### Build and Verify wgsd CoreDNS Binary

Source: https://github.com/jwhited/wgsd/blob/main/README.md

Instructions to build the `wgsd` CoreDNS server binary from source and verify that the `wgsd` plugin is enabled. This uses the recommended method for integrating external CoreDNS plugins by building from source.

```Bash
go build
./coredns -plugins | grep wgsd
```

--------------------------------

### Display wgsd-client Command-Line Help

Source: https://github.com/jwhited/wgsd/blob/main/cmd/wgsd-client/README.md

This snippet shows the command-line usage and available flags for the `wgsd-client` utility. It details options such as specifying the WireGuard device, DNS server, and DNS zone name.

```Shell
% ./wgsd-client --help
Usage of ./wgsd-client:
  -device string
    	name of Wireguard device to manage
  -dns string
    	ip:port of DNS server
  -zone string
    	dns zone name
```

--------------------------------

### Configure wgsd Corefile for WireGuard Peer DNS Resolution

Source: https://github.com/jwhited/wgsd/blob/main/README.md

This snippet shows the `Corefile` configuration for `wgsd`. It defines a DNS zone (`example.com.`) on port 5353, enabling `wgsd` to serve WireGuard peer information. The `self` entry specifies the local WireGuard interface's endpoint and allowed IP range.

```Shell
.:5353 {
  wgsd example.com. wg0 {
    self 192.0.2.1:51820 10.0.0.254/32
  }
}
```

--------------------------------

### Convert Base32 Encoded WireGuard Identifiers to Base64 Public Keys

Source: https://github.com/jwhited/wgsd/blob/main/README.md

This section provides shell commands using `echo`, `tr`, `base32 -d`, and `base64` to convert the Base32 encoded identifiers (found in the `_wireguard._udp.example.com.` PTR records) back into their original Base64 WireGuard public key format. This demonstrates the reversibility of the encoding used by `wgsd`.

```Shell
$ echo yutrled535igkl7bdlerl6m4vjxsxm3uqqpl4nmsn27mt56ad4ha==== | tr '[:lower:]' '[:upper:]' | base32 -d | base64
xScVkH3fUGUv4RrJFfmcqm8rs3SEHr41km6+yffAHw4=
$ echo wmrid55v4enhxqx2jstyoyvkicj5pihkb2tr7r42smiu3t5l4i5q==== | tr '[:lower:]' '[:upper:]' | base32 -d | base64
syKB97XhGnvC+kynh2KqQJPXoOoOpx/HmpMRTc+r4js=
$ echo extglt26a3znqnigvb5gvg26cqwblbgynf5re5pukdhx53cqwvda==== | tr '[:lower:]' '[:upper:]' | base32 -d | base64
JeZlz14G8tg1Bqh6apteFCwVhNhpexJ19FDPfuxQtUY=
```

--------------------------------

### Basic wgsd CoreDNS Plugin Configuration

Source: https://github.com/jwhited/wgsd/blob/main/README.md

Defines the basic configuration syntax for the `wgsd` CoreDNS plugin. It requires specifying the authoritative zone for WireGuard peer information and the name of the WireGuard interface.

```CoreDNS Config
wgsd ZONE DEVICE
```

