Reengineed the code. Generalized the package. Cloud configurators are modules.

2026-08-10 09:02:45 +02:00
parent be4bb34bb0
commit 083ad9a596
40 changed files with 2367 additions and 650 deletions
@@ -0,0 +1,88 @@
+#cloud-config
+#
+# Example: install and configure vpn-router during first boot.
+#
+# This is one way to reach the state described in README.md, not an interface
+# the package depends on. It writes the configuration file directly, which
+# keeps everything in one place and works the same whether or not debconf is
+# involved.
+#
+# Template variables are Terraform templatefile() placeholders. Adapt or drop
+# them for whatever renders this file.
+
+hostname: ${hostname}
+fqdn: ${fqdn}
+manage_etc_hosts: false
+
+apt:
+  sources:
+    vpn-router:
+      source: "deb [signed-by=/etc/apt/keyrings/vpn-router.gpg] ${repo_url} ${ubuntu_codename} main"
+      key: |
+        ${indent(8, trimspace(repo_gpg_key))}
+
+write_files:
+  # The configuration file. Created here before the package is installed, so
+  # postinst leaves it alone.
+  - path: /etc/vpn-router/vpn-router.conf
+    permissions: '0600'
+    owner: root:root
+    content: |
+      [general]
+      platform = ${platform}
+
+      [interfaces]
+      external = ${external_interface}
+      internal = ${internal_interface}
+
+      [wan]
+      local_fqdn = ${fqdn}
+      local_id_mode = ${local_id_mode}
+
+      [local]
+      cidrs = ${local_cidrs}
+      int_gateway_ip = ${int_gateway_ip}
+
+      [remote]
+      addrs = ${remote_addrs}
+      id = ${remote_id}
+      cidrs = ${remote_cidrs}
+      psk_b64 = ${psk_b64}
+
+      [p2s]
+      enabled = ${p2s_enabled}
+      address_pool = ${p2s_address_pool}
+      ca_name = ${p2s_ca_name}
+
+      [wireguard]
+      enabled = ${wg_enabled}
+      address = ${wg_address}
+      listen_port = ${wg_listen_port}
+
+  # Optional: supply your own PKI instead of letting the package create a CA.
+  # Remove these three entries to have a local CA generated on first boot.
+  # <label> is the first component of the FQDN, for example "router" in
+  # router.example.com.
+  - path: /etc/vpn-router/pki/ca_cert.pem
+    permissions: '0644'
+    owner: root:root
+    content: |
+      ${indent(6, trimspace(ca_cert))}
+  - path: /etc/vpn-router/pki/${label}_cert.pem
+    permissions: '0644'
+    owner: root:root
+    content: |
+      ${indent(6, trimspace(server_cert))}
+  - path: /etc/vpn-router/pki/${label}_key.pem
+    permissions: '0600'
+    owner: root:root
+    content: |
+      ${indent(6, trimspace(server_key))}
+
+package_update: true
+
+packages:
+  - vpn-router
+
+# Nothing further is required: installing the package starts
+# vpn-router-setup, which applies the configuration written above.
@@ -0,0 +1,73 @@
+#!/bin/sh
+#
+# Example: unattended install and configuration of vpn-router on an existing
+# host. Run as root. Adjust the values below, or set them in the environment.
+#
+# This is the same end state as the cloud-init example and as configuring the
+# router by hand; only the way the file is written differs.
+
+set -e
+
+DEB="${DEB:-./vpn-router_1.0.0-1_all.deb}"
+
+PLATFORM="${PLATFORM:-generic}"
+EXTERNAL_INTERFACE="${EXTERNAL_INTERFACE:-eth0}"
+INTERNAL_INTERFACE="${INTERNAL_INTERFACE:-eth1}"
+LOCAL_FQDN="${LOCAL_FQDN:-router.example.com}"
+LOCAL_ID_MODE="${LOCAL_ID_MODE:-fqdn}"
+LOCAL_CIDRS="${LOCAL_CIDRS:-10.0.0.0/24}"
+INT_GATEWAY_IP="${INT_GATEWAY_IP:-10.1.1.1}"
+REMOTE_ADDRS="${REMOTE_ADDRS:-peer.example.net}"
+REMOTE_ID="${REMOTE_ID:-peer.example.net}"
+REMOTE_CIDRS="${REMOTE_CIDRS:-192.168.0.0/24}"
+PSK="${PSK:-change-me}"
+P2S_ENABLED="${P2S_ENABLED:-false}"
+P2S_ADDRESS_POOL="${P2S_ADDRESS_POOL:-172.16.0.0/24}"
+P2S_CA_NAME="${P2S_CA_NAME:-VPN Router CA}"
+WG_ENABLED="${WG_ENABLED:-false}"
+WG_ADDRESS="${WG_ADDRESS:-}"
+WG_LISTEN_PORT="${WG_LISTEN_PORT:-51820}"
+
+# Write the configuration before installing, so postinst leaves it alone.
+install -d -m 0755 /etc/vpn-router
+umask 077
+cat > /etc/vpn-router/vpn-router.conf <<EOF
+[general]
+platform = ${PLATFORM}
+
+[interfaces]
+external = ${EXTERNAL_INTERFACE}
+internal = ${INTERNAL_INTERFACE}
+
+[wan]
+local_fqdn = ${LOCAL_FQDN}
+local_id_mode = ${LOCAL_ID_MODE}
+
+[local]
+cidrs = ${LOCAL_CIDRS}
+int_gateway_ip = ${INT_GATEWAY_IP}
+
+[remote]
+addrs = ${REMOTE_ADDRS}
+id = ${REMOTE_ID}
+cidrs = ${REMOTE_CIDRS}
+psk_b64 = $(printf %s "$PSK" | base64 -w0)
+
+[p2s]
+enabled = ${P2S_ENABLED}
+address_pool = ${P2S_ADDRESS_POOL}
+ca_name = ${P2S_CA_NAME}
+
+[wireguard]
+enabled = ${WG_ENABLED}
+address = ${WG_ADDRESS}
+listen_port = ${WG_LISTEN_PORT}
+EOF
+umask 022
+
+DEBIAN_FRONTEND=noninteractive apt-get install -y "$DEB"
+
+# Installing starts vpn-router-setup, which applies the file above. Restart it
+# explicitly after any later edit.
+systemctl restart vpn-router-setup
+systemctl --no-pager status vpn-router-setup