CERES is a broker service I wrote to turn a growing WireGuard-based private network from something managed by hand into something that manages itself. It runs as an always-on Flask app under systemd.
What it does
- Automatic IP allocation: separate IP ranges are defined per device class (field panels, user devices, admin, the server itself); when a new peer registers, a free address from the right range is picked automatically.
- WireGuard peer management: new peers are added to/removed from
wg0.confautomatically — no manual file editing. - Dynamic DNS: each peer can be given a name; a BIND (named) zone file mapping those names is generated and reloaded automatically, so devices can reach each other by name instead of IP inside the VPN.
- Registration history: each peer's serial number, public key, display name, DNS name and last-seen time are kept in SQLite.
- A simple admin panel: a lightweight web UI to view/manage registered peers.
End result: deploying a new device in the field (e.g. a lighting panel) requires no manual server-side steps — sending a registration request is enough, and IP allocation, VPN access and DNS registration all happen automatically.
A minimal illustration
A tiny example capturing the idea of picking a free address from an IP pool, unrelated to the real code:
import ipaddress
def allocate_ip(start, end, used_ips):
for ip in ipaddress.summarize_address_range(
ipaddress.ip_address(start), ipaddress.ip_address(end)):
for candidate in ip:
if str(candidate) not in used_ips:
return str(candidate)
raise RuntimeError("IP pool exhausted")