fix(awg): auto-enable Docker IPv6 so dual-stack instances actually work

[leonidorlov-hash]

Problem

The panel already writes dual-stack configs (fd42:8:1::/64 server address, fd42:8:1::N/128 peer addresses, NAT66 rules), but on a stock Docker install the daemon runs IPv4-only. Containers then have no IPv6 route out:

ping6 2606:4700:4700::1111 -> sendto: Network unreachable

Result: clients receive fd42:... addresses in their configs, but IPv6 traffic silently doesn't work — the tunnel is de facto IPv4-only. Reproduced on Debian 13 and Ubuntu 20.04 with default Docker settings.

Fix — three layers, all required

1. Enable IPv6 + NAT66 in the Docker daemon (prepare_host(), runs before every AWG instance install)

When the host has a global IPv6 address, the panel now enforces four keys in /etc/docker/daemon.json (merged, never overwriting other settings; backed up to daemon.json.bak.awp):

• "ipv6": true + "fixed-cidr-v6": "fd00:42::/64" — containers get v6 addressing and a default route
• "experimental": true + "ip6tables": true — without these Docker programs no NAT66 MASQUERADE rule for the ULA subnet, so v6 packets leave the host with an unroutable fd00:42:: source and blackhole

Docker is restarted only when the file actually changed. Keys are enforced unconditionally, so hosts that already have "ipv6": true but lack ip6tables still get fixed on the next install. IPv4-only hosts are untouched.

2. Enable IPv6 inside the container netns at creation time (docker run)

Even with an IPv6-enabled daemon, containers are created with net.ipv6.conf.all.disable_ipv6 = 1, and that flag is fixed at network-namespace creation — it cannot be changed afterwards:

[#] ip -4 address add 10.8.1.1/24 dev awg0     # OK
[#] ip -6 address add fd42:8:1::1/64 dev awg0  # RTNETLINK answers: Permission denied
[#] ip link delete dev awg0                    # awg-quick rolls back: awg0 is gone

Worse, awg-quick's rollback deletes the whole interface, so a failed IPv6 address add takes the working IPv4 tunnel down with it — the instance looks installed but passes no traffic at all.

So host IPv6 is detected before docker run and --sysctl net.ipv6.conf.all.disable_ipv6=0 + net.ipv6.conf.default.disable_ipv6=0 are passed at container creation. On IPv4-only hosts the sysctls are omitted, behaviour unchanged.

Testing

Verified on live servers (Debian 13), layer by layer:

• Stock daemon: containers had no inet6 on eth0, ping6 failed.
• After layer 1 only: ip -6 address add failed with Permission denied and awg-quick deleted awg0 — tunnel fully dead.
• After layers 1+2 without ip6tables: interface up, v6 address and default route present, but ping6 100% loss — no NAT66 MASQUERADE on the host.
• After all layers: disable_ipv6 = 0, fd00:42:: addressing works, host has MASQUERADE ... fd00:42::/64, ping6 succeeds, clients get working IPv6 through the tunnel (test-ipv6.com 10/10).