fix(wireguard): исправить endpoint и поля клиентского шаблона

backend/src/routes/wireguard.ts

@@ -6,6 +6,7 @@ import {
   wgImportRequestSchema,
   wgPatchInterfaceSchema,
   wgPatchPeerSchema,
+  resolveWgClientEndpoint,
   type WgCreatePeerRequest,
   type WgIfaceDto,
 } from "@mmapp/contracts/wireguard"
@@ -451,23 +452,13 @@ const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
     if (!iface.publicKey) {
       return reply.status(400).send({ error: "У интерфейса нет public-key" })
     }
-    const endpoint =
-      peer.clientEndpoint ||
-      (peer.endpoint
-        ? peer.endpoint
-        : undefined)
+    const endpoint = resolveWgClientEndpoint(peer.clientEndpoint, server.host, iface.listenPort)
     const content = generatePeerClientConf({
       peerAddress: peer.clientAddress,
       peerDns: peer.clientDns,
       serverPublicKey: iface.publicKey,
-      allowedIps: peer.allowedIps.length ? peer.allowedIps : ["0.0.0.0/0"],
-      endpoint:
-        endpoint ||
-        (peer.clientEndpoint
-          ? peer.clientEndpoint.includes(":")
-            ? peer.clientEndpoint
-            : `${peer.clientEndpoint}:${iface.listenPort}`
-          : undefined),
+      // Server allowed-address describes the remote peer, not the client's routes.
+      endpoint,
       persistentKeepalive: peer.persistentKeepalive ?? 25,
     })
     return reply.send({

backend/src/services/wireguard-config.ts

@@ -291,13 +291,16 @@ export function generatePeerClientConf(args: {
       ? `PrivateKey = ${args.peerPrivateKey}`
       : `# PrivateKey = <ключ клиента>`,
   )
-  if (args.peerAddress) lines.push(`Address = ${args.peerAddress}`)
+  if (args.peerAddress?.trim()) lines.push(`Address = ${args.peerAddress.trim()}`)
+  else lines.push(`# Address = <укажите адрес клиента>`)
   if (args.peerDns) lines.push(`DNS = ${args.peerDns}`)
   lines.push(``)
   lines.push(`[Peer]`)
   lines.push(`PublicKey = ${args.serverPublicKey}`)
-  lines.push(`AllowedIPs = ${(args.allowedIps?.length ? args.allowedIps : ["0.0.0.0/0"]).join(", ")}`)
+  if (args.allowedIps?.length) lines.push(`AllowedIPs = ${args.allowedIps.join(", ")}`)
+  else lines.push(`# AllowedIPs = <укажите сети через туннель>`)
   if (args.endpoint) lines.push(`Endpoint = ${args.endpoint}`)
+  else lines.push(`# Endpoint = <укажите адрес сервера и порт>`)
   if (args.persistentKeepalive != null && args.persistentKeepalive > 0) {
     lines.push(`PersistentKeepalive = ${args.persistentKeepalive}`)
   }