts","lineNumber":193,"sourceCode":"  }\n\n  getMeshSubnet(): string {\n    return this.meshSubnet;\n  }\n\n  /**\n   * Build a `wg-quick`-compatible config string from current peers.\n   *\n   * Peers below WG_MIN_MESH_TRUST (UNTRUSTED) are excluded entirely.\n   * Suspended peers stay in the config but with `AllowedIPs =` empty\n   * (soft-block). Evicted peers are dropped completely.\n   *\n   * Operator writes this to `/etc/wireguard/<interface>.conf` and runs\n   * `wg-quick up <interface>`.\n   */\n  buildInterfaceConfig(peers: readonly FederationNode[]): string {\n    if (!this.localKey || !this.localMeshIP) {\n      throw new Error('WgMeshService.buildInterfaceConfig: local identity not set; call setLocalIdentity() first');\n    }\n    const lines: string[] = [];\n    lines.push('# Generated by ruflo federation plugin — ADR-111 Phase 2.');\n    lines.push('# Operator MUST review before `wg-quick up`. Trust-graded port');\n    lines.push('# rules (WG_NETWORK_GATES) are not enforced here — Phase 4 will');\n    lines.push('# project them into nftables/pf. v1 uses mesh-IP isolation only.');\n    lines.push('[Interface]');\n    lines.push(`PrivateKey = ${this.localKey.privateKey}`);\n    lines.push(`Address = ${this.localMeshIP}`);\n    lines.push(`ListenPort = ${this.listenPort}`);\n    lines.push('');\n    for (const peer of peers) {\n      if (peer.trustLevel < WG_MIN_MESH_TRUST) continue;\n      // Security: validate every spliced field. A compromised but-signed\n      // peer can otherwise inject extra [Peer] blocks via newline-laden\n      // wgEndpoint. readSafePeerWgFields enforces base64/CIDR/host:port\n      // regexes; mismatches skip the peer entirely (safer than partial-write).\n      const safe = readSafePeerWgFields(peer);","sourceCodeStart":175,"sourceCodeEnd":211,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/plugin-agent-federation/src/domain/services/wg-mesh-service.ts#L175-L211","documentation":"buildInterfaceConfig refuses to render a wg-quick config because the local node's WireGuard keypair or mesh IP has not been established via setLocalIdentity(). The [Interface] section requires a PrivateKey and Address; without them the generated config would be unusable, so the operation is a precondition failure rather than a bad-peer problem.","triggerScenarios":"buildInterfaceConfig is called on WgMeshService before setLocalIdentity() has been called.","commonSituations":"Mesh configuration built during startup before identity bootstrap completes.","solutions":["Call setLocalIdentity() with the node's keypair/identity before building interface configs.","Order startup so identity initialization precedes mesh configuration."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}