Skip to content

feat(vpn): basic connection commands #1433

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cgoetz-inovex merged 7 commits into from
Jun 12, 2026
Merged

feat(vpn): basic connection commands #1433

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
b3907e9
feat(vpn): basic connection commands
cgoetz-inovex Jun 9, 2026
cec8328
Merge branch 'main' into feat/STACKITCLI-384-vpn-connection
cgoetz-inovex Jun 9, 2026
1b38892
fix(vpn): docs etc
cgoetz-inovex Jun 9, 2026
4cf05e8
refac(vpn): extract tunnelInputModel from inputModel
cgoetz-inovex Jun 12, 2026
39f5822
feat(vpn): implement vpn connection status command
cgoetz-inovex Jun 12, 2026
f0cf7e9
Merge branch 'main' into feat/STACKITCLI-384-vpn-connection
cgoetz-inovex Jun 12, 2026
9b83511
fix(vpn): lint, fmt, docs
cgoetz-inovex Jun 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
refac(vpn): extract tunnelInputModel from inputModel
  • Loading branch information
@cgoetz-inovex
cgoetz-inovex committed Jun 12, 2026
commit 4cf05e8b2b169f721ea3298b4e8fc6715c859f5e
214 changes: 90 additions & 124 deletions internal/cmd/beta/vpn/connection/create/create.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,6 +131,24 @@ var (
)
)

type tunnelInputModel struct {
BgpRemoteAsn *int64
PeeringLocalAddress *string
PeeringRemoteAddress *string
Phase1DhGroups []vpn.PhaseDhGroupsInner
Phase1EncryptionAlgorithms []vpn.PhaseEncryptionAlgorithmsInner
Phase1IntegrityAlgorithms []vpn.PhaseIntegrityAlgorithmsInner
Phase1RekeyTime *int32
Phase2DhGroups []vpn.PhaseDhGroupsInner
Phase2EncryptionAlgorithms []vpn.PhaseEncryptionAlgorithmsInner
Phase2IntegrityAlgorithms []vpn.PhaseIntegrityAlgorithmsInner
Phase2RekeyTime *int32
Phase2DpdAction *vpn.TunnelConfigurationPhase2AllOfDpdAction
Phase2StartAction *vpn.TunnelConfigurationPhase2AllOfStartAction
PreSharedKey string
RemoteAddress string
}

type inputModel struct {
*globalflags.GlobalFlagModel
GatewayId string
Expand All @@ -142,37 +160,8 @@ type inputModel struct {
RemoteSubnets []string
StaticRoutes []string

Tunnel1BgpRemoteAsn *int64
Tunnel1PeeringLocalAddress *string
Tunnel1PeeringRemoteAddress *string
Tunnel1Phase1DhGroups []vpn.PhaseDhGroupsInner
Tunnel1Phase1EncryptionAlgorithms []vpn.PhaseEncryptionAlgorithmsInner
Tunnel1Phase1IntegrityAlgorithms []vpn.PhaseIntegrityAlgorithmsInner
Tunnel1Phase1RekeyTime *int32
Tunnel1Phase2DhGroups []vpn.PhaseDhGroupsInner
Tunnel1Phase2EncryptionAlgorithms []vpn.PhaseEncryptionAlgorithmsInner
Tunnel1Phase2IntegrityAlgorithms []vpn.PhaseIntegrityAlgorithmsInner
Tunnel1Phase2RekeyTime *int32
Tunnel1Phase2DpdAction *vpn.TunnelConfigurationPhase2AllOfDpdAction
Tunnel1Phase2StartAction *vpn.TunnelConfigurationPhase2AllOfStartAction
Tunnel1PreSharedKey string
Tunnel1RemoteAddress string

