feat: add DNS server routes to WireGuard profiles and gateway firewall rules

Add mergeProfileAllowedIPs function to combine policy destinations with DNS server routes in device enrollment and rotation. Add dnsServerRoute helper to convert DNS server IPs to /32 CIDR notation. Update BuildSyncBundle query to include gateway DNS servers in peer data. Add DNSServers field to wireguard.Peer struct. Update gateway nftables configuration to allow UDP/TCP port 53 traffic from assigned IPs to DNS servers before

backend/internal/device/service.go

@@ -2,6 +2,7 @@ package device
 
 import (
 	"context"
+	"strings"
 
 	"github.com/google/uuid"
 
@@ -61,11 +62,12 @@ func (s *Service) Enroll(ctx context.Context, userID uuid.UUID, input EnrollRequ
 	if len(destinations) == 0 {
 		destinations = []string{"172.16.10.0/24"}
 	}
+	profileAllowedIPs := mergeProfileAllowedIPs(destinations, selectedGateway.DNSServers)
 
 	enrollment.Peer = PeerView{
 		AssignedIP: assignedIP,
 		DNSServers: selectedGateway.DNSServers,
-		AllowedIPs: destinations,
+		AllowedIPs: profileAllowedIPs,
 		Gateway: GatewayView{
 			ID:        selectedGateway.ID,
 			Name:      selectedGateway.Name,
@@ -90,7 +92,7 @@ func (s *Service) Enroll(ctx context.Context, userID uuid.UUID, input EnrollRequ
 			DNSServers:       selectedGateway.DNSServers,
 			ServerPublicKey:  selectedGateway.PublicKey,
 			ServerEndpoint:   selectedGateway.Endpoint,
-			AllowedIPs:       destinations,
+			AllowedIPs:       profileAllowedIPs,
 			PersistentKeepal: 25,
 		}),
 	}
@@ -149,6 +151,7 @@ func (s *Service) Rotate(ctx context.Context, deviceID uuid.UUID) error {
 }
 
 func withDebugProfile(enrollment EnrollmentResponse) EnrollmentResponse {
+	profileAllowedIPs := mergeProfileAllowedIPs(enrollment.Peer.AllowedIPs, enrollment.Peer.DNSServers)
 	enrollment.Profile = ProfileView{
 		Format: "wireguard",
 		Content: profile.BuildWireGuardConfig(profile.BuildInput{
@@ -157,9 +160,51 @@ func withDebugProfile(enrollment EnrollmentResponse) EnrollmentResponse {
 			DNSServers:       enrollment.Peer.DNSServers,
 			ServerPublicKey:  enrollment.Peer.Gateway.PublicKey,
 			ServerEndpoint:   enrollment.Peer.Gateway.Endpoint,
-			AllowedIPs:       enrollment.Peer.AllowedIPs,
+			AllowedIPs:       profileAllowedIPs,
 			PersistentKeepal: 25,
 		}),
 	}
 	return enrollment
 }
+
+func mergeProfileAllowedIPs(destinations []string, dnsServers []string) []string {
+	seen := make(map[string]struct{}, len(destinations)+len(dnsServers))
+	merged := make([]string, 0, len(destinations)+len(dnsServers))
+
+	for _, destination := range destinations {
+		destination = strings.TrimSpace(destination)
+		if destination == "" {
+			continue
+		}
+		if _, exists := seen[destination]; exists {
+			continue
+		}
+		seen[destination] = struct{}{}
+		merged = append(merged, destination)
+	}
+
+	for _, dnsServer := range dnsServers {
+		route := dnsServerRoute(dnsServer)
+		if route == "" {
+			continue
+		}
+		if _, exists := seen[route]; exists {
+			continue
+		}
+		seen[route] = struct{}{}
+		merged = append(merged, route)
+	}
+
+	return merged
+}
+
+func dnsServerRoute(value string) string {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return ""
+	}
+	if strings.Contains(value, "/") {
+		return value
+	}
+	return value + "/32"
+}