wireguard: new keygen syntax

1 files changed, 60 insertions, 54 deletions

diff --git a/docs/vpn/wireguard.rst b/docs/vpn/wireguard.rst
index 6348fb01..9b3d36f4 100644
--- a/docs/vpn/wireguard.rst
+++ b/docs/vpn/wireguard.rst
@@ -11,61 +11,66 @@ information.
 Configuration
 =============
 
-WireGuard requires the generation of a keypair, a private key which will decrypt
-incoming traffic and a public key, which the peer(s) will use to encrypt traffic.
+WireGuard requires the generation of a keypair, a private key which will
+decrypt incoming traffic and a public key, which the peer(s) will use to
+encrypt traffic.
 
 Generate keypair
 ----------------
 
-Generate the keypair, which creates a public and private part and stores it
-within VyOS. It will be used per default on any configured WireGuard interface,
-even if multiple interfaces are being configured.
+.. opcmd:: generate wireguard default-keypair
 
-.. code-block:: none
+It generates the keypair, that is its public and private part and stores
+it within VyOS. It will be used per default on any configured WireGuard
+interface, even if multiple interfaces are being configured.
 
-  wg01:~$ configure
-  wg01# run generate wireguard keypair
 
-The public key is being shared with your peer(s), your peer will encrypt all
-traffic to your system using this public key.
 
-.. code-block:: none
+.. opcmd:: show wireguard keypairs pubkey default
+
+It shows the public key which needs to be shared with your peer(s). Your
+peer will encrypt all traffic to your system using this public key.
+
+
+
+   .. code-block:: none
+
+     vyos@vyos:~$ show wireguard keypairs pubkey default 
+     hW17UxY7zeydJNPIyo3UtGnBHkzTK/NeBOrDSIU9Tx0=
 
-  wg01# run show wireguard pubkey
-  u41jO3OF73Gq1WARMMFG7tOfk7+r8o8AzPxJ1FZRhzk=
 
 
 Generate named keypair
 ----------------------
 
-Named keypairs can be used on a interface basis, if configured.
-If multiple WireGuard interfaces are being configured, each can have
-their own keypairs.
+Named keypairs can be used on a interface basis, if configured. If
+multiple WireGuard interfaces are being configured, each can have their
+own keypairs.
 
-The commands below will generate 2 keypairs, which are not related
-to each other.
+The commands below will generate 2 keypairs, which are not related to
+each other.
 
 .. code-block:: none
 
-  wg01:~$ configure
-  wg01# run generate wireguard named-keypairs KP01
-  wg01# run generate wireguard named-keypairs KP02
+  vyos@vyos:~$ generate wireguard named-keypairs KP01
+  vyos@vyos:~$ generate wireguard named-keypairs KP02
 
 
 Interface configuration
 -----------------------
 
-The next step is to configure your local side as well as the policy based
-trusted destination addresses. If you only initiate a connection, the listen
-port and endpoint is optional, if you however act as a server and endpoints
-initiate the connections to your system, you need to define a port your clients
-can connect to, otherwise it's randomly chosen and may make it difficult with
-firewall rules, since the port may be a different one when you reboot your
-system.
+The next step is to configure your local side as well as the policy
+based trusted destination addresses. If you only initiate a connection,
+the listen port and endpoint is optional, if you however act as a server
+and endpoints initiate the connections to your system, you need to
+define a port your clients can connect to, otherwise it's randomly
+chosen and may make it difficult with firewall rules, since the port may
+be a different one when you reboot your system.
 
-You will also need the public key of your peer as well as the network(s) you
-want to tunnel (allowed-ips) to configure a WireGuard tunnel. The public key
-below is always the public key from your peer, not your local one.
+You will also need the public key of your peer as well as the network(s)
+you want to tunnel (allowed-ips) to configure a WireGuard tunnel. The
+public key below is always the public key from your peer, not your local
+one.
 