Tunnel2BgpRemoteAsn *int64
Tunnel2PeeringLocalAddress *string
Tunnel2PeeringRemoteAddress *string
Tunnel2Phase1DhGroups []vpn.PhaseDhGroupsInner
Tunnel2Phase1EncryptionAlgorithms []vpn.PhaseEncryptionAlgorithmsInner
Tunnel2Phase1IntegrityAlgorithms []vpn.PhaseIntegrityAlgorithmsInner
Tunnel2Phase1RekeyTime *int32
Tunnel2Phase2DhGroups []vpn.PhaseDhGroupsInner
Tunnel2Phase2EncryptionAlgorithms []vpn.PhaseEncryptionAlgorithmsInner
Tunnel2Phase2IntegrityAlgorithms []vpn.PhaseIntegrityAlgorithmsInner
Tunnel2Phase2RekeyTime *int32
Tunnel2Phase2DpdAction *vpn.TunnelConfigurationPhase2AllOfDpdAction
Tunnel2Phase2StartAction *vpn.TunnelConfigurationPhase2AllOfStartAction
Tunnel2PreSharedKey string
Tunnel2RemoteAddress string
Tunnel1 tunnelInputModel
Tunnel2 tunnelInputModel
}

func NewCmd(p *types.CmdParams) *cobra.Command {
Expand Down Expand Up @@ -301,43 +290,80 @@ func parseInput(p *print.Printer, cmd *cobra.Command) (*inputModel, error) {
RemoteSubnets: flags.FlagToStringSliceValue(p, cmd, remoteSubnetsFlag),
StaticRoutes: flags.FlagToStringSliceValue(p, cmd, staticRoutesFlag),

Tunnel1BgpRemoteAsn: flags.FlagToInt64Pointer(p, cmd, tunnel1BgpRemoteAsnFlag),
Tunnel1PeeringLocalAddress: flags.FlagToStringPointer(p, cmd, tunnel1PeeringLocalAddressFlag),
Tunnel1PeeringRemoteAddress: flags.FlagToStringPointer(p, cmd, tunnel1PeeringRemoteAddressFlag),
Tunnel1Phase1DhGroups: tunnel1Phase1DhGroupsFlag.Get(),
Tunnel1Phase1EncryptionAlgorithms: tunnel1Phase1EncryptionAlgorithmsFlag.Get(),
Tunnel1Phase1IntegrityAlgorithms: tunnel1Phase1IntegrityAlgorithmsFlag.Get(),
Tunnel1Phase1RekeyTime: flags.FlagToInt32Pointer(p, cmd, tunnel1Phase1RekeyTimeFlag),
Tunnel1Phase2DhGroups: tunnel1Phase2DhGroupsFlag.Get(),
Tunnel1Phase2EncryptionAlgorithms: tunnel1Phase2EncryptionAlgorithmsFlag.Get(),
Tunnel1Phase2IntegrityAlgorithms: tunnel1Phase2IntegrityAlgorithmsFlag.Get(),
Tunnel1Phase2RekeyTime: flags.FlagToInt32Pointer(p, cmd, tunnel1Phase2RekeyTimeFlag),
Tunnel1Phase2DpdAction: tunnel1Phase2DpdActionFlag.Ptr(),
Tunnel1Phase2StartAction: tunnel1Phase2StartActionFlag.Ptr(),
Tunnel1PreSharedKey: flags.FlagToStringValue(p, cmd, tunnel1PreSharedKeyFlag),
Tunnel1RemoteAddress: flags.FlagToStringValue(p, cmd, tunnel1RemoteAddressFlag),

