close tunnels that are missing from the config

internal/wireguard/wg.go

@@ -111,7 +111,7 @@ func C25519pair() (string, string) {
 
 type WireGuardStates map[string]*wg.WireGuardState
 
-func getWireGuardState() (WireGuardStates, error) {
+func GetWireGuardState() (WireGuardStates, error) {
 	states := WireGuardStates{}
 
 	if err := viper.UnmarshalKey(flyctl.ConfigWireGuardState, &states); err != nil {
@@ -122,7 +122,7 @@ func getWireGuardState() (WireGuardStates, error) {
 }
 
 func getWireGuardStateForOrg(orgSlug string) (*wg.WireGuardState, error) {
-	states, err := getWireGuardState()
+	states, err := GetWireGuardState()
 	if err != nil {
 		return nil, err
 	}
@@ -141,7 +141,7 @@ func setWireGuardState(s WireGuardStates) error {
 }
 
 func setWireGuardStateForOrg(orgSlug string, s *wg.WireGuardState) error {
-	states, err := getWireGuardState()
+	states, err := GetWireGuardState()
 	if err != nil {
 		return err
 	}
@@ -152,7 +152,7 @@ func setWireGuardStateForOrg(orgSlug string, s *wg.WireGuardState) error {
 }
 
 func PruneInvalidPeers(apiClient *api.Client) error {
-	state, err := getWireGuardState()
+	state, err := GetWireGuardState()
 	if err != nil {
 		return nil
 	}

pkg/agent/agent.go

@@ -392,6 +392,27 @@ func (s *Server) tunnelFor(slug string) (*wg.Tunnel, error) {
 	return tunnel, nil
 }
 
+// validateTunnels closes any active tunnel that isn't in the wire_guard_state config
+func (s *Server) validateTunnels() error {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	peers, err := wireguard.GetWireGuardState()
+	if err != nil {
+		return err
+	}
+
+	for slug, tunnel := range s.tunnels {
+		if peers[slug] == nil {
+			log.Printf("no peer for %s in config - closing tunnel", slug)
+			tunnel.Close()
+			delete(s.tunnels, slug)
+		}
+	}
+
+	return nil
+}
+
 func resolve(tunnel *wg.Tunnel, addr string) (string, error) {
 	log.Printf("Resolving %v %s", tunnel, addr)
 	host, port, err := net.SplitHostPort(addr)