slawek
7cb2f1b8dd
Add platform = none as the shipped default so installing the package changes nothing on the machine until a platform is chosen. Add a mode setting (manual/interfaces/auto) controlling how much of the network configuration is supplied versus detected from the system. Manage /etc/vpn-router/vpn-router.conf with ucf instead of writing it once, so dpkg-reconfigure can safely reapply debconf answers without clobbering local edits. Extend NAT/forward rules to all local subnets, not just the first.
68 lines
3.3 KiB
Bash
Executable File
68 lines
3.3 KiB
Bash
Executable File
#!/bin/sh
|
|
set -e
|
|
. /usr/share/debconf/confmodule
|
|
|
|
case "$1" in
|
|
configure)
|
|
# --- Read the installer's answers ---
|
|
db_get vpn-router/platform; VPN_ROUTER_PLATFORM="$RET"
|
|
db_get vpn-router/mode; VPN_ROUTER_MODE="$RET"
|
|
db_get vpn-router/int_addr; VPN_ROUTER_INT_ADDR="$RET"
|
|
db_get vpn-router/external_interface; VPN_ROUTER_EXTERNAL_INTERFACE="$RET"
|
|
db_get vpn-router/internal_interface; VPN_ROUTER_INTERNAL_INTERFACE="$RET"
|
|
db_get vpn-router/local_fqdn; VPN_ROUTER_LOCAL_FQDN="$RET"
|
|
db_get vpn-router/local_id_mode; VPN_ROUTER_LOCAL_ID_MODE="$RET"
|
|
db_get vpn-router/local_cidrs; VPN_ROUTER_LOCAL_CIDRS="$RET"
|
|
db_get vpn-router/int_gateway_ip; VPN_ROUTER_INT_GATEWAY_IP="$RET"
|
|
db_get vpn-router/remote_addrs; VPN_ROUTER_REMOTE_ADDRS="$RET"
|
|
db_get vpn-router/remote_id; VPN_ROUTER_REMOTE_ID="$RET"
|
|
db_get vpn-router/remote_cidrs; VPN_ROUTER_REMOTE_CIDRS="$RET"
|
|
db_get vpn-router/psk; VPN_ROUTER_PSK="$RET"
|
|
db_get vpn-router/p2s_enabled; VPN_ROUTER_P2S_ENABLED="$RET"
|
|
db_get vpn-router/p2s_address_pool; VPN_ROUTER_P2S_ADDRESS_POOL="$RET"
|
|
db_get vpn-router/p2s_ca_name; VPN_ROUTER_P2S_CA_NAME="$RET"
|
|
db_get vpn-router/wg_enabled; VPN_ROUTER_WG_ENABLED="$RET"
|
|
db_get vpn-router/wg_address; VPN_ROUTER_WG_ADDRESS="$RET"
|
|
db_get vpn-router/wg_listen_port; VPN_ROUTER_WG_LISTEN_PORT="$RET"
|
|
|
|
export VPN_ROUTER_PLATFORM VPN_ROUTER_MODE VPN_ROUTER_INT_ADDR \
|
|
VPN_ROUTER_EXTERNAL_INTERFACE \
|
|
VPN_ROUTER_INTERNAL_INTERFACE VPN_ROUTER_LOCAL_FQDN \
|
|
VPN_ROUTER_LOCAL_ID_MODE VPN_ROUTER_LOCAL_CIDRS \
|
|
VPN_ROUTER_INT_GATEWAY_IP \
|
|
VPN_ROUTER_REMOTE_ADDRS VPN_ROUTER_REMOTE_ID \
|
|
VPN_ROUTER_REMOTE_CIDRS VPN_ROUTER_PSK \
|
|
VPN_ROUTER_P2S_ENABLED VPN_ROUTER_P2S_ADDRESS_POOL \
|
|
VPN_ROUTER_P2S_CA_NAME VPN_ROUTER_WG_ENABLED \
|
|
VPN_ROUTER_WG_ADDRESS VPN_ROUTER_WG_LISTEN_PORT
|
|
|
|
# --- Hand a candidate configuration to ucf ---
|
|
# ucf compares it against the file in /etc and decides what to do about
|
|
# local changes, prompting through debconf only for a real conflict.
|
|
# This is what makes dpkg-reconfigure apply without destroying edits.
|
|
CANDIDATE="$(mktemp)"
|
|
/usr/lib/vpn-router/generate-config "$CANDIDATE"
|
|
ucf --three-way --debconf-ok "$CANDIDATE" /etc/vpn-router/vpn-router.conf
|
|
ucfr vpn-router /etc/vpn-router/vpn-router.conf
|
|
chmod 0600 /etc/vpn-router/vpn-router.conf
|
|
rm -f "$CANDIDATE"
|
|
|
|
# The key now lives in the configuration file; do not keep a copy. An
|
|
# empty answer means "leave alone" next time, so clearing it here does
|
|
# not blank the key on the next dpkg-reconfigure.
|
|
db_set vpn-router/psk ""
|
|
|
|
# Apply the sysctl drop-in shipped by this package so it takes effect
|
|
# without waiting for a reboot.
|
|
sysctl --system >/dev/null
|
|
|
|
# The firewall is not touched here. Enabling it, allowing SSH and
|
|
# setting the forward policy all belong to vpn-router-setup, which does
|
|
# them only once the configuration says this host is a router.
|
|
;;
|
|
esac
|
|
|
|
#DEBHELPER#
|
|
|
|
db_stop
|