|
1 | 1 | #!/usr/bin/with-contenv bash |
2 | 2 |
|
3 | | -mkdir -p /config |
| 3 | +mkdir -p /config/templates |
4 | 4 |
|
5 | 5 | # install headers and wireguard |
6 | 6 | apt-get update |
@@ -53,59 +53,100 @@ else |
53 | 53 | wireguard |
54 | 54 | fi |
55 | 55 |
|
| 56 | +# prepare symlinks |
56 | 57 | rm -rf /etc/wireguard |
57 | 58 | mkdir -p /etc/wireguard |
58 | 59 | ln -s /config/wg0.conf /etc/wireguard/wg0.conf |
| 60 | +# prepare templates |
| 61 | +[[ ! -f /config/templates/server.conf ]] && \ |
| 62 | + cp /defaults/server.conf /config/templates/server.conf |
| 63 | +[[ ! -f /config/templates/peer.conf ]] && \ |
| 64 | + cp /defaults/peer.conf /config/templates/peer.conf |
59 | 65 |
|
60 | | -if [ ! -f /config/wg0.conf ] && [ -n "$PEERS" ] && [ -n "$SERVERURL" ]; then |
61 | | - SERVERPORT=${SERVERPORT:-51820} |
62 | | - PEERDNS=${PEERDNS:-8.8.8.8} |
| 66 | +generate_confs () { |
63 | 67 | mkdir -p /config/server |
64 | 68 | if [ ! -f /config/server/privatekey-server ]; then |
65 | 69 | umask 077 |
66 | 70 | wg genkey | tee /config/server/privatekey-server | wg pubkey > /config/server/publickey-server |
67 | 71 | fi |
| 72 | + eval "`printf %s` |
68 | 73 | cat <<DUDE > /config/wg0.conf |
69 | | -[Interface] |
70 | | -Address = 10.13.13.1 |
71 | | -ListenPort = 51820 |
72 | | -PrivateKey = $(cat /config/server/privatekey-server) |
73 | | -PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE |
74 | | -PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE |
| 74 | +`cat /config/templates/server.conf` |
75 | 75 |
|
76 | | -DUDE |
77 | | - if ! [[ $PEERS =~ ^[0-9]+$ ]]; then |
78 | | - echo "PEERS is not set to an integer, setting it to 1" |
79 | | - PEERS="1" |
80 | | - fi |
| 76 | +DUDE" |
81 | 77 | for i in $(seq 1 $PEERS); do |
82 | 78 | mkdir -p /config/peer${i} |
83 | | - if [ ! -f /config/peer${i}/privatekey-peer${i} ]; then |
| 79 | + if [ ! -f "/config/peer${i}/privatekey-peer${i}" ]; then |
84 | 80 | umask 077 |
85 | 81 | wg genkey | tee /config/peer${i}/privatekey-peer${i} | wg pubkey > /config/peer${i}/publickey-peer${i} |
86 | 82 | fi |
| 83 | + eval "`printf %s` |
87 | 84 | cat <<DUDE > /config/peer${i}/peer${i}.conf |
88 | | -[Interface] |
89 | | -Address = 10.13.13.$(( $i + 1 )) |
90 | | -PrivateKey = $(cat /config/peer${i}/privatekey-peer${i}) |
91 | | -ListenPort = 51820 |
92 | | -DNS = ${PEERDNS} |
93 | | - |
94 | | -[Peer] |
95 | | -PublicKey = $(cat /config/server/publickey-server) |
96 | | -Endpoint = ${SERVERURL}:${SERVERPORT} |
97 | | -AllowedIPs = 0.0.0.0/0, ::/0 |
98 | | -DUDE |
| 85 | +`cat /config/templates/peer.conf` |
| 86 | +DUDE" |
99 | 87 | cat <<DUDE >> /config/wg0.conf |
100 | 88 | [Peer] |
101 | 89 | PublicKey = $(cat /config/peer${i}/publickey-peer${i}) |
102 | | -AllowedIPs = 10.13.13.$(( $i + 1 ))/32 |
| 90 | +AllowedIPs = ${INTERFACE}.$(( $i + 1 ))/32 |
