From d422b4db8c615879ab6cde07d817424583f18f58 Mon Sep 17 00:00:00 2001
From: Ruakij <ruakij@ruekov.eu>
Date: Tue, 20 Oct 2026 23:33:14 +0000
Subject: [PATCH] Make INTERFACE optional with default wg0, document host
 networking, capabilities and name lookup

---
 README.md                                     | 12 ++++----
 cmd/app/main.go                               |  7 -----
 lib/environmentchecks/environmentchecks.go    | 17 ++---------
 .../environmentchecks_test.go                 | 29 +++++++++++++++++++
 4 files changed, 38 insertions(+), 27 deletions(-)
 create mode 100644 lib/environmentchecks/environmentchecks_test.go

diff --git a/README.md b/README.md
index 8781504..42dc2fd 100644
--- a/README.md
+++ b/README.md
@@ -42,21 +42,21 @@ In case routes clash or cant be added to Wireguard, Warnings will be logged.
 
 Variable|Description|Type|Default
 -|-|-|-
-`INTERFACE`*      | Wireguard-Interface Name | String       |
+`INTERFACE`       | Wireguard-Interface Name, empty for the default | String       | wg0
 `FILTER_PROTOCOL` | Protocol to react on | Number / iproute2-name  | All
 `FILTER_TABLE`    | Table to react on | Number / iproute2-name  | All
 `PERIODIC_SYNC`   | Reguarly sync the routing-table <br> Useful when the wg-interface is changed/updated without us knowing  | Seconds  | -1
 `PROTECTED_PREFIXES` | Prefixes that are never added, moved or removed, see [2.3](#23-ownership-of-allowedips) | Comma-separated CIDRs  | -
 
-*\* Required*
+Protocol and table names are read from `rt_protos` and `rt_tables`, and the `*.conf` files in `rt_protos.d` and `rt_tables.d`, in `/usr/share/iproute2` and `/etc/iproute2`. Entries in `/etc/iproute2` take precedence.
 
 <br>
 
 ### 1.2.2. Docker
 
-Depending on the needs, the Container can be run in `network_mode: host` to be able to access routing-tables and interfaces of the host.
+The Container has to run in the network namespace of the Wireguard-Interface, which is the host for most setups. That makes it `network_mode: host`, as the routing-tables and interfaces are only visible there.
 
-Additionally the capability `NET_ADMIN` is required for interacting with interfaces.
+The only required capability is `NET_ADMIN`, for interacting with interfaces. All others can be dropped.
 
 <details><summary><code>docker-compose.yml</code></summary>
 
@@ -68,6 +68,8 @@ services:
     image: ghcr.io/ruakij/routingtabletowg
     restart: unless-stopped
     network_mode: host
+    cap_drop:
+      - ALL
     cap_add:
       - NET_ADMIN
     environment:
@@ -81,7 +83,7 @@ services:
 
 Requires Go 1.27.3 or newer and Linux.
 
-Clone the Repository `git clone <URI>` and build the Program with `make build` (or `go build ./cmd/app`)
+Clone the Repository `git clone <URI>` and build the Program with `make build` (or `go build -o bin/routingtabletowg ./cmd/app`)
 
 Then you can run it with `./bin/routingtabletowg`
 
diff --git a/cmd/app/main.go b/cmd/app/main.go
index 7c4c8b5..582a7a6 100644
--- a/cmd/app/main.go
+++ b/cmd/app/main.go
@@ -15,9 +15,6 @@ import (
 	"golang.zx2c4.com/wireguard/wgctrl"
 )
 
-var envRequired = []string{
-	"INTERFACE",
-}
 var envDefaults = map[string]string{
 	"INTERFACE": "wg0",
 	// "MANAGE_ALL": "true",
@@ -30,10 +27,6 @@ var envDefaults = map[string]string{
 
 func main() {
 	// Environment-vars
-	err := envChecks.HandleRequired(envRequired)
-	if err != nil {
-		logger.Error.Fatal(err)
-	}
 	envChecks.HandleDefaults(envDefaults)
 
 	iface := os.Getenv("INTERFACE")
diff --git a/lib/environmentchecks/environmentchecks.go b/lib/environmentchecks/environmentchecks.go
index fe678f9..72766d7 100644
--- a/lib/environmentchecks/environmentchecks.go
+++ b/lib/environmentchecks/environmentchecks.go
@@ -1,27 +1,14 @@
 package environmentchecks
 
 import (
-	"fmt"
 	"os"
 )
 
+// HandleDefaults sets every env that is unset or empty to its default.
 func HandleDefaults(envDefaults map[string]string) {
 	for env, defaultValue := range envDefaults {
-		// Check if env is set
-		_, isSet := os.LookupEnv(env)
-		if !isSet {
+		if os.Getenv(env) == "" {
 			os.Setenv(env, defaultValue)
 		}
 	}
 }
-
-func HandleRequired(envRequired []string) error {
-	for _, env := range envRequired {
-		// Check if env is set
-		_, isSet := os.LookupEnv(env)
-		if !isSet {
-			return fmt.Errorf("env '%s' required, but not set", env)
-		}
-	}
-	return nil
-}
diff --git a/lib/environmentchecks/environmentchecks_test.go b/lib/environmentchecks/environmentchecks_test.go
new file mode 100644
index 0000000..4f1207a
--- /dev/null
+++ b/lib/environmentchecks/environmentchecks_test.go
@@ -0,0 +1,29 @@
+package environmentchecks
+
+import (
+	"os"
+	"testing"
+)
+
+func TestHandleDefaults(t *testing.T) {
+	t.Setenv("TEST_UNSET", "")
+	os.Unsetenv("TEST_UNSET")
+	t.Setenv("TEST_EMPTY", "")
+	t.Setenv("TEST_SET", "value")
+
+	HandleDefaults(map[string]string{
+		"TEST_UNSET": "default",
+		"TEST_EMPTY": "default",
+		"TEST_SET":   "default",
+	})
+
+	for env, want := range map[string]string{
+		"TEST_UNSET": "default",
+		"TEST_EMPTY": "default",
+		"TEST_SET":   "value",
+	} {
+		if got := os.Getenv(env); got != want {
+			t.Errorf("%s = %q, want %q", env, got, want)
+		}
+	}
+}