network: add auto-detection of optimal MTU for WireGuard interface, --wg-mtu flag, set max_mtu for Corrosion to 1232

internal/machine/network/config.go

@@ -18,9 +18,11 @@ type Config struct {
 	ManagementIP netip.Addr
 	// WireGuardPort is the UDP port WireGuard listens on. Zero means the default port (51820).
 	WireGuardPort int `json:",omitempty"`
-	PrivateKey    secret.Secret
-	PublicKey     secret.Secret
-	Peers         []PeerConfig `json:",omitempty"`
+	// MTU of the WireGuard interface. Use EffectiveMTU to get the default if not set (zero).
+	MTU        int `json:",omitempty"`
+	PrivateKey secret.Secret
+	PublicKey  secret.Secret
+	Peers      []PeerConfig `json:",omitempty"`
 }
 
 type PeerConfig struct {
@@ -48,6 +50,14 @@ func (c Config) EffectiveWireGuardPort() int {
 	return DefaultWireGuardPort
 }
 
+// EffectiveMTU returns the MTU for the WireGuard interface. Falls back to MaxWireGuardMTU if not set (zero).
+func (c Config) EffectiveMTU() int {
+	if c.MTU != 0 {
+		return c.MTU
+	}
+	return MaxWireGuardMTU
+}
+
 // toDeviceConfig converts the configuration to a WireGuard device configuration. It updates the existing peers
 // without replacing them to not disrupt existing connections and to not lose track of the last handshake time.
 func (c Config) toDeviceConfig(currentPeers []wgtypes.Peer) (wgtypes.Config, error) {