Tunnel2BgpRemoteAsn: flags.FlagToInt64Pointer(p, cmd, tunnel2BgpRemoteAsnFlag),
Tunnel2PeeringLocalAddress: flags.FlagToStringPointer(p, cmd, tunnel2PeeringLocalAddressFlag),
Tunnel2PeeringRemoteAddress: flags.FlagToStringPointer(p, cmd, tunnel2PeeringRemoteAddressFlag),
Tunnel2Phase1DhGroups: tunnel2Phase1DhGroupsFlag.Get(),
Tunnel2Phase1EncryptionAlgorithms: tunnel2Phase1EncryptionAlgorithmsFlag.Get(),
Tunnel2Phase1IntegrityAlgorithms: tunnel2Phase1IntegrityAlgorithmsFlag.Get(),
Tunnel2Phase1RekeyTime: flags.FlagToInt32Pointer(p, cmd, tunnel2Phase1RekeyTimeFlag),
Tunnel2Phase2DhGroups: tunnel2Phase2DhGroupsFlag.Get(),
Tunnel2Phase2EncryptionAlgorithms: tunnel2Phase2EncryptionAlgorithmsFlag.Get(),
Tunnel2Phase2IntegrityAlgorithms: tunnel2Phase2IntegrityAlgorithmsFlag.Get(),
Tunnel2Phase2RekeyTime: flags.FlagToInt32Pointer(p, cmd, tunnel2Phase2RekeyTimeFlag),
Tunnel2Phase2DpdAction: tunnel2Phase2DpdActionFlag.Ptr(),
Tunnel2Phase2StartAction: tunnel2Phase2StartActionFlag.Ptr(),
Tunnel2PreSharedKey: flags.FlagToStringValue(p, cmd, tunnel2PreSharedKeyFlag),
Tunnel2RemoteAddress: flags.FlagToStringValue(p, cmd, tunnel2RemoteAddressFlag),
Tunnel1: tunnelInputModel{
BgpRemoteAsn: flags.FlagToInt64Pointer(p, cmd, tunnel1BgpRemoteAsnFlag),
PeeringLocalAddress: flags.FlagToStringPointer(p, cmd, tunnel1PeeringLocalAddressFlag),
PeeringRemoteAddress: flags.FlagToStringPointer(p, cmd, tunnel1PeeringRemoteAddressFlag),
Phase1DhGroups: tunnel1Phase1DhGroupsFlag.Get(),
Phase1EncryptionAlgorithms: tunnel1Phase1EncryptionAlgorithmsFlag.Get(),
Phase1IntegrityAlgorithms: tunnel1Phase1IntegrityAlgorithmsFlag.Get(),
Phase1RekeyTime: flags.FlagToInt32Pointer(p, cmd, tunnel1Phase1RekeyTimeFlag),
Phase2DhGroups: tunnel1Phase2DhGroupsFlag.Get(),
Phase2EncryptionAlgorithms: tunnel1Phase2EncryptionAlgorithmsFlag.Get(),
Phase2IntegrityAlgorithms: tunnel1Phase2IntegrityAlgorithmsFlag.Get(),
Phase2RekeyTime: flags.FlagToInt32Pointer(p, cmd, tunnel1Phase2RekeyTimeFlag),
Phase2DpdAction: tunnel1Phase2DpdActionFlag.Ptr(),
Phase2StartAction: tunnel1Phase2StartActionFlag.Ptr(),
PreSharedKey: flags.FlagToStringValue(p, cmd, tunnel1PreSharedKeyFlag),
RemoteAddress: flags.FlagToStringValue(p, cmd, tunnel1RemoteAddressFlag),
},

Tunnel2: tunnelInputModel{
BgpRemoteAsn: flags.FlagToInt64Pointer(p, cmd, tunnel2BgpRemoteAsnFlag),
PeeringLocalAddress: flags.FlagToStringPointer(p, cmd, tunnel2PeeringLocalAddressFlag),
PeeringRemoteAddress: flags.FlagToStringPointer(p, cmd, tunnel2PeeringRemoteAddressFlag),
Phase1DhGroups: tunnel2Phase1DhGroupsFlag.Get(),
Phase1EncryptionAlgorithms: tunnel2Phase1EncryptionAlgorithmsFlag.Get(),
Phase1IntegrityAlgorithms: tunnel2Phase1IntegrityAlgorithmsFlag.Get(),
Phase1RekeyTime: flags.FlagToInt32Pointer(p, cmd, tunnel2Phase1RekeyTimeFlag),
Phase2DhGroups: tunnel2Phase2DhGroupsFlag.Get(),
Phase2EncryptionAlgorithms: tunnel2Phase2EncryptionAlgorithmsFlag.Get(),
Phase2IntegrityAlgorithms: tunnel2Phase2IntegrityAlgorithmsFlag.Get(),
Phase2RekeyTime: flags.FlagToInt32Pointer(p, cmd, tunnel2Phase2RekeyTimeFlag),
Phase2DpdAction: tunnel2Phase2DpdActionFlag.Ptr(),
Phase2StartAction: tunnel2Phase2StartActionFlag.Ptr(),
PreSharedKey: flags.FlagToStringValue(p, cmd, tunnel2PreSharedKeyFlag),
RemoteAddress: flags.FlagToStringValue(p, cmd, tunnel2RemoteAddressFlag),
},
}

