claude generated first pass

host/setup.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Host-side bootstrap for the RackNerd VPN hub (Ubuntu).
+# Run as root from the repo: sudo host/setup.sh
+# Idempotent: safe to re-run; never overwrites an existing wg0.conf.
+set -euo pipefail
+cd "$(dirname "$0")"
+
+[ "$(id -u)" -eq 0 ] || { echo "Run as root."; exit 1; }
+
+PUBIF=$(ip -4 route show default | awk '{print $5; exit}')
+echo "==> Public interface: ${PUBIF}"
+
+echo "==> Installing wireguard + iptables-persistent"
+apt-get update -qq
+DEBIAN_FRONTEND=noninteractive apt-get install -y wireguard iptables-persistent
+
+echo "==> sysctl (ip_forward)"
+install -m 0644 99-vpnhub-sysctl.conf /etc/sysctl.d/99-vpnhub.conf
+sysctl --system >/dev/null
+
+echo "==> Firewall (WARNING: INPUT policy DROP — port 22 stays open)"
+sed "s/\${PUBIF}/${PUBIF}/g" rules.v4.template > /etc/iptables/rules.v4
+netfilter-persistent reload
+# reload flushed Docker's chains; put them back if Docker is running
+if systemctl is-active --quiet docker; then
+  systemctl restart docker
+fi
+
+echo "==> WireGuard"
+if [ ! -f /etc/wireguard/wg0.conf ]; then
+  umask 077
+  PRIV=$(wg genkey)
+  sed "s|<RACKNERD_WG_PRIVATE_KEY>|${PRIV}|" wg0.conf.example > /etc/wireguard/wg0.conf
+  echo
+  echo "    RackNerd WG public key (add as a peer at BOTH sites):"
+  echo "    $(echo "${PRIV}" | wg pubkey)"
+  echo
+  echo "    >>> Now edit /etc/wireguard/wg0.conf and paste in the"
+  echo "    >>> Trochalakis and Oswald public keys, then:"
+  echo "    >>>   systemctl enable --now wg-quick@wg0"
+else
+  echo "    /etc/wireguard/wg0.conf exists — leaving it alone."
+  systemctl enable --now wg-quick@wg0
+fi
+
+echo "==> Done. Next: cp .env.example .env, fill it in, docker compose up -d --build"