WIP

peer/wginterface/interface.go

@@ -21,6 +21,7 @@ import (
 // Create creates a WireGuard interface named name, assigns vpnIP/prefixLen to
 // it, and brings it up.
 func Create(name string, vpnIP net.IP, prefixLen int) error {
+	_ = Delete(name) // remove any stale interface left by a previous run
 	if err := nlNewLink(name); err != nil {
 		return fmt.Errorf("failed to create wireguard link: %w", err)
 	}

peer/wginterface/manage.go

@@ -84,6 +84,17 @@ func (d *Device) Peer(pubKey wgtypes.Key) (wgtypes.Peer, error) {
 	return wgtypes.Peer{}, fmt.Errorf("peer %v not found in %q", pubKey, d.name)
 }
 
+// AddPeer registers a peer with no AllowedIPs and no endpoint. WireGuard will
+// accept handshakes from this peer but route no traffic to it yet.
+func (d *Device) AddPeer(pubKey wgtypes.Key) error {
+	return d.client.ConfigureDevice(d.name, wgtypes.Config{
+		Peers: []wgtypes.PeerConfig{{
+			PublicKey:         pubKey,
+			ReplaceAllowedIPs: true,
+		}},
+	})
+}
+
 // SetRelay configures the relay peer with AllowedIPs covering the entire VPN
 // network prefix. This is the fallback route for all VPN traffic.
 func (d *Device) SetRelay(pubKey wgtypes.Key, endpoint netip.AddrPort, network netip.Prefix) error {