p.DebugInputModel(model)
return &model, nil
}

func buildTunnelConfiguration(model tunnelInputModel) vpn.TunnelConfiguration {
tunnel := vpn.TunnelConfiguration{
RemoteAddress: model.RemoteAddress,
}
if model.BgpRemoteAsn != nil {
tunnel.Bgp = &vpn.BGPTunnelConfig{
RemoteAsn: *model.BgpRemoteAsn,
}
}
if model.PeeringLocalAddress != nil || model.PeeringRemoteAddress != nil {
tunnel.Peering = &vpn.PeeringConfig{
LocalAddress: model.PeeringLocalAddress,
RemoteAddress: model.PeeringRemoteAddress,
}
}
tunnel.Phase1 = vpn.TunnelConfigurationPhase1{
DhGroups: model.Phase1DhGroups,
EncryptionAlgorithms: model.Phase1EncryptionAlgorithms,
IntegrityAlgorithms: model.Phase1IntegrityAlgorithms,
RekeyTime: model.Phase1RekeyTime,
}
tunnel.Phase2 = vpn.TunnelConfigurationPhase2{
DhGroups: model.Phase2DhGroups,
EncryptionAlgorithms: model.Phase2EncryptionAlgorithms,
IntegrityAlgorithms: model.Phase2IntegrityAlgorithms,
RekeyTime: model.Phase2RekeyTime,
DpdAction: model.Phase2DpdAction,
StartAction: model.Phase2StartAction,
}
tunnel.PreSharedKey = &model.PreSharedKey
return tunnel
}

func buildRequest(ctx context.Context, model *inputModel, apiClient *vpn.APIClient) (vpn.ApiCreateGatewayConnectionRequest, error) {
req := apiClient.DefaultAPI.CreateGatewayConnection(ctx, model.ProjectId, model.Region, model.GatewayId)

Expand All @@ -350,68 +376,8 @@ func buildRequest(ctx context.Context, model *inputModel, apiClient *vpn.APIClie
StaticRoutes: model.StaticRoutes,
}

tunnel1 := vpn.TunnelConfiguration{
RemoteAddress: model.Tunnel1RemoteAddress,
}
if model.Tunnel1BgpRemoteAsn != nil {
tunnel1.Bgp = &vpn.BGPTunnelConfig{
RemoteAsn: *model.Tunnel1BgpRemoteAsn,
}
}
if model.Tunnel1PeeringLocalAddress != nil || model.Tunnel1PeeringRemoteAddress != nil {
tunnel1.Peering = &vpn.PeeringConfig{
LocalAddress: model.Tunnel1PeeringLocalAddress,
RemoteAddress: model.Tunnel1PeeringRemoteAddress,
}
}
tunnel1.Phase1 = vpn.TunnelConfigurationPhase1{
DhGroups: model.Tunnel1Phase1DhGroups,
EncryptionAlgorithms: model.Tunnel1Phase1EncryptionAlgorithms,
IntegrityAlgorithms: model.Tunnel1Phase1IntegrityAlgorithms,
RekeyTime: model.Tunnel1Phase1RekeyTime,
}
tunnel1.Phase2 = vpn.TunnelConfigurationPhase2{
DhGroups: model.Tunnel1Phase2DhGroups,
EncryptionAlgorithms: model.Tunnel1Phase2EncryptionAlgorithms,
IntegrityAlgorithms: model.Tunnel1Phase2IntegrityAlgorithms,
RekeyTime: model.Tunnel1Phase2RekeyTime,
DpdAction: model.Tunnel1Phase2DpdAction,
StartAction: model.Tunnel1Phase2StartAction,
}
tunnel1.PreSharedKey = &model.Tunnel1PreSharedKey
payload.Tunnel1 = tunnel1

