feat(wireguard): manage WireGuard peers via Xray's inbound UserManager

backend/xray/api/account.go

@@ -205,4 +205,5 @@ type ProxySettings struct {
 	Shadowsocks     *ShadowsocksTcpAccount
 	Shadowsocks2022 *ShadowsocksAccount
 	Hysteria        *HysteriaAccount
+	Wireguard       *WireguardAccount
 }

backend/xray/api/wireguard_account.go

@@ -0,0 +1,49 @@
+package api
+
+import (
+	"fmt"
+
+	"github.com/xtls/xray-core/common/serial"
+	"github.com/xtls/xray-core/proxy/wireguard"
+
+	"github.com/pasarguard/node/common"
+)
+
+type WireguardAccount struct {
+	BaseAccount
+	PublicKey  string   `json:"publicKey"`
+	AllowedIPs []string `json:"allowedIPs"`
+}
+
+func (wa *WireguardAccount) Message() (*serial.TypedMessage, error) {
+	return ToTypedMessage(&wireguard.PeerConfig{
+		PublicKey:  wa.PublicKey,
+		AllowedIps: wa.AllowedIPs,
+	})
+}
+
+func NewWireguardAccount(user *common.User) (*WireguardAccount, error) {
+	wg := user.GetProxies().GetWireguard()
+	if wg == nil || wg.GetPublicKey() == "" {
+		return nil, fmt.Errorf("wireguard public_key is required")
+	}
+
+	pubHex, err := WireguardKeyToHex(wg.GetPublicKey())
+	if err != nil {
+		return nil, fmt.Errorf("wireguard public_key: %w", err)
+	}
+
+	allowed := wg.GetPeerIps()
+	if len(allowed) == 0 {
+		return nil, fmt.Errorf("wireguard peer_ips is required")
+	}
+
+	return &WireguardAccount{
+		BaseAccount: BaseAccount{
+			Email: user.GetEmail(),
+			Level: 0,
+		},
+		PublicKey:  pubHex,
+		AllowedIPs: allowed,
+	}, nil
+}

backend/xray/api/wireguard_key.go

@@ -0,0 +1,31 @@
+package api
+
+import (
+	"encoding/base64"
+	"encoding/hex"
+	"fmt"
+	"strings"
+)
+
+// WireguardKeyToHex normalizes a WireGuard key from base64 (panel) or hex (Xray API) to hex.
+func WireguardKeyToHex(key string) (string, error) {
+	key = strings.TrimSpace(key)
+	if key == "" {
+		return "", fmt.Errorf("empty wireguard key")
+	}
+
+	if len(key) == 64 {
+		if _, err := hex.DecodeString(key); err == nil {
+			return key, nil
+		}
+	}
+
+	raw, err := base64.StdEncoding.DecodeString(key)
+	if err != nil {
+		return "", fmt.Errorf("invalid wireguard key encoding: %w", err)
+	}
+	if len(raw) != 32 {
+		return "", fmt.Errorf("invalid wireguard key length: %d", len(raw))
+	}
+	return hex.EncodeToString(raw), nil
+}

backend/xray/config.go

@@ -25,6 +25,7 @@ const (
 	Trojan      = "trojan"
 	Shadowsocks = "shadowsocks"
 	Hysteria    = "hysteria"
+	Wireguard   = "wireguard"
 )
 
 type Config struct {
@@ -199,6 +200,21 @@ func (i *Inbound) syncUsers(users []*common.User) {
 				i.clients[user.GetEmail()] = api.NewHysteriaAccount(user)
 			}
 		}
+
+	case Wireguard:
+		for _, user := range users {
+			if user.GetProxies().GetWireguard() == nil {
+				continue
+			}
+			if slices.Contains(user.Inbounds, i.Tag) {
+				account, err := api.NewWireguardAccount(user)
+				if err != nil {
+					log.Println("error for user", user.GetEmail(), ":", err)
+					continue
+				}
+				i.clients[account.GetEmail()] = account
+			}
+		}
 	}
 }
 
@@ -235,6 +251,9 @@ func (i *Inbound) updateUser(account api.Account) {
 
 	case *api.HysteriaAccount:
 		i.clients[email] = a
+
+	case *api.WireguardAccount:
+		i.clients[email] = a
 	}
 }
 
@@ -291,6 +310,13 @@ func (i *Inbound) updateUsers(accounts []api.Account, removeEmails []string) {
 				i.clients[account.GetEmail()] = a
 			}
 		}
+
+	case Wireguard:
+		for _, account := range accounts {
+			if a, ok := account.(*api.WireguardAccount); ok {
+				i.clients[account.GetEmail()] = a
+			}
+		}
 	}
 
 	for _, email := range removeEmails {
@@ -326,7 +352,11 @@ func (c *Config) ToBytes() ([]byte, error) {
 		}
 
 		if len(i.clients) == 0 {
-			i.Settings["clients"] = []any{}
+			if i.Protocol == Wireguard {
+				i.Settings["peers"] = []any{}
+			} else {
+				i.Settings["clients"] = []any{}
+			}
 			continue
 		}
 
