feat(wireguard): manage WireGuard peers via Xray's inbound UserManager

backend/xray/api/account.go

@@ -205,4 +205,5 @@ type ProxySettings struct {
 	Shadowsocks     *ShadowsocksTcpAccount
 	Shadowsocks2022 *ShadowsocksAccount
 	Hysteria        *HysteriaAccount
+	Wireguard       *WireguardAccount
 }

backend/xray/api/wireguard_account.go

@@ -0,0 +1,61 @@
+package api
+
+import (
+	"fmt"
+
+	"github.com/xtls/xray-core/common/serial"
+	"github.com/xtls/xray-core/proxy/wireguard"
+
+	"github.com/pasarguard/node/common"
+)
+
+// WireguardAccount is a WireGuard peer for Xray inbound UserManager (email = hex public key).
+type WireguardAccount struct {
+	BaseAccount
+	PublicKey    string
+	PreSharedKey string
+	AllowedIPs   []string
+}
+
+func (wa *WireguardAccount) Message() (*serial.TypedMessage, error) {
+	return ToTypedMessage(&wireguard.PeerConfig{
+		PublicKey:    wa.PublicKey,
+		PreSharedKey: wa.PreSharedKey,
+		AllowedIps:   wa.AllowedIPs,
+	})
+}
+
+func NewWireguardAccount(user *common.User) (*WireguardAccount, error) {
+	wg := user.GetProxies().GetWireguard()
+	if wg == nil || wg.GetPublicKey() == "" {
+		return nil, fmt.Errorf("wireguard public_key is required")
+	}
+
+	pubHex, err := WireguardKeyToHex(wg.GetPublicKey())
+	if err != nil {
+		return nil, fmt.Errorf("wireguard public_key: %w", err)
+	}
+
+	pskHex := ""
+	if psk := wg.GetPreSharedKey(); psk != "" {
+		pskHex, err = WireguardKeyToHex(psk)
+		if err != nil {
+			return nil, fmt.Errorf("wireguard pre_shared_key: %w", err)
+		}
+	}
+
+	allowed := wg.GetPeerIps()
+	if len(allowed) == 0 {
+		return nil, fmt.Errorf("wireguard peer_ips is required")
+	}
+
+	return &WireguardAccount{
+		BaseAccount: BaseAccount{
+			Email: pubHex,
+			Level: 0,
+		},
+		PublicKey:    pubHex,
+		PreSharedKey: pskHex,
+		AllowedIPs:   allowed,
+	}, nil
+}

backend/xray/api/wireguard_key.go

@@ -0,0 +1,31 @@
+package api
+
+import (
+	"encoding/base64"
+	"encoding/hex"
+	"fmt"
+	"strings"
+)
+
+// WireguardKeyToHex normalizes a WireGuard key from base64 (panel) or hex (Xray API) to hex.
+func WireguardKeyToHex(key string) (string, error) {
+	key = strings.TrimSpace(key)
+	if key == "" {
+		return "", fmt.Errorf("empty wireguard key")
+	}
+
+	if len(key) == 64 {
+		if _, err := hex.DecodeString(key); err == nil {
+			return key, nil
+		}
+	}
+
+	raw, err := base64.StdEncoding.DecodeString(key)
+	if err != nil {
+		return "", fmt.Errorf("invalid wireguard key encoding: %w", err)
+	}
+	if len(raw) != 32 {
+		return "", fmt.Errorf("invalid wireguard key length: %d", len(raw))
+	}
+	return hex.EncodeToString(raw), nil
+}

backend/xray/config.go

@@ -25,6 +25,7 @@ const (
 	Trojan      = "trojan"
 	Shadowsocks = "shadowsocks"
 	Hysteria    = "hysteria"
+	Wireguard   = "wireguard"
 )
 
 type Config struct {
@@ -98,7 +99,11 @@ func (c *Config) buildInboundUpdates(users []*common.User) (map[string]*Inbound,
 			if isActive {
 				update.accounts = append(update.accounts, account)
 			} else {
-				update.removeEmailSet[userEmail] = struct{}{}
+				removeKey := userEmail
+				if inbound.Protocol == Wireguard && settings.Wireguard != nil {
+					removeKey = settings.Wireguard.GetEmail()
+				}
+				update.removeEmailSet[removeKey] = struct{}{}
 			}
 		}
 	}
@@ -199,6 +204,21 @@ func (i *Inbound) syncUsers(users []*common.User) {
 				i.clients[user.GetEmail()] = api.NewHysteriaAccount(user)
 			}
 		}
+
+	case Wireguard:
+		for _, user := range users {
+			if user.GetProxies().GetWireguard() == nil {
+				continue
+			}
+			if slices.Contains(user.Inbounds, i.Tag) {
+				account, err := api.NewWireguardAccount(user)
+				if err != nil {
+					log.Println("error for user", user.GetEmail(), ":", err)
+					continue
+				}
+				i.clients[account.GetEmail()] = account
+			}
+		}
 	}
 }
 
@@ -235,6 +255,9 @@ func (i *Inbound) updateUser(account api.Account) {
 
 	case *api.HysteriaAccount:
 		i.clients[email] = a
+
+	case *api.WireguardAccount:
+		i.clients[email] = a
 	}
 }
 