tunnel2 := vpn.TunnelConfiguration{
RemoteAddress: model.Tunnel2RemoteAddress,
}
if model.Tunnel2BgpRemoteAsn != nil {
tunnel2.Bgp = &vpn.BGPTunnelConfig{
RemoteAsn: *model.Tunnel2BgpRemoteAsn,
}
}
if model.Tunnel2PeeringLocalAddress != nil || model.Tunnel2PeeringRemoteAddress != nil {
tunnel2.Peering = &vpn.PeeringConfig{
LocalAddress: model.Tunnel2PeeringLocalAddress,
RemoteAddress: model.Tunnel2PeeringRemoteAddress,
}
}
tunnel2.Phase1 = vpn.TunnelConfigurationPhase1{
DhGroups: model.Tunnel2Phase1DhGroups,
EncryptionAlgorithms: model.Tunnel2Phase1EncryptionAlgorithms,
IntegrityAlgorithms: model.Tunnel2Phase1IntegrityAlgorithms,
RekeyTime: model.Tunnel2Phase1RekeyTime,
}

tunnel2.Phase2 = vpn.TunnelConfigurationPhase2{
DhGroups: model.Tunnel2Phase2DhGroups,
EncryptionAlgorithms: model.Tunnel2Phase2EncryptionAlgorithms,
IntegrityAlgorithms: model.Tunnel2Phase2IntegrityAlgorithms,
RekeyTime: model.Tunnel2Phase2RekeyTime,
DpdAction: model.Tunnel2Phase2DpdAction,
StartAction: model.Tunnel2Phase2StartAction,
}
tunnel2.PreSharedKey = &model.Tunnel2PreSharedKey
payload.Tunnel2 = tunnel2
payload.Tunnel1 = buildTunnelConfiguration(model.Tunnel1)
payload.Tunnel2 = buildTunnelConfiguration(model.Tunnel2)

