57 lines
2.1 KiB
Bash
57 lines
2.1 KiB
Bash
#!/usr/bin/env bash
|
|
# Host-side bootstrap for the RackNerd VPN hub (Ubuntu).
|
|
# Run as root from the repo: sudo host/setup.sh
|
|
# Idempotent: safe to re-run; never overwrites an existing wg0.conf.
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")"
|
|
|
|
[ "$(id -u)" -eq 0 ] || { echo "Run as root."; exit 1; }
|
|
|
|
PUBIF=$(ip -4 route show default | awk '{print $5; exit}')
|
|
echo "==> Public interface: ${PUBIF}"
|
|
|
|
echo "==> Installing wireguard + iptables-persistent"
|
|
apt-get update -qq
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y wireguard iptables-persistent
|
|
|
|
echo "==> sysctl (ip_forward)"
|
|
install -m 0644 99-vpnhub-sysctl.conf /etc/sysctl.d/99-vpnhub.conf
|
|
sysctl --system >/dev/null
|
|
|
|
echo "==> Freeing port 53 (systemd-resolved stub listener) for Technitium"
|
|
mkdir -p /etc/systemd/resolved.conf.d
|
|
printf '[Resolve]\nDNSStubListener=no\n' > /etc/systemd/resolved.conf.d/99-vpnhub.conf
|
|
# resolv.conf must stop pointing at the (now dead) 127.0.0.53 stub
|
|
if [ -e /run/systemd/resolve/resolv.conf ]; then
|
|
ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
|
|
fi
|
|
systemctl try-restart systemd-resolved || true
|
|
|
|
echo "==> Firewall (WARNING: INPUT policy DROP — port 22 stays open)"
|
|
sed "s/\${PUBIF}/${PUBIF}/g" rules.v4.template > /etc/iptables/rules.v4
|
|
sed "s/\${PUBIF}/${PUBIF}/g" rules.v6.template > /etc/iptables/rules.v6
|
|
netfilter-persistent reload
|
|
# reload flushed Docker's chains; put them back if Docker is running
|
|
if systemctl is-active --quiet docker; then
|
|
systemctl restart docker
|
|
fi
|
|
|
|
echo "==> WireGuard"
|
|
if [ ! -f /etc/wireguard/wg0.conf ]; then
|
|
umask 077
|
|
PRIV=$(wg genkey)
|
|
sed "s|<RACKNERD_WG_PRIVATE_KEY>|${PRIV}|" wg0.conf.example > /etc/wireguard/wg0.conf
|
|
echo
|
|
echo " RackNerd WG public key (add as a peer at BOTH sites):"
|
|
echo " $(echo "${PRIV}" | wg pubkey)"
|
|
echo
|
|
echo " >>> Now edit /etc/wireguard/wg0.conf and paste in the"
|
|
echo " >>> Trochalakis and Oswald public keys, then:"
|
|
echo " >>> systemctl enable --now wg-quick@wg0"
|
|
else
|
|
echo " /etc/wireguard/wg0.conf exists — leaving it alone."
|
|
systemctl enable --now wg-quick@wg0
|
|
fi
|
|
|
|
echo "==> Done. Next: cp .env.example .env, fill it in, docker compose up -d --build"
|