 **local side**
 
@@ -79,24 +84,25 @@ below is always the public key from your peer, not your local one.
   set interfaces wireguard wg01 port '12345'
   set protocols static interface-route 10.2.0.0/24 next-hop-interface wg01
 
-.. note:: The `endpoint` must be an IP and not a fully qualified domain name
-   (FQDN). Using a FQDN will result in unexpected behavior.
+.. note:: The `endpoint` must be an IP and not a fully qualified domain
+  name (FQDN). Using a FQDN will result in unexpected behavior.
 
-The last step is to define an interface route for 10.2.0.0/24 to get through
-the WireGuard interface `wg01`. Multiple IPs or networks can be defined and
-routed, the last check is allowed-ips which either prevents or allows the
-traffic.
+The last step is to define an interface route for 10.2.0.0/24 to get
+through the WireGuard interface `wg01`. Multiple IPs or networks can be
+defined and routed, the last check is allowed-ips which either prevents
+or allows the traffic.
 
 
-To use a named key on an interface, the option private-key needs to be set.
+To use a named key on an interface, the option private-key needs to be
+set.
 
 .. code-block:: none
 
   set interfaces wireguard wg01 private-key KP01
   set interfaces wireguard wg02 private-key KP02
 
-The command ``run show wireguard keypairs pubkey KP01`` will then show the public key,
-which needs to be shared with the peer.
+The command ``run show wireguard keypairs pubkey KP01`` will then show
+the public key, which needs to be shared with the peer.
 
 
 **remote side**
@@ -111,8 +117,8 @@ which needs to be shared with the peer.
   set interfaces wireguard wg01 port '12345'
   set protocols static interface-route 10.1.0.0/24 next-hop-interface wg01
 
-Assure that your firewall rules allow the traffic, in which case you have a
-working VPN using WireGuard
+Assure that your firewall rules allow the traffic, in which case you
+have a working VPN using WireGuard
 
 .. code-block:: none
 
@@ -134,9 +140,9 @@ asymmetric crypto, which is optional.
   wg01# run generate wireguard preshared-key
   rvVDOoc2IYEnV+k5p7TNAmHBMEGTHbPU8Qqg8c/sUqc=
 
-Copy the key, as it is not stored on the local file system. Make sure you
-distribute that key in a safe manner, it's a symmetric key, so only you and
-your peer should have knowledge of its content.
+Copy the key, as it is not stored on the local file system. Make sure
+you distribute that key in a safe manner, it's a symmetric key, so only
+you and your peer should have knowledge of its content.
 
 .. code-block:: none
 
@@ -146,11 +152,11 @@ your peer should have knowledge of its content.
 Road Warrior Example
 --------------------
 
-With WireGuard, a Road Warrior VPN config is similar to a site-to-site VPN. It
-just lacks the ``endpoint`` address.
+With WireGuard, a Road Warrior VPN config is similar to a site-to-site
+VPN. It just lacks the ``endpoint`` address.
 
-In the following example, the IPs for the remote clients are defined in the
-peers. This would allow the peers to interact with one another.
+In the following example, the IPs for the remote clients are defined in
+the peers. This would allow the peers to interact with one another.
 
 .. code-block:: none
 
@@ -173,9 +179,9 @@ peers. This would allow the peers to interact with one another.
         port 2224
     }
 
-The following is the config for the iPhone peer above.  It's important to note
-that the ``AllowedIPs`` setting directs all IPv4 and IPv6 traffic through the
-connection.
+The following is the config for the iPhone peer above. It's important to
+note that the ``AllowedIPs`` setting directs all IPv4 and IPv6 traffic
+through the connection.
 
 .. code-block:: none
 
@@ -191,8 +197,8 @@ connection.
     PersistentKeepalive = 25
 
 
-This MacBook peer is doing split-tunneling, where only the subnets local to the
-server go over the connection.
+This MacBook peer is doing split-tunneling, where only the subnets local
+to the server go over the connection.
 
 .. code-block:: none