return req.CreateGatewayConnectionPayload(payload), nil
}
Expand Down
46 changes: 25 additions & 21 deletions internal/cmd/beta/vpn/connection/create/create_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,18 +64,22 @@ func fixtureInputModel(mods ...func(model *inputModel)) *inputModel {
GatewayId: testGatewayID,
DisplayName: "test-connection",
Enabled: nil,
Tunnel1RemoteAddress: "1.2.3.4",
Tunnel1PreSharedKey: "test-psk-1",
Tunnel1Phase1EncryptionAlgorithms: []vpn.PhaseEncryptionAlgorithmsInner{"aes256"},
Tunnel1Phase1IntegrityAlgorithms: []vpn.PhaseIntegrityAlgorithmsInner{"sha2_256"},
Tunnel1Phase2EncryptionAlgorithms: []vpn.PhaseEncryptionAlgorithmsInner{"aes256"},
Tunnel1Phase2IntegrityAlgorithms: []vpn.PhaseIntegrityAlgorithmsInner{"sha2_256"},
Tunnel2RemoteAddress: "5.6.7.8",
Tunnel2PreSharedKey: "test-psk-2",
Tunnel2Phase1EncryptionAlgorithms: []vpn.PhaseEncryptionAlgorithmsInner{"aes256"},
Tunnel2Phase1IntegrityAlgorithms: []vpn.PhaseIntegrityAlgorithmsInner{"sha2_256"},
Tunnel2Phase2EncryptionAlgorithms: []vpn.PhaseEncryptionAlgorithmsInner{"aes256"},
Tunnel2Phase2IntegrityAlgorithms: []vpn.PhaseIntegrityAlgorithmsInner{"sha2_256"},
Tunnel1: tunnelInputModel{
RemoteAddress: "1.2.3.4",
PreSharedKey: "test-psk-1",
Phase1EncryptionAlgorithms: []vpn.PhaseEncryptionAlgorithmsInner{"aes256"},
Phase1IntegrityAlgorithms: []vpn.PhaseIntegrityAlgorithmsInner{"sha2_256"},
Phase2EncryptionAlgorithms: []vpn.PhaseEncryptionAlgorithmsInner{"aes256"},
Phase2IntegrityAlgorithms: []vpn.PhaseIntegrityAlgorithmsInner{"sha2_256"},
},
Tunnel2: tunnelInputModel{
RemoteAddress: "5.6.7.8",
PreSharedKey: "test-psk-2",
Phase1EncryptionAlgorithms: []vpn.PhaseEncryptionAlgorithmsInner{"aes256"},
Phase1IntegrityAlgorithms: []vpn.PhaseIntegrityAlgorithmsInner{"sha2_256"},
Phase2EncryptionAlgorithms: []vpn.PhaseEncryptionAlgorithmsInner{"aes256"},
Phase2IntegrityAlgorithms: []vpn.PhaseIntegrityAlgorithmsInner{"sha2_256"},
},
}
for _, mod := range mods {
mod(model)
Expand Down Expand Up @@ -202,15 +206,15 @@ func TestBuildRequest(t *testing.T) {
model.LocalSubnets = []string{"10.0.0.0/24"}
model.RemoteSubnets = []string{"192.168.0.0/24"}
model.StaticRoutes = []string{"10.1.0.0/24"}
model.Tunnel1BgpRemoteAsn = utils.Ptr(int64(65000))
model.Tunnel1PeeringLocalAddress = utils.Ptr("169.254.0.1")
model.Tunnel1PeeringRemoteAddress = utils.Ptr("169.254.0.2")
model.Tunnel1Phase1DhGroups = []vpn.PhaseDhGroupsInner{"14"}
model.Tunnel1Phase1RekeyTime = utils.Ptr(int32(3600))
model.Tunnel1Phase2DhGroups = []vpn.PhaseDhGroupsInner{"14"}
model.Tunnel1Phase2RekeyTime = utils.Ptr(int32(3600))
model.Tunnel1Phase2DpdAction = utils.Ptr(vpn.TunnelConfigurationPhase2AllOfDpdAction("restart"))
model.Tunnel1Phase2StartAction = utils.Ptr(vpn.TunnelConfigurationPhase2AllOfStartAction("start"))
model.Tunnel1.BgpRemoteAsn = utils.Ptr(int64(65000))
model.Tunnel1.PeeringLocalAddress = utils.Ptr("169.254.0.1")
model.Tunnel1.PeeringRemoteAddress = utils.Ptr("169.254.0.2")
model.Tunnel1.Phase1DhGroups = []vpn.PhaseDhGroupsInner{"14"}
model.Tunnel1.Phase1RekeyTime = utils.Ptr(int32(3600))
model.Tunnel1.Phase2DhGroups = []vpn.PhaseDhGroupsInner{"14"}
model.Tunnel1.Phase2RekeyTime = utils.Ptr(int32(3600))
model.Tunnel1.Phase2DpdAction = utils.Ptr(vpn.TunnelConfigurationPhase2AllOfDpdAction("restart"))
model.Tunnel1.Phase2StartAction = utils.Ptr(vpn.TunnelConfigurationPhase2AllOfStartAction("start"))
}),
expectedResult: fixtureRequest(func(request *vpn.ApiCreateGatewayConnectionRequest) {
payload := vpn.CreateGatewayConnectionPayload{
Expand Down