The One-Click KVM & Mesh Engine transforms hypervisors and isolated virtual machines across diverse cloud providers or bare-metal setups into a unified, secure overlay network. Powered by KVM for hardware virtualization and WireGuard for cryptographically isolated routing, every provisioned guest or hypervisor peer is dynamically registered into a centralized controller-managed tunnel (10.10.0.0/16).

# Enable the fleet VPS functionality of One-Click
ENABLE_VPS=true # Set to true to enable KVM operations

# Threshold that LVM will operate with. Default is 5120MB (5GB)
ALLOC_THRESHOLD=5120

# The location where the .img loop file is generated
IMG_STORAGE_PATH="/etc/one-click/virtualization/storage"

# Firewall monitoring and mitigation (0 = passive, 1 = auto mitigation)
AUTO_MITIGATION=0

The --vps command suite controls the full lifecycle of virtual machine guests across local or remote hypervisor nodes.

# 1. Provision an isolated NAT virtual machine (No public IP assigned)
one-click --vps create --target hypervisor1 --name web-app-vm --image ubuntu24 --cpu 2 --ram 4G --disk 40G --mode nat

# 2. Expose the private NAT guest application to the public internet using --proxy
one-click --proxy --target web-app-vm --website app.example.com --proto https --source 8080 --port 443

# Point-in-time guest snapshot
one-click --vps snapshot create --target hypervisor1 --name web-app-vm_v1

# Live migrate VM across cluster hypervisors
one-click --vps migrate --target hypervisor2 --name web-app-vm

# OS Reinstall
one-click --vps reinstall -n web-app-vm -i ubuntu24 --password "SecretPass123" -l en_US

When joining a new hypervisor node into the cluster overlay network, the Controller automates cryptographic key exchange, endpoint registration, system kernel tuning, and net-filter rules:

1. 1. Key Generation & Endpoint Registration:

   The Controller locally generates hv_private_key, hv_public_key, and a unique hv_preshared_key (PSK). It registers the hypervisor as a [Peer] under /etc/wireguard/one-click.conf on port 51821 and syncs runtime states with wg set.

2. 2. IP Pool Tracking:

   Pulls an available private IPv4 address from FLEET_AVAILABLE_IPS_FILE, shifts it into FLEET_USED_IPS_FILE, and updates host-to-IP JSON mappings via jq.

3. 3. Remote Staging & Ansible Deployment:

   Renders a temporary interface file (/tmp/wg_build_${hv_node_name}.conf) setting MTU to 1412 and routes traffic for 10.10.0.0/16 to the Controller IP. This config is securely pushed to the target machine via Ansible.

4. 4. Remote Kernel Tuning & Firewall Isolation:

   Executes remote Ansible directives to verify wireguard-tools, enables IPv4 forwarding (net.ipv4.ip_forward=1), sets Reverse Path Filtering (rp_filter=2), and adjusts iptables / firewalld rules for WireGuard (UDP 51821), DHCP (UDP 67/68), and DNS (UDP 53).

# Enable IP Forwarding and Loose Reverse Path Filtering
sysctl -w net.ipv4.ip_forward=1
echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-oneclick-vps-routing.conf
echo 'net.ipv4.conf.all.rp_filter=2' >> /etc/sysctl.d/99-oneclick-vps-routing.conf
echo 'net.ipv4.conf.default.rp_filter=2' >> /etc/sysctl.d/99-oneclick-vps-routing.conf
echo 'net.ipv4.conf.one-click.rp_filter=2' >> /etc/sysctl.d/99-oneclick-vps-routing.conf

# Restart Service Daemon
systemctl daemon-reload
systemctl enable wg-quick@one-click
systemctl restart wg-quick@one-click

When a individual VPS guest instance is deployed, the Controller stages its peer parameters and cloud-init definitions locally before pushing them out to the hosting hypervisor:

/etc/one-click/virtualization/
├── storage/                     # Target directory configured in IMG_STORAGE_PATH
├── staging/
│   └── ${vps_name}/
│       ├── user_data.yml        # Cloud-init user credentials & SSH keys
│       └── network-config.yml   # NAT Network interface & gateway mappings
└── deployments/
    └── ${vps_name}/
        ├── user_data.yml        # Archived deployment metadata
        ├── network-config.yml   # Archived network definition
        └── one-click.conf       # Generated WireGuard peer configuration

Generated Peer Interface Template

Every guest instance receives a custom WireGuard configuration configured with explicit MTU clamping (1412) to ensure stable encapsulation over standard 1500-byte public interfaces:

[Interface]
Address = ${vps_private_ip}/16
MTU = 1412
SaveConfig = true
PrivateKey = ${vps_private_key}

[Peer]
PublicKey = ${master_pub_key}
PresharedKey = ${vps_preshared_key}
AllowedIPs = 10.10.0.0/16
Endpoint = ${CONTROLLER_IP}:51821
PersistentKeepalive = 25

To maintain high availability across volatile network states, the engine features runtime config synchronization (wg syncconf) and an automatic emergency link override mechanism.

# Attempt standard startup or sync runtime configuration
if ip link show dev one-click &>/dev/null; then
    wg syncconf one-click <(sudo wg-quick strip one-click)
else
    if ! wg-quick up one-click 2>/tmp/wg_start_error.log; then
        # Emergency link override
        sudo ip link add dev one-click type wireguard
        sudo wg setconf one-click /etc/wireguard/one-click.conf
        sudo ip link set dev one-click mtu 1412
        sudo ip addr add 10.10.0.1/16 dev one-click
        sudo ip link set dev one-click up
    fi
fi