[miguel-fly]

Problem

• A WireGuard token can create peers on every private network in its org.
• Nothing can mint a token that is limited to a network.

Solution

• fly tokens create wireguard --network <name> mints a token that can add and remove WireGuard peers only on the named networks.

Details

• Bumps macaroon to v0.3.3, which adds the NetworkNames caveat (Add support for network-names caveat. macaroon#51).
• The flag adds a second caveat to the token: IfPresent(NetworkNames{<name>: all}, else: read).
• A write that names no network is refused, so code that ignores networks fails closed. Reads still work.
• Repeat the flag or separate names with commas. default is the org's default network (flyio.NetworkNameDefault, in the macaroon library).
• Empty names are refused. An empty name in the caveat means every network, so --network "" or --network a,,b would mint an unlimited token.
• Without the flag the token is the same as before.

Notes

• Part of https://github.com/superfly/mpg/issues/547.
• The gateway check is https://github.com/superfly/nomad-firecracker/pull/5305.
• flyctl does not check the name format. The API owns that rule, and a name that matches no network gives a token that works nowhere.

Rollout

• A limited token works in token mode once the gateway change is deployed.
• The old peer creation path needs the matching change in web. Until then it refuses a limited token.
• Services on an older macaroon refuse any token that carries the caveat.