Development

router/core.py

@@ -103,8 +103,8 @@ from pathlib import Path
 from validation import (
     VALID_PROTOCOLS, VALID_BLOCKLIST_FORMATS,
     int_range, domainname,
-    inject_interfaces, is_wg, is_dynamic_ip,
-    validate_config,
+    is_wg, is_dynamic_ip,
+    resolve_vlan_derived_fields, validate_config,
 )
 
 SCRIPT_DIR        = Path(__file__).parent
@@ -3079,7 +3079,7 @@ def cmd_apply(data, dry_run=False):
     dnsmasq confs, start/restart all services whose interface is up, nftables,
     timer, and boot service. Safe to run repeatedly.
     """
-    inject_interfaces(data)
+    data = resolve_vlan_derived_fields(data)
     if dry_run:
         print("[DRY RUN] --apply would perform the following actions:")
         print()

router/validation.py

@@ -253,22 +253,47 @@ def is_dynamic_ip(r):
     return ip in ("", "dynamic") or ip is None
 
 
-def inject_interfaces(data):
-    """Mutate data in-place: add derived 'interface' field to every VLAN.
+def derive_vlan_id(subnet, prefix):
+    """Return VLAN ID (1-4094) derived from the active octet of the network address, or None."""
+    try:
+        network  = ipaddress.IPv4Network(f'{subnet}/{prefix}', strict=False)
+        octets   = list(network.network_address.packed)
+        byte_idx = (int(prefix) - 1) // 8
+        vlan_id  = octets[byte_idx]
+        if 1 <= vlan_id <= 4094:
+            return vlan_id
+        return None
+    except Exception:
+        return None
 
-    Called by core.py cmd_apply before apply logic. NOT called by
-    validate_config — validate_config computes iface locally to stay pure.
+
+def resolve_vlan_derived_fields(data):
+    """Return a deep copy of data with vlan_id and interface computed for every VLAN.
+
+    WireGuard VLANs are assigned wg0/wg1/... in ascending vlan_id order for
+    deterministic interface naming regardless of JSON list order.
+    Does not mutate the input dict.
     """
-    lan = data.get("general", {}).get("lan_interface", "eth0")
-    wg_idx = 0
-    for vlan in data.get("vlans", []):
-        if vlan.get("is_vpn"):
-            vlan["interface"] = f"wg{wg_idx}"
-            wg_idx += 1
-        else:
+    import copy
+    result = copy.deepcopy(data)
+    lan    = result.get("general", {}).get("lan_interface", "eth0")
+    vlans  = result.get("vlans", [])
+
+    for vlan in vlans:
+        vlan["vlan_id"] = derive_vlan_id(vlan.get("subnet", ""), vlan.get("subnet_mask", 24))
+
+    wg_entries = [(i, v) for i, v in enumerate(vlans) if is_wg(v)]
+    wg_sorted  = sorted(wg_entries, key=lambda x: (x[1].get("vlan_id") is None, x[1].get("vlan_id") or 0))
+    for wg_idx, (_, vlan) in enumerate(wg_sorted):
+        vlan["interface"] = f"wg{wg_idx}"
+
+    for vlan in vlans:
+        if not is_wg(vlan):
             vid = vlan.get("vlan_id", 1)
             vlan["interface"] = lan if vid == 1 else f"{lan}.{vid}"
 
+    return result
+
 
 # ===================================================================
 # Full config validation (shared with core.py --apply)
@@ -282,16 +307,24 @@ def validate_config(data):
     seen_names        = {}
     seen_listen_ports = {}
 
-    # Pre-compute per-VLAN interface names without mutating data
-    _lan = data.get("general", {}).get("lan_interface", "eth0")
+    # Pre-compute per-VLAN vlan_ids and interface names without mutating data
+    _lan       = data.get("general", {}).get("lan_interface", "eth0")
+    _all_vlans = data.get("vlans", [])
+    _derived_ids = [
+        derive_vlan_id(_v.get("subnet", ""), _v.get("subnet_mask", 24))
+        for _v in _all_vlans
+    ]
+    _wg_sorted = sorted(
+        [(i, _derived_ids[i]) for i, _v in enumerate(_all_vlans) if is_wg(_v)],
+        key=lambda x: (x[1] is None, x[1] or 0)
+    )
+    _wg_order = {orig_i: wg_idx for wg_idx, (orig_i, _) in enumerate(_wg_sorted)}
     vlan_ifaces = []
-    _wg_idx = 0
-    for _vlan in data.get("vlans", []):
+    for i, _vlan in enumerate(_all_vlans):
         if is_wg(_vlan):
-            vlan_ifaces.append(f"wg{_wg_idx}")
-            _wg_idx += 1
+            vlan_ifaces.append(f"wg{_wg_order[i]}")
         else:
-            _vid = _vlan.get("vlan_id", 1)
+            _vid = _derived_ids[i]
             vlan_ifaces.append(_lan if _vid == 1 else f"{_lan}.{_vid}")
 
     # -- upstream_dns block ----------------------------------------------------
@@ -339,8 +372,8 @@ def validate_config(data):
     # -- Per-VLAN validation ---------------------------------------------------
     vlan_networks = {}  # iface -> IPv4Network (used for NAT section)
 
-    for vlan, iface in zip(data.get("vlans", []), vlan_ifaces):
-        vlan_id = vlan.get("vlan_id")
+    for i, (vlan, iface) in enumerate(zip(_all_vlans, vlan_ifaces)):
+        vlan_id = _derived_ids[i]
         name    = vlan.get("name", "?")
         label   = f"vlan '{name}' (id={vlan_id})"