103 | 91 |
|
104 | 92 | DUDE |
105 | 93 | echo "PEER ${i} QR code:" |
106 | 94 | qrencode -t ansiutf8 < /config/peer${i}/peer${i}.conf |
107 | 95 | qrencode -o /config/peer${i}/peer${i}.png < /config/peer${i}/peer${i}.conf |
108 | 96 | done |
| 97 | +} |
| 98 | + |
| 99 | +save_vars () { |
| 100 | + cat <<DUDE > /config/.donoteditthisfile |
| 101 | +ORIG_SERVERURL=$SERVERURL |
| 102 | +ORIG_SERVERPORT=#SERVER_PORT |
| 103 | +ORIG_PEERDNS=$PEERDNS |
| 104 | +ORIG_PEERS=$PEERS |
| 105 | +ORIG_INTERFACE=$INTERFACE |
| 106 | +DUDE |
| 107 | +} |
| 108 | + |
| 109 | +if [ -n "$PEERS" ]; then |
| 110 | + echo "Server mode is selected" |
| 111 | + if ! [[ "$PEERS" =~ ^[0-9]+$ ]]; then |
| 112 | + echo "PEERS is not set to an integer, setting it to 1" |
| 113 | + PEERS="1" |
| 114 | + fi |
| 115 | + if [ -z "$SERVERURL" ] || [ "$SERVERURL" = "auto" ]; then |
| 116 | + SERVERURL=$(curl icanhazip.com) |
| 117 | + echo "SERVERURL var is either not set or is set to \"auto\", setting external IP to auto detected value of $SERVERURL" |
| 118 | + else |
| 119 | + echo "External server address is set to $SERVERURL" |
| 120 | + fi |
| 121 | + SERVERPORT=${SERVERPORT:-51820} |
| 122 | + echo "External server port is set to ${SERVERPORT}. Make sure that port is properly forwarded to port 51820 inside this container" |
| 123 | + PEERDNS=${PEERDNS:-8.8.8.8} |
| 124 | + echo "DNS server is set to $PEERDNS" |
| 125 | + INTERNAL_SUBNET=${INTERNAL_SUBNET:-10.13.13.0} |
| 126 | + echo "Internal subnet is set to $INTERNAL_SUBNET" |
| 127 | + INTERFACE=$(echo "$INTERNAL_SUBNET" | awk 'BEGIN{FS=OFS="."} NF--') |
| 128 | + if [ ! -f /config/wg0.conf ]; then |
| 129 | + echo "No found wg0.conf found (maybe an initial install), generating 1 server and $PEERS peer/client confs" |
| 130 | + generate_confs |
| 131 | + save_vars |
| 132 | + else |
| 133 | + echo "Server mode is selected" |
| 134 | + [[ -f /config/.donoteditthisfile ]] && \ |
| 135 | + . /config/.donoteditthisfile |
| 136 | + if [ "$SERVERURL" != "$ORIG_SERVERURL" ] || [ "$SERVERPORT" != "$ORIG_SERVERPORT" ] || [ "$PEERDNS" != "$ORIG_PEERDNS" ] || [ "$PEERS" != "$ORIG_PEERS" ] || [ "$INTERFACE" != "$ORIG_INTERFACE" ]; then |
| 137 | + echo "Server related environment variables changed, regenerating 1 server and $PEERS peer/client confs" |
| 138 | + generate_confs |
| 139 | + save_vars |
| 140 | + else |
| 141 | + echo "No changes to parameters. Existing configs are used." |
| 142 | + fi |
| 143 | + fi |
| 144 | +else |
| 145 | + echo "Client mode selected." |
| 146 | + if [ !-f /config/wg0.conf ]; then |
| 147 | + "No client conf found. Provide your own client conf as \"/config/wg0.conf\" and restart the container." |
| 148 | + sleep infinity |
| 149 | + fi |
109 | 150 | fi |
110 | 151 |
|
111 | 152 | # permissions |
|
0 commit comments