74 lines
2.0 KiB
Bash
Executable File
74 lines
2.0 KiB
Bash
Executable File
#!/bin/sh
|
|
#
|
|
# Example: unattended install and configuration of vpn-router on an existing
|
|
# host. Run as root. Adjust the values below, or set them in the environment.
|
|
#
|
|
# This is the same end state as the cloud-init example and as configuring the
|
|
# router by hand; only the way the file is written differs.
|
|
|
|
set -e
|
|
|
|
DEB="${DEB:-./vpn-router_1.0.0-1_all.deb}"
|
|
|
|
PLATFORM="${PLATFORM:-generic}"
|
|
EXTERNAL_INTERFACE="${EXTERNAL_INTERFACE:-eth0}"
|
|
INTERNAL_INTERFACE="${INTERNAL_INTERFACE:-eth1}"
|
|
LOCAL_FQDN="${LOCAL_FQDN:-router.example.com}"
|
|
LOCAL_ID_MODE="${LOCAL_ID_MODE:-fqdn}"
|
|
LOCAL_CIDRS="${LOCAL_CIDRS:-10.0.0.0/24}"
|
|
INT_GATEWAY_IP="${INT_GATEWAY_IP:-10.1.1.1}"
|
|
REMOTE_ADDRS="${REMOTE_ADDRS:-peer.example.net}"
|
|
REMOTE_ID="${REMOTE_ID:-peer.example.net}"
|
|
REMOTE_CIDRS="${REMOTE_CIDRS:-192.168.0.0/24}"
|
|
PSK="${PSK:-change-me}"
|
|
P2S_ENABLED="${P2S_ENABLED:-false}"
|
|
P2S_ADDRESS_POOL="${P2S_ADDRESS_POOL:-172.16.0.0/24}"
|
|
P2S_CA_NAME="${P2S_CA_NAME:-VPN Router CA}"
|
|
WG_ENABLED="${WG_ENABLED:-false}"
|
|
WG_ADDRESS="${WG_ADDRESS:-}"
|
|
WG_LISTEN_PORT="${WG_LISTEN_PORT:-51820}"
|
|
|
|
# Write the configuration before installing, so postinst leaves it alone.
|
|
install -d -m 0755 /etc/vpn-router
|
|
umask 077
|
|
cat > /etc/vpn-router/vpn-router.conf <<EOF
|
|
[general]
|
|
platform = ${PLATFORM}
|
|
|
|
[interfaces]
|
|
external = ${EXTERNAL_INTERFACE}
|
|
internal = ${INTERNAL_INTERFACE}
|
|
|
|
[wan]
|
|
local_fqdn = ${LOCAL_FQDN}
|
|
local_id_mode = ${LOCAL_ID_MODE}
|
|
|
|
[local]
|
|
cidrs = ${LOCAL_CIDRS}
|
|
int_gateway_ip = ${INT_GATEWAY_IP}
|
|
|
|
[remote]
|
|
addrs = ${REMOTE_ADDRS}
|
|
id = ${REMOTE_ID}
|
|
cidrs = ${REMOTE_CIDRS}
|
|
psk_b64 = $(printf %s "$PSK" | base64 -w0)
|
|
|
|
[p2s]
|
|
enabled = ${P2S_ENABLED}
|
|
address_pool = ${P2S_ADDRESS_POOL}
|
|
ca_name = ${P2S_CA_NAME}
|
|
|
|
[wireguard]
|
|
enabled = ${WG_ENABLED}
|
|
address = ${WG_ADDRESS}
|
|
listen_port = ${WG_LISTEN_PORT}
|
|
EOF
|
|
umask 022
|
|
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y "$DEB"
|
|
|
|
# Installing starts vpn-router-setup, which applies the file above. Restart it
|
|
# explicitly after any later edit.
|
|
systemctl restart vpn-router-setup
|
|
systemctl --no-pager status vpn-router-setup
|