#!/bin/sh
#
# Example: unattended install and configuration of vpn-router on an existing
# host. Run as root. Adjust the values below, or set them in the environment.
#
# This is the same end state as the cloud-init example and as configuring the
# router by hand; only the way the file is written differs.

set -e

DEB="${DEB:-./vpn-router_1.0.0-1_all.deb}"

PLATFORM="${PLATFORM:-generic}"
MODE="${MODE:-manual}"
EXTERNAL_INTERFACE="${EXTERNAL_INTERFACE:-eth0}"
INTERNAL_INTERFACE="${INTERNAL_INTERFACE:-eth1}"
LOCAL_FQDN="${LOCAL_FQDN:-router.example.com}"
LOCAL_ID_MODE="${LOCAL_ID_MODE:-fqdn}"
LOCAL_CIDRS="${LOCAL_CIDRS:-10.0.0.0/24}"
INT_ADDR="${INT_ADDR:-10.1.1.4}"
INT_GATEWAY_IP="${INT_GATEWAY_IP:-10.1.1.1}"
REMOTE_ADDRS="${REMOTE_ADDRS:-peer.example.net}"
REMOTE_ID="${REMOTE_ID:-peer.example.net}"
REMOTE_CIDRS="${REMOTE_CIDRS:-192.168.0.0/24}"
PSK="${PSK:-change-me}"
P2S_ENABLED="${P2S_ENABLED:-false}"
P2S_ADDRESS_POOL="${P2S_ADDRESS_POOL:-172.16.0.0/24}"
P2S_CA_NAME="${P2S_CA_NAME:-VPN Router CA}"
WG_ENABLED="${WG_ENABLED:-false}"
WG_ADDRESS="${WG_ADDRESS:-}"
WG_LISTEN_PORT="${WG_LISTEN_PORT:-51820}"

# Write the configuration before installing, so postinst leaves it alone.
install -d -m 0755 /etc/vpn-router
umask 077
cat > /etc/vpn-router/vpn-router.conf <<EOF
[general]
platform = ${PLATFORM}
mode = ${MODE}

[interfaces]
external = ${EXTERNAL_INTERFACE}
internal = ${INTERNAL_INTERFACE}

[wan]
local_fqdn = ${LOCAL_FQDN}
local_id_mode = ${LOCAL_ID_MODE}

[local]
cidrs = ${LOCAL_CIDRS}
int_addr = ${INT_ADDR}
int_gateway_ip = ${INT_GATEWAY_IP}

[remote]
addrs = ${REMOTE_ADDRS}
id = ${REMOTE_ID}
cidrs = ${REMOTE_CIDRS}
psk_b64 = $(printf %s "$PSK" | base64 -w0)

[p2s]
enabled = ${P2S_ENABLED}
address_pool = ${P2S_ADDRESS_POOL}
ca_name = ${P2S_CA_NAME}

[wireguard]
enabled = ${WG_ENABLED}
address = ${WG_ADDRESS}
listen_port = ${WG_LISTEN_PORT}
EOF
umask 022

DEBIAN_FRONTEND=noninteractive apt-get install -y "$DEB"

# Installing starts vpn-router-setup, which applies the file above. Restart it
# explicitly after any later edit.
systemctl restart vpn-router-setup
systemctl --no-pager status vpn-router-setup