Bring up WireGuard when provided and add SSH preflight summary

agent/pipeline_engine.py

@@ -21,6 +21,9 @@ import yaml
 import logging
 import os
 import time
+import base64
+import subprocess
+import socket
 from distutils.util import strtobool
 from .netbox_client import NetBoxClient
 from agent.network_ops import create_gns3_project
@@ -221,6 +224,7 @@ class OvergrowthPipeline:
         # Enable deployment by default; set OG_DEPLOY_ENABLED=0 to disable in restricted envs.
         self.deploy_enabled = strtobool(os.getenv("OG_DEPLOY_ENABLED", "1")) == 1
         self.ssh_on_seed_fail = strtobool(os.getenv("OG_SSH_ON_SEED_FAIL", "0")) == 1
+        self._ensure_wireguard()
 
     def _slugify(self, text: str, length: int = 24) -> str:
         import re
@@ -229,6 +233,45 @@ class OvergrowthPipeline:
             slug = "network"
         return slug[:length]
 
+    def _ensure_wireguard(self):
+        """
+        If WG_CONFIG_B64 is provided, bring up wg0 using that config.
+        """
+        wg_cfg_b64 = os.getenv("WG_CONFIG_B64")
+        if not wg_cfg_b64:
+            return
+        # If wg0 already exists, skip
+        try:
+            already_up = subprocess.run(
+                ["ip", "link", "show", "wg0"],
+                stdout=subprocess.DEVNULL,
+                stderr=subprocess.DEVNULL,
+                timeout=2,
+            )
+            if already_up.returncode == 0:
+                logger.info("WireGuard wg0 already up; skipping bring-up")
+                return
+        except Exception:
+            pass
+
+        try:
+            cfg_bytes = base64.b64decode(wg_cfg_b64)
+            cfg_path = Path("/tmp/wg0.conf")
+            cfg_path.write_bytes(cfg_bytes)
+            logger.info("Bringing up WireGuard interface wg0 from WG_CONFIG_B64")
+            result = subprocess.run(
+                ["wg-quick", "up", str(cfg_path)],
+                capture_output=True,
+                text=True,
+                timeout=15,
+            )
+            if result.returncode != 0:
+                logger.error(f"WireGuard bring-up failed: {result.stderr.strip()}")
+            else:
+                logger.info("WireGuard wg0 up")
+        except Exception as e:
+            logger.error(f"WireGuard setup error: {e}")
+
     def _prepare_lab_info(self, intent: NetworkIntent, create_project: bool = False) -> Dict[str, Any]:
         """
         Return lab link info and optionally create a project via MCP to get the project_id.
@@ -274,6 +317,26 @@ class OvergrowthPipeline:
             lab_info["web_url"] = f"{self.gns3_server.rstrip('/')}/static/webUi"
 
         return lab_info
+
+    def _ssh_preflight(self, model: NetworkModel, port: int = 22, timeout: int = 3) -> List[Dict[str, Any]]:
+        """Attempt TCP connection to each device mgmt_ip to surface reachability before deployment."""
+        results = []
+        for device in model.devices:
+            ip = getattr(device, "mgmt_ip", None)
+            status = {"device": device.name, "ip": ip, "port": port}
+            if not ip:
+                status["status"] = "missing_ip"
+                status["error"] = "No mgmt_ip set"
+                results.append(status)
+                continue
+            try:
+                with socket.create_connection((ip, port), timeout=timeout):
+                    status["status"] = "reachable"
+            except Exception as e:
+                status["status"] = "unreachable"
+                status["error"] = str(e)
+            results.append(status)
+        return results
     
     def _build_model_from_dict(self, data: Dict[str, Any], description: str,
                                constraints: Optional[List[str]] = None) -> NetworkModel:
@@ -1267,6 +1330,17 @@ Be specific and practical. Use RFC1918 addressing. Consider scalability and secu
                 "name": lab_info.get("project_name"),
                 "id": lab_info.get("project_id")
             }
+
+        # Deployment credentials from environment
+        env_username = os.getenv("DEPLOY_USERNAME")
+        env_password = os.getenv("DEPLOY_PASSWORD")
+        env_port = int(os.getenv("DEPLOY_PORT", "22"))
+        if credentials is None:
+            credentials = {
+                'username': env_username or 'admin',
+                'password': env_password or 'admin'
+            }
+        ssh_preflight = self._ssh_preflight(model, port=env_port)
         
         from agent.deployment_engine import DeploymentEngine
         
@@ -1362,7 +1436,8 @@ Be specific and practical. Use RFC1918 addressing. Consider scalability and secu
                     credentials=credentials,
                     dry_run=dry_run,
                     pre_checks=default_pre_checks,
-                    post_checks=default_post_checks
+                    post_checks=default_post_checks,
+                    port=env_port
                 )
                 
                 results.append({
@@ -1401,7 +1476,8 @@ Be specific and practical. Use RFC1918 addressing. Consider scalability and secu
             'results': results,
             'summary': summary,
             'seed_results': seed_results,
-            'deploy_mode': deploy_mode
+            'deploy_mode': deploy_mode,
+            'ssh_preflight': ssh_preflight
         }
     
     def stage7_observability(self, model: NetworkModel) -> Dict[str, Any]:

app.py

@@ -465,6 +465,15 @@ def build_ui():
                         status += f"- Web UI: {gns3_web}\n"
                     status += "\n"
                 
+                # SSH preflight summary (if available)
+                preflight_ssh = results.get("deployment", {}).get("ssh_preflight") if isinstance(results.get("deployment"), dict) else None
+                if preflight_ssh:
+                    reachable = len([r for r in preflight_ssh if r.get("status") == "reachable"])
+                    unreachable = len([r for r in preflight_ssh if r.get("status") == "unreachable"])
+                    status += "### 🔌 SSH Reachability\n"
+                    status += f"- Reachable: {reachable}\n"
+                    status += f"- Unreachable: {unreachable}\n\n"
+                
                 # Pre-flight validation section
                 if ready_to_deploy:
                     status += "### ✅ Pre-flight Validation PASSED\n"