[tschumacher]

Sounds like a whole lot of effort to avoid a GraphQL request each time a flyctl client wants to connect.

[sudhirj]

Huh? They do make one to set it up. More a way to avoid having the public keys of every single client every loaded up into the wireguard kernel module on the gateway all the time.

[tschumacher]

My implicit suggestion was that clients make a GraphQL request not only before the first connection but before every connection. The gateway server can insert the keys into the kernel in response to an explicit GraphQL request instead of in response to some complicated packet sniffing.

[rudasn]

What would the payload of the grapphql request to fetch the wg config for that peer look like, when they don't know from which peer the request is coming from?

[mrkurt]

This needs to support any ol' wireguard client. We use it in `flyctl` but people also use it to create gateways so they can, eg, peer with VPCs.