@@ -386,6 +416,15 @@ func (c *Config) ToBytes() ([]byte, error) {
 				}
 			}
 			i.Settings["clients"] = clients
+
+		case Wireguard:
+			peers := make([]*api.WireguardAccount, 0, len(i.clients))
+			for _, account := range i.clients {
+				if wgAccount, ok := account.(*api.WireguardAccount); ok {
+					peers = append(peers, wgAccount)
+				}
+			}
+			i.Settings["peers"] = peers
 		}
 	}
 

backend/xray/user.go

@@ -40,6 +40,12 @@ func setupUserAccount(user *common.User) (api.ProxySettings, error) {
 		settings.Hysteria = api.NewHysteriaAccount(user)
 	}
 
+	if user.GetProxies().GetWireguard() != nil {
+		if wgAccount, err := api.NewWireguardAccount(user); err == nil {
+			settings.Wireguard = wgAccount
+		}
+	}
+
 	return settings, nil
 }
 
@@ -114,6 +120,12 @@ func isActiveInbound(inbound *Inbound, inbounds []string, settings api.ProxySett
 				return nil, false
 			}
 			return settings.Hysteria, true
+
+		case Wireguard:
+			if settings.Wireguard == nil {
+				return nil, false
+			}
+			return settings.Wireguard, true
 		}
 	}
 	return nil, false
@@ -140,7 +152,7 @@ func (x *Xray) SyncUser(ctx context.Context, user *common.User) error {
 			continue
 		}
 
-		_ = handler.RemoveInboundUser(ctx, inbound.Tag, user.Email)
+		_ = handler.RemoveInboundUser(ctx, inbound.Tag, user.GetEmail())
 		account, isActive := isActiveInbound(inbound, userInbounds, proxySetting)
 		if isActive {
 			inbound.updateUser(account)

go.mod

@@ -9,7 +9,7 @@ require (
 	github.com/joho/godotenv v1.5.1
 	github.com/shirou/gopsutil/v4 v4.26.6
 	github.com/vishvananda/netlink v1.3.1
-	github.com/xtls/xray-core v1.260327.0
+	github.com/xtls/xray-core v1.260327.1-0.20260711155151-50231eaff98c
 	golang.org/x/sys v0.47.0
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
 	google.golang.org/grpc v1.82.1
@@ -18,8 +18,8 @@ require (
 
 require (
 	github.com/andybalholm/brotli v1.1.0 // indirect
-	github.com/apernet/quic-go v0.59.1-0.20260217092621-db4786c77a22 // indirect
-	github.com/cloudflare/circl v1.6.3 // indirect
+	github.com/apernet/quic-go v0.59.1-0.20260425001925-6c6cc9bcb716 // indirect
+	github.com/cloudflare/circl v1.6.4 // indirect
 	github.com/ebitengine/purego v0.10.0 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
 	github.com/google/btree v1.1.2 // indirect
@@ -28,35 +28,42 @@ require (
 	github.com/josharian/native v1.1.0 // indirect
 	github.com/juju/ratelimit v1.0.2 // indirect
 	github.com/klauspost/compress v1.17.8 // indirect
-	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
+	github.com/klauspost/cpuid/v2 v2.4.0 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
 	github.com/mdlayher/genetlink v1.3.2 // indirect
 	github.com/mdlayher/netlink v1.7.2 // indirect
 	github.com/mdlayher/socket v0.5.1 // indirect
 	github.com/miekg/dns v1.1.72 // indirect
-	github.com/pires/go-proxyproto v0.11.0 // indirect
+	github.com/pion/dtls/v3 v3.1.4 // indirect
+	github.com/pion/logging v0.2.4 // indirect
+	github.com/pion/stun/v3 v3.1.6 // indirect
+	github.com/pion/transport/v4 v4.0.2 // indirect
+	github.com/pires/go-proxyproto v0.15.0 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect
 	github.com/refraction-networking/utls v1.8.3-0.20260301010127-aa6edf4b11af // indirect
+	github.com/robfig/cron/v3 v3.0.1 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/sagernet/sing v0.5.1 // indirect
 	github.com/sagernet/sing-shadowsocks v0.2.7 // indirect
 	github.com/tklauser/go-sysconf v0.3.16 // indirect
 	github.com/tklauser/numcpus v0.11.0 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
+	github.com/wlynxg/anet v0.0.5 // indirect
 	github.com/xtls/reality v0.0.0-20260322125925-9234c772ba8f // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
-	golang.org/x/crypto v0.52.0 // indirect
+	golang.org/x/crypto v0.54.0 // indirect
 	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 // indirect
-	golang.org/x/mod v0.35.0 // indirect
-	golang.org/x/net v0.54.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
-	golang.org/x/time v0.12.0 // indirect
-	golang.org/x/tools v0.44.0 // indirect
+	golang.org/x/mod v0.37.0 // indirect
+	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb // indirect
+	golang.zx2c4.com/wireguard/windows v1.0.1 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
 	gvisor.dev/gvisor v0.0.0-20260122175437-89a5d21be8f0 // indirect
 	lukechampine.com/blake3 v1.4.1 // indirect