Aegis-VPN v3.0.0

[rabindra789]

What's New

This is a major version release — the largest update since the project started.

---

Bug Fixes

• add_client.sh — Fixed undefined $CLIENT_IP variable that silently wrote broken peer entries
• add_client.sh — Fixed IP collision bug when re-adding clients after deletion (replaced ls | grep -c with lock file + counter)
• manage_clients.sh — Fixed destructive sed regex that could corrupt wg0.conf on client removal (rewritten with awk)
• setup.sh — Fixed typo /etc/systl.conf → /etc/sysctl.conf (IP forwarding was not persisting across reboots)

---

New Features

Server-Side Key Rotation (aegis-vpn rotate-server)

Resolves #5. Rotates the WireGuard server private key with minimal client disruption:

• Swaps the kernel-level key in-place via wg set — interface stays up, no firewall flush
• Clients lose ~1 handshake cycle (~5 s), then reconnect automatically
• All client configs updated atomically before any reconnection attempt
• Full audit record (old key, new key, timestamp, client count)
• --qr flag re-displays QR codes for all clients after rotation

Client Key Rotation (aegis-vpn rotate <client>)

Regenerates a single client's keys without changing their IP, DNS, or tunnel mode. New QR code displayed automatically.

Status Dashboard (aegis-vpn status)

Shows WireGuard service state, uptime, and per-peer bandwidth (sent/received) via wg show transfer.

Backup & Restore (aegis-vpn backup / aegis-vpn restore <file>)

Creates a timestamped tarball of /etc/wireguard/ and clients/. Restore stops WireGuard, extracts, and restarts cleanly.

Config Validation (aegis-vpn check)

Validates wg0.conf integrity: checks key formats, detects orphaned peers (in server config but no client file), and detects orphaned client files (no matching server peer).

DNS Selection

When adding a client, choose your DNS resolver: Cloudflare, Google, Quad9, or custom.

Split Tunneling

When adding a client, choose between full tunnel (0.0.0.0/0) or VPN-only subnet routing.

Log Rotation

Logs auto-rotate at 10 MB, keeping 3 rotations.

---

Hardening

• New scripts/lib.sh shared library — eliminates duplicated constants across all scripts
• Auto-detect network interface via ip route (removes hardcoded enX0)
• set -euo pipefail across all scripts
• Input validation on client names ([a-zA-Z0-9_-], max 32 chars)
• Atomic lock file prevents IP allocation race conditions

CLI / UX

• 13-option interactive menu with live peer count in header
• Color output: green = online, red = offline, yellow = warning
• Live dashboard reads wg show data (replaces log file parsing)
• Table-format list with Name / IPv4 / IPv6 / Status / Last Handshake
• Spinners for long operations
• aegis-vpn --help, aegis-vpn version

---

New Files

File	Description
scripts/lib.sh	Shared constants, colors, utility functions
scripts/rotate_server.sh	Server key rotation
scripts/rotate_client.sh	Client key rotation
scripts/backup_restore.sh	Backup and restore
scripts/validate.sh	Config integrity validation

---

Upgrade from v1.x

No migration needed — existing clients/*.conf and /etc/wireguard/wg0.conf remain compatible.
Run aegis-vpn check after upgrading to verify config integrity.

---

This discussion was created from the release Aegis-VPN v3.0.0.