@@ -291,6 +314,13 @@ func (i *Inbound) updateUsers(accounts []api.Account, removeEmails []string) {
 				i.clients[account.GetEmail()] = a
 			}
 		}
+
+	case Wireguard:
+		for _, account := range accounts {
+			if a, ok := account.(*api.WireguardAccount); ok {
+				i.clients[account.GetEmail()] = a
+			}
+		}
 	}
 
 	for _, email := range removeEmails {

backend/xray/user.go

@@ -40,6 +40,12 @@ func setupUserAccount(user *common.User) (api.ProxySettings, error) {
 		settings.Hysteria = api.NewHysteriaAccount(user)
 	}
 
+	if user.GetProxies().GetWireguard() != nil {
+		if wgAccount, err := api.NewWireguardAccount(user); err == nil {
+			settings.Wireguard = wgAccount
+		}
+	}
+
 	return settings, nil
 }
 
@@ -114,11 +120,24 @@ func isActiveInbound(inbound *Inbound, inbounds []string, settings api.ProxySett
 				return nil, false
 			}
 			return settings.Hysteria, true
+
+		case Wireguard:
+			if settings.Wireguard == nil {
+				return nil, false
+			}
+			return settings.Wireguard, true
 		}
 	}
 	return nil, false
 }
 
+func wireguardRemoveEmail(inbound *Inbound, user *common.User, settings api.ProxySettings) string {
+	if inbound.Protocol != Wireguard || settings.Wireguard == nil {
+		return user.GetEmail()
+	}
+	return settings.Wireguard.GetEmail()
+}
+
 func (x *Xray) SyncUser(ctx context.Context, user *common.User) error {
 	x.syncMu.Lock()
 	defer x.syncMu.Unlock()
@@ -140,7 +159,8 @@ func (x *Xray) SyncUser(ctx context.Context, user *common.User) error {
 			continue
 		}
 
-		_ = handler.RemoveInboundUser(ctx, inbound.Tag, user.Email)
+		removeEmail := wireguardRemoveEmail(inbound, user, proxySetting)
+		_ = handler.RemoveInboundUser(ctx, inbound.Tag, removeEmail)
 		account, isActive := isActiveInbound(inbound, userInbounds, proxySetting)
 		if isActive {
 			inbound.updateUser(account)
@@ -232,6 +252,15 @@ func (x *Xray) UpdateUsers(ctx context.Context, users []*common.User) error {
 		inbound.updateUsers(update.accounts, removeEmails)
 
 		for _, email := range removeEmails {
+			if inbound.Protocol == Wireguard {
+				for _, user := range users {
+					settings, _ := setupUserAccount(user)
+					if settings.Wireguard != nil && user.GetEmail() == email {
+						email = settings.Wireguard.GetEmail()
+						break
+					}
+				}
+			}
 			handler.RemoveInboundUser(ctx, tag, email)
 		}
 

backend/xray/wireguard_sync.go

@@ -0,0 +1,58 @@
+package xray
+
+import (
+	"context"
+	"errors"
+	"log"
+	"slices"
+
+	"github.com/pasarguard/node/common"
+)
+
+// pushWireguardPeers applies WG peers via Xray HandlerService (no process restart).
+// Initial JSON should keep settings.peers empty; panel passes users on Start.
+func (x *Xray) pushWireguardPeers(ctx context.Context, users []*common.User) error {
+	handler := x.handler
+	if handler == nil {
+		return errors.New("xray handler not ready")
+	}
+
+	var errMessage string
+	applied := 0
+
+	for _, user := range users {
+		proxySetting, err := setupUserAccount(user)
+		if err != nil || proxySetting.Wireguard == nil {
+			continue
+		}
+
+		userInbounds := user.GetInbounds()
+		for _, inbound := range x.config.InboundConfigs {
+			if inbound.exclude || inbound.Protocol != Wireguard {
+				continue
+			}
+			if !slices.Contains(userInbounds, inbound.Tag) {
+				continue
+			}
+
+			account := proxySetting.Wireguard
+			_ = handler.RemoveInboundUser(ctx, inbound.Tag, account.GetEmail())
+			inbound.updateUser(account)
+			if err := handler.AddInboundUser(ctx, inbound.Tag, accountForAPI(inbound, account)); err != nil {
+				log.Printf("wireguard add peer %s on %s: %v", account.GetEmail(), inbound.Tag, err)
+				errMessage += "\n" + err.Error()
+				continue
+			}
+			applied++
+		}
+	}
+
+	if applied > 0 {
+		log.Printf("wireguard: applied %d peer(s) via API", applied)
+	}
+
+	if errMessage != "" {
+		return errors.New("failed to push wireguard peers:" + errMessage)
+	}
+	return nil
+}

backend/xray/xray.go

@@ -95,6 +95,12 @@ func New(ctx context.Context, xrayConfig *Config, users []*common.User, apiPort,
 		return nil, err
 	}
 
+	if len(users) > 0 {
+		if err = xray.pushWireguardPeers(ctx, users); err != nil {
+			log.Printf("wireguard peer sync after start: %v", err)
+		}
+	}
+
 	// Wait a bit for Xray to fully initialize before starting health checks
 	// This prevents false positives during startup
 	go xray.checkXrayHealth(xCtx)

common/service.proto

@@ -131,6 +131,7 @@ message Shadowsocks {
 message Wireguard {
     string public_key = 1;
     repeated string peer_ips = 2;
+    string pre_shared_key = 3;
 }
 
 message Hysteria {