Reengineed the code. Generalized the package. Cloud configurators are modules.

2026-08-10 09:02:45 +02:00
parent be4bb34bb0
commit 083ad9a596
40 changed files with 2367 additions and 650 deletions
@@ -0,0 +1,69 @@
+# Example vpn-router configuration.
+#
+# This file is documentation. The live configuration is
+# /etc/vpn-router/vpn-router.conf, which is generated on first install and
+# owned by the operator afterwards. Copy settings from here as needed.
+#
+# Format: INI. Lists are comma-separated, booleans are true/false, an empty
+# value means unset, and a _b64 suffix means the value is base64-encoded.
+#
+# Comments start with # or ; and may follow a value on the same line. That
+# means # and ; cannot appear inside a value - which is why the pre-shared
+# key, the one setting that can hold arbitrary text, is base64-encoded.
+#
+# Apply any change with:  systemctl restart vpn-router-setup
+#
+# Every feature is optional. A file with nothing filled in configures nothing
+# and leaves the host reachable and unchanged.
+
+[general]
+# Platform module to load: generic, azure or gcp.
+platform = generic
+
+[interfaces]
+# The two inputs everything else is built on. Names only: the addresses on
+# these interfaces are read from the system, never configured here.
+# External faces the untrusted network; internal faces the protected one.
+external =
+internal =
+
+[wan]
+# This router's fully-qualified domain name.
+local_fqdn =
+# Source of the local IKE identity: fqdn | public_ip | internal_ip
+#   fqdn        - use local_fqdn (must match what the peer expects)
+#   public_ip   - resolve local_fqdn at boot and use the address
+#   internal_ip - use the address on the internal interface
+local_id_mode = fqdn
+
+[local]
+# Local subnets advertised into the tunnel, comma-separated.
+cidrs =
+# Next hop on the internal side for the subnets above.
+int_gateway_ip =
+
+[remote]
+# Remote gateway address(es) or FQDN, comma-separated.
+addrs =
+# Remote IKE identity, without a leading '@'.
+id =
+# Remote subnets reachable through the tunnel, comma-separated.
+cidrs =
+# Pre-shared key, base64-encoded:  printf %s "$PSK" | base64 -w0
+psk_b64 =
+# Path to a file containing the raw PSK. Takes precedence over psk_b64.
+psk_file =
+
+[p2s]
+# Road-warrior access.
+enabled = false
+# Address pool handed to road-warrior clients.
+address_pool =
+# CN for the CA created when /etc/vpn-router/pki is empty.
+ca_name = VPN Router CA
+
+[wireguard]
+enabled = false
+# Address and prefix length for wg0, for example 192.168.200.1/24.
+address =
+listen_port = 51820