--------------------------------

### Verify wgsd DNS Resolution for WireGuard Peers using dig

Source: https://github.com/jwhited/wgsd/blob/main/README.md

These `dig` commands query the `wgsd` DNS server running locally on port 5353 to verify that it correctly resolves WireGuard peer information. It demonstrates querying for PTR records to discover peer identifiers, and then SRV, A, and TXT records for specific peer details like endpoint, IP address, public key, and allowed IPs.

```Shell
$ dig @127.0.0.1 -p 5353 _wireguard._udp.example.com. PTR +noall +answer +additional
_wireguard._udp.example.com. 0	IN	PTR	yutrled535igkl7bdlerl6m4vjxsxm3uqqpl4nmsn27mt56ad4ha====._wireguard._udp.example.com.
_wireguard._udp.example.com. 0	IN	PTR	wmrid55v4enhxqx2jstyoyvkicj5pihkb2tr7r42smiu3t5l4i5q====._wireguard._udp.example.com.
_wireguard._udp.example.com. 0	IN	PTR	extglt26a3znqnigvb5gvg26cqwblbgynf5re5pukdhx53cqwvda====._wireguard._udp.example.com.
$ dig @127.0.0.1 -p 5353 yutrled535igkl7bdlerl6m4vjxsxm3uqqpl4nmsn27mt56ad4ha====._wireguard._udp.example.com. SRV +noall +answer +additional
yutrled535igkl7bdlerl6m4vjxsxm3uqqpl4nmsn27mt56ad4ha====._wireguard._udp.example.com. 0	IN SRV 0 0 7777 yutrled535igkl7bdlerl6m4vjxsxm3uqqpl4nmsn27mt56ad4ha====._wireguard._udp.example.com.
yutrled535igkl7bdlerl6m4vjxsxm3uqqpl4nmsn27mt56ad4ha====._wireguard._udp.example.com. 0	IN A 203.0.113.1
yutrled535igkl7bdlerl6m4vjxsxm3uqqpl4nmsn27mt56ad4ha====._wireguard._udp.example.com. 0	IN TXT "txtvers=1" "pub=xScVkH3fUGUv4RrJFfmcqm8rs3SEHr41km6+yffAHw4=" "allowed=10.0.0.1/32"
$ dig @127.0.0.1 -p 5353 wmrid55v4enhxqx2jstyoyvkicj5pihkb2tr7r42smiu3t5l4i5q====._wireguard._udp.example.com. SRV +noall +answer +additional
wmrid55v4enhxqx2jstyoyvkicj5pihkb2tr7r42smiu3t5l4i5q====._wireguard._udp.example.com. 0	IN SRV 0 0 8888 wmrid55v4enhxqx2jstyoyvkicj5pihkb2tr7r42smiu3t5l4i5q====._wireguard._udp.example.com.
wmrid55v4enhxqx2jstyoyvkicj5pihkb2tr7r42smiu3t5l4i5q====._wireguard._udp.example.com. 0	IN A 198.51.100.1
wmrid55v4enhxqx2jstyoyvkicj5pihkb2tr7r42smiu3t5l4i5q====._wireguard._udp.example.com. 0	IN TXT "txtvers=1" "pub=syKB97XhGnvC+kynh2KqQJPXoOoOpx/HmpMRTc+r4js=" "allowed=10.0.0.2/32"
$ dig @127.0.0.1 -p 5353 extglt26a3znqnigvb5gvg26cqwblbgynf5re5pukdhx53cqwvda====._wireguard._udp.example.com. SRV +noall +answer +additional
extglt26a3znqnigvb5gvg26cqwblbgynf5re5pukdhx53cqwvda====._wireguard._udp.example.com. 0	IN SRV 0 0 51820 extglt26a3znqnigvb5gvg26cqwblbgynf5re5pukdhx53cqwvda====._wireguard._udp.example.com.
extglt26a3znqnigvb5gvg26cqwblbgynf5re5pukdhx53cqwvda====._wireguard._udp.example.com. 0	IN A 192.0.2.1
extglt26a3znqnigvb5gvg26cqwblbgynf5re5pukdhx53cqwvda====._wireguard._udp.example.com. 0	IN TXT "txtvers=1" "pub=JeZlz14G8tg1Bqh6apteFCwVhNhpexJ19FDPfuxQtUY=" "allowed=10.0.0.254/32"
```

--------------------------------

### wgsd CoreDNS Plugin Querying API

Source: https://github.com/jwhited/wgsd/blob/main/README.md

Describes the DNS-SD query interface for the `wgsd` plugin, detailing how to discover WireGuard peers and their associated information. It specifies the namespace, record types, and the format of the returned data, including public keys and allowed IPs.

```APIDOC
Query Interface:
  Namespace: _wireguard._udp.<zone>
  Record Types:
    - PTR: Lists peers. Target format: <base32PubKey>._wireguard._udp.<zone>
    - SRV: Service record for a peer. Includes A/AAAA and TXT records in 'additional' section.
    - A/AAAA: IP address records for a peer.
    - TXT: Text record for a peer. Contains Base64 public key and allowed IPs.
  Key Representation:
    - In record names (e.g., PTR targets): Base32 (case-insensitive for DNS).
    - In TXT records: Base64.
```

--------------------------------

### Display Current WireGuard Interface and Peer Status

Source: https://github.com/jwhited/wgsd/blob/main/README.md

This command displays the current configuration and status of the `wg0` WireGuard interface and its connected peers. It provides details such as public keys, endpoints, allowed IPs, latest handshake times, and data transfer statistics for each peer.

```Shell
interface: wg0
  public key: JeZlz14G8tg1Bqh6apteFCwVhNhpexJ19FDPfuxQtUY=
  private key: (hidden)
  listening port: 51820

peer: xScVkH3fUGUv4RrJFfmcqm8rs3SEHr41km6+yffAHw4=
  endpoint: 203.0.113.1:7777
  allowed ips: 10.0.0.1/32
  latest handshake: 14 hours, 24 minutes, 40 seconds ago
  transfer: 840.64 KiB received, 85.54 KiB sent

peer: syKB97XhGnvC+kynh2KqQJPXoOoOpx/HmpMRTc+r4js=
  endpoint: 198.51.100.1:8888
  allowed ips: 10.0.0.2/32
  latest handshake: 4 days, 15 hours, 8 minutes, 12 seconds ago
  transfer: 1.38 MiB received, 139.42 KiB sent
```

--------------------------------

### Advanced wgsd CoreDNS Plugin Configuration with Self Option

Source: https://github.com/jwhited/wgsd/blob/main/README.md

Explains the `self` option in `wgsd` configuration, which enables the server to serve its own WireGuard device data. It includes optional arguments for setting a custom endpoint (ip:port) and specifying allowed IPs, useful for hosts behind NAT.

```CoreDNS Config
wgsd ZONE DEVICE {
    self [ ENDPOINT ] [ ALLOWED-IPS ... ]
}
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.